# authentik

> Bring all of your authentication into a unified platform.

This file contains the full text of all authentik documentation pages, following the llmstxt.org convention.

Related: [Integrations](https://integrations.goauthentik.io/llms.txt)

## Welcome to authentik

## What is authentik?

authentik is an IdP (Identity Provider) and SSO (Single Sign-On) platform that is built with security at the forefront of every piece of code and every feature, with an emphasis on flexibility and versatility.

With authentik, site administrators, application developers, and security engineers have a dependable and secure solution for authentication in almost any type of environment. There are robust recovery actions available for the users and applications, including user profile and password management. You can quickly edit, deactivate, or even impersonate a user profile, and set a new password for new users or reset an existing password.

You can use authentik in an existing environment to add support for new protocols, so introducing authentik to your current tech stack doesn't present re-architecting challenges. We support all of the major providers, such as OAuth2, SAML, LDAP, and SCIM, so you can pick the protocol that you need for each application.

We offer two versions of authentik: the forever-free open source project upon which everything is built, and our source available Enterprise version, with a Support center and additional features.

## User-focused & task-oriented dashboards

The authentik product provides the following consoles:

- **Flow interface**: [*Flows*](./add-secure-apps/flows-stages/flow/index.mdx) are the steps by which the various *Stages* of a login and authentication process occur. A stage represents a single verification or logic step in the sign-on process. authentik allows for the customization and exact definition of these flows.

- **User interface**: this console view in authentik displays all of the applications and integrations in which you have implemented authentik. Click on the app that you want to access to open it, or drill down to edit its configuration in the admin interface.

- **Admin interface**: a visual tool for the creation and management of users and groups, tokens and credentials, application integrations, events, and the Flows that define standard and customizable login and authentication processes. Easy-to-read visual dashboards display system status, recent logins and authentication events, and application usage.

In authentik, you can use Light or Dark mode for the Flow interface, User interface, and the Admin interface.

## Documentation

Our tech docs cover the typical topics, from installation to configuration, adding providers, defining policies and creating login flows, event monitoring, security, and attributes. [Enterprise](./enterprise/index.mdx) version documentation is included here, within our standard tech docs.

- For information about integrating a specific application or software into authentik, refer to our **Integrations** section, accessible from the top menu bar.

- For developer-focused documentation, such as using our APIs and blueprints, setting up your development environment, translations, or how to contribute, refer to the [**Developer**](./developer-docs/index.mdx) area, accessible from the top menu bar.

## Installation

Refer to the installation steps for either [Docker Compose](./install-config/install/docker-compose.mdx) or [Kubernetes](./install-config/install/kubernetes.mdx).

For more information about configuration, beta versions, and additional installation options, see our main [Installation](./install-config/index.mdx) section.

---

## Architecture

authentik consists of a handful of components, most of which are required for a functioning setup.

```mermaid
graph LR
    user(User) --> ak_server(authentik Server)
    ak_server --> ak_server_core(authentik Server Core)
    ak_server --> ak_outpost(Embedded outpost)
    ak_server_core --> db(PostgreSQL)
    ak_worker(Background Worker) --> db(PostgreSQL)
```

### Server

The server container consists of two sub-components, the actual server itself and the embedded outpost. Incoming requests to the server container(s) are routed by a lightweight router to either the *Core* server or the embedded outpost. This router also handles requests for any static assets such as JavaScript and CSS files.

#### Core

The core sub-component handles most of authentik's logic, such as API requests, flow executions, any kind of SSO requests, etc.

#### Embedded outpost

Similar to [other outposts](../add-secure-apps/outposts/index.mdx), this outpost allows using [Proxy providers](../add-secure-apps/providers/proxy/index.mdx) without deploying a separate outpost.

#### Persistence

- `/data` is used to store uploaded files (icons, flow backgrounds, etc.) and CSV reports. If not mounted, authentik will allow you to use external URLs for icons and other media fields instead of uploading files. See [Files](../customize/files.mdx) and [File picker values](../customize/file-picker.mdx) for more information.

### Worker

This container executes background tasks, such as sending emails, the event notification system, and everything you can see on the *System Tasks* page in the Admin interface.

#### Persistence

- `/certs` is used for authentik to import external certs, which in most cases shouldn't be used for SAML, but if you use authentik without a reverse proxy, this can be used, for example, for the [Let's Encrypt integration](../sys-mgmt/certificates.mdx#lets-encrypt-integration).
- `/templates` is used for [custom email templates](../add-secure-apps/flows-stages/stages/email/index.mdx#custom-templates), and as with the others is fully optional.

### PostgreSQL

authentik uses PostgreSQL to store all of its configuration and other data (excluding uploaded files).

#### Persistence

- `/var/lib/postgresql/data` is used to store the PostgreSQL database

On Kubernetes, with the default Helm chart and using the packaged PostgreSQL sub-chart, persistent data is stored in a PVC.

---

## File picker values

Many fields in the authentik Admin interface use the same file picker. You can use it to select an uploaded file, reference a built-in static asset, point at an external URL, or use a Font Awesome icon.

This applies to:

- **System** > **Brands** > **Logo**
- **System** > **Brands** > **Favicon**
- **System** > **Brands** > **Default flow background**
- **Flows and Stages** > **Flows** > **Background**
- **Applications** > **Applications** > **Icon**
- **Applications** > **New Application** wizard > **Icon**
- **Directory** > **Federation and Social login** > source **Icon** fields for SAML, OAuth, Plex, and Kerberos sources

## Accepted values

The file picker accepts the following value types.

| Value type            | Example                                         | Notes                                                                                                                                                                                                                         |
| --------------------- | ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Uploaded file path    | `branding/company-logo.svg`                     | Relative path to a file stored in authentik's media storage. You can upload these from **Customization** > **Files**. When authentik serves these files, it uses a short-lived protected URL rather than a fixed public path. |
| Built-in static asset | `/static/dist/assets/icons/icon_left_brand.svg` | Absolute path to a built-in asset shipped with authentik.                                                                                                                                                                     |
| External URL          | `https://cdn.example.com/branding/logo.svg`     | Useful when files are hosted outside authentik.                                                                                                                                                                               |
| Font Awesome icon     | `fa://fa-circle-user`                           | Supported for icon fields. This is not useful for background image fields.                                                                                                                                                    |

When you open the picker, authentik lists uploaded files and built-in static assets. You can also type a custom value directly into the field.

## Theme-aware values with `%(theme)s`

Some assets can change based on whether the active theme is light or dark. For those cases, you can use the placeholder `%(theme)s` in the path or URL.

Examples:

- `branding/logo-%(theme)s.svg`
- `branding/background-%(theme)s.jpg`
- `/static/dist/assets/icons/icon-%(theme)s.svg`
- `https://cdn.example.com/assets/logo-%(theme)s.svg`

authentik resolves `%(theme)s` to:

- `light`
- `dark`

`automatic` is not substituted directly. When a user is set to automatic theme selection, authentik chooses either the light or dark asset first and then uses the matching resolved URL.

This resolution happens on the backend, which means it also works with storage backends that need signed URLs, such as S3.

The `%(theme)s` placeholder is supported in all current Admin interface fields that use the shared file picker:

- Brand **Logo**
- Brand **Favicon**
- Brand **Default flow background**
- Flow **Background**
- Application **Icon**
- Source **Icon**

## Upload and path rules

When uploading a file in **Customization** > **Files**, or when typing a relative media path manually, use these rules:

- If a file exists at `/data/media/public/branding/logo.svg`, enter `branding/logo.svg` in the picker field - without a leading slash. Do not enter `/data/media/public/branding/logo.svg` or `/branding/logo.svg`.
- Files uploaded through **Customization** > **Files** are always served through a temporary protected URL
- On S3 storage, authentik generates a presigned S3 URL
- On local file storage, authentik generates an authentik `/files/...` URL with a unique signed token
- Uploaded files can be up to 25 MB each
- Allowed characters are letters, numbers, `.`, `_`, `-`, and `/`
- `%(theme)s` is also allowed anywhere in the path
- Paths must be relative, not absolute
- Parent directory references such as `..` are not allowed
- Duplicate slashes such as `//` are not allowed
- Paths cannot start with `.`
- The full path can be up to 1024 characters long
- Each path segment can be up to 255 characters long

Examples of valid upload names:

- `branding/logo.svg`
- `branding/logo-%(theme)s.svg`
- `sources/oauth/company-icon.png`

If you rename a file during upload, authentik keeps the original file extension.

---

## Files

Image files are used in authentik to add icons to new applications or sources, and to define the ["branded" look](../customize/branding/index.mdx#branding-settings) of the authentik interface, with your company's logo and title, a favicon, or a background image for the flows.

authentik provides a centralized file management system for storing and organizing these files. Files can be uploaded and managed from **Customization** > **Files** in the Admin interface. By default, files are stored on disk in the `/data` directory, but [S3 storage](../sys-mgmt/ops/storage-s3/index.mdx) can also be configured.

If file uploads are missing or unavailable after an upgrade, see [Errors when uploading icons](../troubleshooting/image_upload.mdx).

## Storage requirements

Local uploads require a writable volume mounted at the configured storage path or its usage subdirectory, such as `/data/media`, shared by the server and worker. Setting the path alone does not enable uploads. See [Volume permissions](../troubleshooting/image_upload.mdx#1-permissions-problems) for the required ownership and permissions.

## Upload and manage files

To upload and use image files, follow these steps:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Files**.

   Here you can upload a new file, delete a file, and search for a file that you already uploaded.

Fields such as brand logos, favicons, flow backgrounds, application icons, and source icons all use the same file picker. Those fields can accept uploaded files, built-in static assets, external URLs, Font Awesome icons, and theme-aware paths using `%(theme)s`.

See [File picker values](./file-picker.mdx) for the full list of supported values and path rules.

## Technical deep dive

You can skip this section if you only need to upload or reference files.

The shared file picker is a UI on top of the files API and the storage backends. The frontend stores the selected value as a string such as a relative media path, a static asset path, an external URL, or a `fa://...` icon reference.

```mermaid
flowchart LR
    A["Admin user"] --> B["Admin interface<br/>ak-file-search-input / ak-file-upload-form"]
    B --> C["authentik server router<br/>(lightweight Go router / proxy)"]
    C --> D["authentik Core backend"]
    D --> E["FileView API<br/>/api/v3/admin/file/"]
    E --> F["FileManager"]
    F --> G["StaticBackend"]
    F --> H["PassthroughBackend"]
    F --> I["FileBackend"]
    F --> J["S3Backend"]
    I --> K["Local media storage<br/>/data/..."]
    J --> L["S3-compatible object storage"]

    E -. "returns file list with name, url,<br/>mime_type, themed_urls" .-> B
    B -. "selected value saved on object<br/>(brand, flow, application, source)" .-> D
```

- The frontend calls the files API to list selectable entries
- The files API asks the `FileManager` to list files and resolve each file into a `url`
- The `FileManager` picks the first backend that supports the value
- For uploaded files, the management backend is either local file storage or S3
- For built-in assets, the static backend returns `/static/...` paths
- For external URLs and `fa://...` values, the passthrough backend returns the value unchanged
- For uploads, the backend validates the file size and path rules before writing to local storage or S3

When a value contains `%(theme)s`, authentik can return both a single `url` and a `themed_urls` map:

```mermaid
flowchart LR
    A["Stored value<br/>branding/logo-%(theme)s.svg"] --> B["FileManager"]
    B --> C["file_url(name)<br/>raw URL for stored value"]
    B --> D["themed_urls(name)"]
    D --> E["light -> .../logo-light.svg"]
    D --> F["dark -> .../logo-dark.svg"]

    C --> G["API response"]
    E --> G
    F --> G
```

- The files API can return `themed_urls` for picker entries
- The current-brand/config response and the flow, application, and source APIs expose themed URL fields for assets that support them
- Those fields include `branding_logo_themed_urls`, `branding_favicon_themed_urls`, `background_themed_urls`, `meta_icon_themed_urls`, and `icon_themed_urls`
- The frontend uses those pre-resolved themed URLs to pick the correct asset for light or dark mode
- This is especially important for S3-backed media, where each themed variant may need its own presigned URL

---

## Customize your instance

You can customize the behavior, look, and available resources for your authentik instance. For more information, refer to each of the topics below:

---

## Contributing to authentik

:+1::tada: Thanks for taking the time to contribute! \:tada::+1:

The following is a set of guidelines for contributing to authentik and its components, which are hosted in the [goauthentik Organization](https://github.com/goauthentik) on GitHub. These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.

We appreciate contributions of code, documentation, enhancements, and bug fixes. Read more [below](#how-can-i-contribute) about the many ways to contribute.

## Code of conduct

We expect all contributors to act professionally and respectfully in all interactions. If there's something you dislike or think can be done better, tell us! We'd love to hear any suggestions for improvement.

## Ask a question

Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=\&labels=question\&template=question.md\&title=) or join [the Discord server](https://goauthentik.io/discord?utm_source=developer-docs).

## What should I know before I get started?

### The components

authentik consists of a few larger components:

- `authentik/` — The Django application server and source of truth for authentik's identity features.
- `cmd/` and `internal/` — Go outposts and the front reverse proxy.
- `src/` and `packages/ak-*` — Native Rust server, worker, and shared components.
- `web/` — The TypeScript web interfaces, built with Lit and PatternFly.
- `website/` — The Docusaurus documentation, integrations, and API sites.

### authentik's structure

authentik is at its very core a Django project. It consists of many individual Django applications. These applications are intended to separate concerns, and they may share code between each other.

These are the current packages:

```
authentik
├── admin - Administrative tasks and APIs, no models (Version updates, Metrics, system tasks)
├── api - General API Configuration (Routes, Schema and general API utilities)
├── blueprints - Handle managed models and their state.
├── core - Core authentik functionality, central routes, core Models
├── crypto - Cryptography, currently used to generate and hold Certificates and Private Keys
├── enterprise - Enterprise features, which are source available but not open source
├── events - Event Log, middleware and signals to generate signals
├── flows - Flows, the FlowPlanner and the FlowExecutor, used for all flows for authentication, authorization, etc
├── lib - Generic library of functions, few dependencies on other packages.
├── outposts - Configure and deploy outposts on Kubernetes and Docker.
├── policies - General PolicyEngine
│   ├── dummy - A Dummy policy used for testing
│   ├── event_matcher - Match events based on different criteria
│   ├── expiry - Check when a user's password was last set
│   ├── expression - Execute any arbitrary python code
│   ├── password - Check a password against several rules
│   └── reputation - Check the user's/client's reputation
├── providers
│   ├── ldap - Provide LDAP access to authentik users/groups using an outpost
│   ├── oauth2 - OIDC-compliant OAuth2 provider
│   ├── proxy - Provides an identity-aware proxy using an outpost
│   ├── radius - Provides a RADIUS server that authenticates using flows
│   ├── saml - SAML2 provider
│   └── scim - SCIM provider
├── recovery - Generate keys to use in case you lock yourself out
├── root - Root Django application, contains global settings and routes
├── sources
│   ├── kerberos - Sync Kerberos users into authentik
│   ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
│   ├── oauth - OAuth1 and OAuth2 source
│   ├── plex - Plex source
│   ├── saml - SAML2 source
│   └── telegram - Telegram source
├── stages
│   ├── authenticator_duo - Configure a DUO authenticator
│   ├── authenticator_static - Configure TOTP backup keys
│   ├── authenticator_totp - Configure a TOTP authenticator
│   ├── authenticator_validate - Validate any authenticator
│   ├── authenticator_webauthn - Configure a WebAuthn / Passkeys authenticator
│   ├── captcha - Make the user pass a captcha
│   ├── consent - Let the user decide if they want to consent to an action
│   ├── deny - Static deny, can be used with policies
│   ├── dummy - Dummy stage to test
│   ├── email - Send the user an email and block execution until they click the link
│   ├── identification - Identify a user with any combination of fields
│   ├── invitation - Invitation system to limit flows to certain users
│   ├── password - Password authentication
│   ├── prompt - Arbitrary prompts
│   ├── user_delete - Delete the currently pending user
│   ├── user_login - Login the currently pending user
│   ├── user_logout - Logout the currently pending user
│   └── user_write - Write any currently pending data to the user.
├── tasks - Background tasks
└── tenants - Soft tenancy, configure defaults and branding per domain
```

This Django project is running in gunicorn, which spawns multiple workers and threads. Gunicorn is run from a lightweight Go application that reverse-proxies the application and handles static files.

There are also several background tasks that run in Dramatiq, via the `django-dramatiq-postgres` package, with some additional helpers in `authentik.tasks`.

## How can I contribute?

### Reporting bugs

This section guides you through submitting a bug report for authentik. Following these guidelines helps maintainers and the community understand your report, reproduce the behavior, and find related reports.

Whenever authentik encounters an error, it will be logged as an Event with the type `system_exception`. This event type has a button to directly open a pre-filled GitHub issue form.

This form will have the full stack trace of the error that occurred and shouldn't contain any sensitive data.

### Suggesting enhancements

This section guides you through submitting an enhancement suggestion for authentik, including completely new features and minor improvements to existing functionality. Following these guidelines helps maintainers and the community understand your suggestion and find related suggestions.

When you are creating an enhancement suggestion, please fill in [the template](https://github.com/goauthentik/authentik/issues/new?assignees=\&labels=enhancement\&template=feature_request.md\&title=), including the steps that you imagine you would take if the feature you're requesting existed.

### Your first code contribution

#### Local development

authentik can be run locally, although depending on which part you want to work on, different prerequisites are required.

This is documented in the [developer docs](./setup/frontend-dev-environment.mdx).

### Help with the docs

Contributions to the technical documentation are greatly appreciated. Open a PR if you have improvements to make or new content to add. If you have questions or suggestions about the documentation, open an Issue. No contribution is too small.

Please be sure to refer to our [Style Guide](../developer-docs/docs/style-guide.mdx) for the docs, and use a [template](./docs/templates/index.mdx) to make it easier for you. The style guidelines are also used for any Integrations documentation, and we have a template for Integrations as well, in our [GitHub repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.mdx`.

### Pull requests

The process described here has several goals:

- Maintain authentik's quality
- Fix problems that are important to users
- Engage the community in working toward the best possible authentik
- Enable a sustainable system for authentik's maintainers to review contributions

#### Always use feature branches

**DO NOT open pull requests from your `main` branch.** Always create a feature branch for your changes.

Here's one way to do it correctly (your own preferred git commands may differ):

```bash
# Create and switch to a new feature branch
git checkout -b feature/my-awesome-feature

# Make your changes, then commit and push
git add .
git commit -m "providers/oauth2: add awesome feature"
git push -u origin feature/my-awesome-feature
```

Then open your PR from the feature branch.

If you already started working on `main` (even if you've already made commits), you can still recover by creating a branch from your current state, then resetting `main`:

```bash
# Create a new branch with your current changes/commits
git checkout -b feature/my-awesome-feature

# Switch back to main and reset it to match origin
git checkout main
git reset --hard origin/main
```

Your changes are now safely on the feature branch, and `main` is back in sync with the remote.

Please follow these steps to have your contribution considered by the maintainers:

1. Follow the [style guides](#style-guides)
2. After you submit your pull request, verify that all [status checks](https://help.github.com/articles/about-status-checks/) are passing What if the status checks are failing?If a status check is failing, and you believe that the failure is unrelated to your change, please leave a comment on the pull request explaining why you believe the failure is unrelated. A maintainer will re-run the status check for you. If we conclude that the failure was a false positive, then we will open an issue to track that problem with our status check suite.
3. Ensure your code has tests. While it is not always possible to test every single case, the majority of the code should be tested.

While the prerequisites above must be satisfied prior to having your pull request reviewed, the reviewer(s) may ask you to complete additional design work, tests, or other changes before your pull request can be ultimately accepted.

## Style guides

### PR naming

- Use the format of `<package>: <verb> <description>`
  - See [authentik's structure](#authentiks-structure) for `package`.
  - Examples:
    `providers/saml2: fix parsing of requests`
    `website/docs: add config info for GWS`

### Git commit messages

- Use the format of `<package>: <verb> <description>`
  - See [authentik's structure](#authentiks-structure) for `package`.
  - Example: `providers/saml2: fix parsing of requests`
- Reference issues and pull requests liberally after the first line
- Naming of commits within a PR does not need to adhere to the guidelines as we squash merge PRs

### Python style guide

All Python code is linted with [black](https://black.readthedocs.io/en/stable/) and [Ruff](https://docs.astral.sh/ruff).

The required Python version is defined in the repository's [`pyproject.toml`](https://github.com/goauthentik/authentik/blob/main/pyproject.toml).

- Use native type-annotations wherever possible.
- Add meaningful docstrings when possible.
- Ensure any database migrations work properly from the last stable version (this is checked via CI)
- If your code changes central functions, make sure nothing else is broken.

### Documentation style guide

Refer to the full [Style Guide](../developer-docs/docs/style-guide.mdx) for details, but here are some important highlights:

- Our product name is authentik, with a lowercase "a" and a "k" on the end. Our company name is Authentik Security.

- We use sentence case in our titles and headings.

- We use **bold** text to name UI components, and *italic* text for variables.

- Documentation pages are `.mdx`. Ordinary Markdown prose works as usual; add components such as tabs when the page needs them.

---

## Developer Documentation

We're thrilled you're here! 🎉 Thanks for jumping in to contribute to authentik; your ideas, fixes, and features make a real impact. Pick a topic below to dive in and have fun hacking! 🚀 Even small PRs and typo fixes are hugely appreciated.

---

## Translations

authentik uses [@lit/localize](https://lit.dev/docs/localization/overview/) for frontend translations and [Django's translation tools](https://docs.djangoproject.com/en/5.2/topics/i18n/translation/) for backend messages. English is the source language for both.

- [Translation contributors](#translation-contributors) translate existing messages through Transifex.
- [Code contributors](#code-contributors) mark messages for translation in the source code. Bots extract and compile the translation catalogs in follow-up PRs.

## For translation contributors {#translation-contributors}

Submit translations through the [authentik project on Transifex](https://explore.transifex.com/authentik/authentik/). You do not need to clone the repository, install development tools, or open a PR.

1. Sign in to Transifex and join the project for your language.
2. Choose the frontend or backend resource and translate its messages.
3. Save your translations. The Transifex integration brings them into the repository automatically, and bots compile them in follow-up PRs.

Preserve placeholders, markup, and plural forms when translating. These represent values or formatting that authentik supplies at runtime.

Use Transifex for corrections to existing translations too. Local catalog edits are useful for [previewing a translation](#local-previews), but submit the final translation through Transifex.

## For code contributors {#code-contributors}

In normal code PRs, add or change the marked strings in the source code. Do not extract or compile translations for your PR. Bots handle extraction and compilation in follow-up PRs.

Do not run `make i18n-extract`, `make web-i18n-extract`, or `make core-i18n-extract` as a PR preparation step. Leave generated catalog and compiled translation changes out of your PR, including any generated during a local build or preview.

### Mark frontend strings

Wrap user-visible strings with `msg` from `@lit/localize`:

```typescript

msg("New text to be translated.");
```

For messages containing expressions or HTML, follow the [Lit localization guide](https://lit.dev/docs/localization/overview/).

### Mark backend strings

Use Django's translation functions. For strings declared at module level, such as model field labels, use `gettext_lazy` so that Django translates them when they are used:

```python
from django.utils.translation import gettext_lazy as _

_("New text to be translated.")
```

Use `gettext` for immediate translation while handling a request. In Django templates, use `{% trans %}` or `{% blocktrans %}` after loading `i18n`. See the [Django translation guide](https://docs.djangoproject.com/en/5.2/topics/i18n/translation/) for placeholders, pluralization, and template examples.

### Register a frontend language

Adding support for a new frontend language requires source configuration as well as translations:

1. Add the language tag to `targetLocales` in `web/lit-localize.json`, keeping the existing entries.
2. Add a matching entry to `LocaleLoaderRecord` in `web/src/common/ui/locale/definitions.ts`. For example, a new `sv-SE` locale needs:

    ```typescript
    "sv-SE": () => import("#locales/sv-SE"),
    ```

The locale's catalog uses the same tag, for example `web/xliff/sv-SE.xlf`. The frontend build requires that catalog to exist. For a local preview, generate it with `make web-i18n-extract`, then follow the [frontend preview steps](#frontend-preview). Submit translations through Transifex and leave generated files out of the code PR.

`en` is the source locale. `en-XA` is a generated pseudo-locale for testing the UI and does not need translation.

## Optional local previews {#local-previews}

Use these steps to check how a translation appears in authentik. They are not required for a normal PR. Run commands from the repository root and keep generated translation changes out of your PR.

### Frontend {#frontend-preview}

Set up the [frontend development environment](./setup/frontend-dev-environment.mdx), including the backend that serves your local frontend build.

1. Edit `web/xliff/<locale>.xlf`, such as `web/xliff/de-DE.xlf`, with a text editor or an editor that supports XLIFF. Translate the `<target>` content while preserving the `<source>`, message IDs, and placeholders such as `<x .../>`.
2. Start the frontend watcher. It compiles the catalogs at startup:

    ```shell
    make web-watch
    ```

3. Open your local instance with a `locale` query parameter, for example http://localhost:9000/if/user/?locale=de-DE.

After further `.xlf` edits, rebuild the locale modules in another terminal, then reload the page:

```shell
pnpm --dir web run build-locales
```

The build generates `web/src/locales/` and `web/src/locale-codes.ts`. Edit the XLIFF catalogs rather than these generated files.

### Backend {#backend-preview}

Set up the [full development environment](./setup/full-dev-environment.mdx) and install GNU gettext, which provides `xgettext`, `msgmerge`, and `msgfmt`.

1. Edit `locale/<locale>/LC_MESSAGES/django.po` with a text editor or a PO editor such as [Poedit](https://poedit.net/). Translate `msgstr` entries while preserving `msgid` values, placeholders, and plural forms. Backend directory names can differ from frontend language tags; for example, German uses `de_DE` in the backend and `de-DE` in the frontend.
2. Compile the catalog, using German as an example:

    ```shell
    uv run ak compilemessages -l de_DE
    ```

3. Restart the local backend and select the language in authentik to check the translated messages. Django loads the generated `django.mo` file at runtime.

### Extract new strings for a preview

If a string you added is missing from the local catalogs, extract it before translating it locally:

- `make web-i18n-extract` updates the frontend XLIFF catalogs in `web/xliff/`.
- `make core-i18n-extract` updates only the English backend source catalog, `locale/en/LC_MESSAGES/django.po`.
- `make i18n-extract` runs both extraction targets.

To create or refresh a backend catalog for another language locally, specify its locale with Django's extraction command:

```shell
uv run ak makemessages --add-location file --no-obsolete \
    --ignore web --ignore internal --ignore packages/client-ts --ignore website \
    -l de_DE
```

After extraction, follow the frontend or backend preview steps above. Bots perform this work for submitted source changes; these local commands are only for previewing them.

---

## Endpoint Devices

The endpoint devices feature set is currently in early preview and in development. **It is not recommended for production use.**

The features, methods, and even the name are yet to be confirmed.

Breaking changes and bugs should be expected.

An enterprise license is required to access some of these features, refer to the [current features overview table](#features-overview) below for more details.

During this early preview stage, short trial licenses are available for testers. Please contact us via [hello@goauthentik.io](mailto\:hello@goauthentik.io) for more details.

## What are endpoint devices?

Endpoint devices are end-user devices or servers that are registered with authentik.

There are two purposes for registration: [Device authentication](./authentik-agent/device-authentication/index.mdx) and [Device compliance](./device-compliance/index.mdx).

Devices can be registered by installing the [authentik Agent](./authentik-agent/index.mdx) which supports:

- [Device compliance](./device-compliance/index.mdx) by reporting information about endpoint devices to authentik.
- [Local device login](./authentik-agent/device-authentication/local-device-login/index.mdx) with authentik credentials.
- [Connecting via SSH to endpoint devices](./authentik-agent/device-authentication/ssh-authentication.mdx) with authentik credentials.
- [Authenticating to CLI applications](./authentik-agent/device-authentication/cli-app-authentication/index.mdx) such as kubectl and AWS with authentik credentials.

Alternatively, [Connectors](./device-compliance/connectors/index.mdx) allow authentik to be integrated with third-party services such as Fleet. This allows for device information to be reported to authentik for [Device compliance](./device-compliance/index.mdx) purposes.

## Why use endpoint devices?

Endpoint devices offers administrators an alternative to traditional device authentication systems like LDAP for Linux or Active Directory for Windows, while supporting modern MFA methods like FIDO2. This feature set allows authentik to act as a unified authentication platform for devices, servers, and applications.

Meanwhile, Device Compliance allows administrators to make informed decisions about access to applications by verifying device security requirements, like operating system and application versions, before granting access to applications.

## Features overview

| Feature                                                                                        | Linux       | Windows     | macOS       | Status                                                        |
| ---------------------------------------------------------------------------------------------- | ----------- | ----------- | ----------- | ------------------------------------------------------------- |
| [**Local device login**](./authentik-agent/device-authentication/local-device-login/index.mdx) |             |             |             | Available for early preview on Windows and Linux.             |
| [**SSH authentication**](./authentik-agent/device-authentication/ssh-authentication.mdx)       | Open source | Open source | Open source | Available for early preview. Only supports Linux SSH targets. |
| [**Device compliance**](./device-compliance/index.mdx)                                         | Open source | Open source | Open source | Available for early preview.                                  |
| **Advanced device compliance**                                                                 |             |             |             | In development.                                               |
| [**authentik Agent**](./authentik-agent/index.mdx)                                             | Open source | Open source | Open source | Available for early preview.                                  |
| [**Fleet Connector** ](./device-compliance/connectors/fleetdm.mdx)                             |             |             |             | Available for early preview.                                  |
| **Other Connectors** (Entra, Intune, Cloudflare WARP etc)                                      |             |             |             | In development.                                               |

## How to provide feedback and report bugs

Report issues via our [GitHub](https://github.com/goauthentik/platform/issues). Please include as much information as possible to assist us in troubleshooting.

## More information

For more information, refer to each of the topics below:

---

## Manage devices

The Devices page provides a list of all endpoint devices registered with your authentik deployment. Refer to [Device reporting](./device-compliance/device-reporting.mdx) for more details on how [device facts](./device-compliance/device-reporting.mdx#device-facts) are reported to authentik.

Select an endpoint device to view detailed information about it.

## Access the Devices page

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Devices**.
3. Click a device to view its details.

## View device details

After you select an endpoint device, the following tabs are available:

### Device overview

The overview contains:

- **Device details**: The device name, hostname, serial number, operating system, firewall status, and device access group.
- **Hardware**: The manufacturer, model, CPU, memory, disk encryption status, primary disk size, and primary disk usage.
- **Connections**: The enabled [connectors](./device-compliance/connectors/index.mdx) and the time of the last [check-in](./device-compliance/device-reporting.mdx#device-check-in).
- **Users/Groups**: The users and groups that can access the device, as controlled by [device access groups](./authentik-agent/device-authentication/device-access-groups.mdx).

### Processes

Lists the processes that were running on the device when its last check-in occurred.

### Users

Lists all users on the system, along with their username, display name and home directory.

### Groups

Lists all groups on the system.

---

## Enterprise features

authentik Enterprise adds features for identity provisioning, security, compliance, and device access. These features are included with both Enterprise plans.

## Enterprise and Enterprise Plus

Enterprise includes all the product features on this page and [ticket-based support](./enterprise-support.mdx) for qualifying subscriptions.

Enterprise Plus includes everything in Enterprise, with additional options for organizations that need a customized agreement:

- Dedicated support channels (Slack and/or scheduled calls)
- Assistance with onboarding best practices
- SLA-backed response times
- Volume discounts for large teams
- Auditable FIPS-compliant deployments to meet FedRAMP requirements
- Billing and purchase via invoice

See the [pricing page](https://goauthentik.io/pricing/) for current plan details.

## Product features

### Identity and provisioning

- [Agent accounts](../users-sources/user/account-types/agent-accounts.mdx) act on behalf of a parent user when accessing the authentik API.
- [Scheduled user offboarding](../sys-mgmt/user-offboarding.mdx) deactivates or deletes users at a scheduled time, with optional session and token revocation. This feature is in preview.
- [Google Workspace integration](../add-secure-apps/providers/gws/index.mdx) synchronizes users and groups from authentik to Google Workspace.
- [Microsoft Entra ID integration](../add-secure-apps/providers/entra/index.mdx) synchronizes users and groups from authentik to Microsoft Entra ID.
- [External OAuth and SAML sources](../add-secure-apps/flows-stages/stages/source/index.mdx) embed an external identity provider in a flow for migration or additional verification. For example, dynamically redirect users to authenticate against Entra ID or GWS before continuing with a flow.
- The [Shared Signals Framework provider](../add-secure-apps/providers/ssf/index.mdx) sends security events to subscribed applications, including Apple Business Manager.
- [OAuth authentication for SCIM](../add-secure-apps/providers/scim/index.mdx#oauth-token) uses short-lived OAuth tokens instead of a static token for SCIM provisioning.
- The [WS-Federation provider](../add-secure-apps/providers/wsfed/index.mdx) connects applications that use WS-Federation to authentik for single sign-on.

### Authentication and network access

- [Privileged access management](../add-secure-apps/access-requests/index.mdx) lets users request access to applications and entitlements, with approval rules and time-limited grants. This feature is in preview.
- [Password history compliance](../customize/policies/types/password-uniqueness.mdx) prevents users from reusing previous passwords.
- [Client certificate authentication](../add-secure-apps/flows-stages/stages/mtls/index.mdx) authenticates or enrolls users with client certificates from devices, smart cards, PIV cards, or hardware tokens.
- [RADIUS EAP-TLS](../add-secure-apps/providers/radius/index.mdx#eap) authenticates network clients with EAP-TLS and client certificates.
- [Account Lockdown](../security/account-lockdown.mdx) immediately secures a compromised account by disabling it, revoking its tokens, ending its sessions, and recording the action in the audit log.

### Audit and reporting

- [Enhanced audit logging](../sys-mgmt/events/logging-events.mdx#enhanced-audit-logging) records detailed object changes and shows before-and-after values for compliance review.
- [Event maps and charts](../sys-mgmt/events/logging-events.mdx#viewing-events-in-maps-and-charts) visualize recent events by location, type, and volume.
- [CSV data exports](../sys-mgmt/data-exports.mdx) export user and event data for analysis, reporting, or backup.
- [Object Lifecycle Management](../sys-mgmt/object-lifecycle-management.mdx) schedules periodic reviews of applications, groups, and roles, assigns reviewers, and tracks overdue reviews. This feature is in preview.

### Device security

- The [Fleet connector](../endpoint-devices/device-compliance/connectors/fleetdm.mdx) uses device information from Fleet in device-aware access decisions. This feature is in preview.
- The [Google Chrome connector](../endpoint-devices/device-compliance/connectors/google-chrome.mdx) uses Chrome Enterprise Device Trust signals in device-aware access decisions.
- [Local device login](../endpoint-devices/authentik-agent/device-authentication/local-device-login/index.mdx) enables users to sign in to Windows and Linux devices with authentik credentials. This feature is in preview.
- Advanced device compliance adds device facts and integrations to device-aware access decisions. This feature is in development; see the [Endpoint Devices feature overview](../endpoint-devices/index.mdx#features-overview).

Feature availability can change as preview features mature. Refer to the linked technical documentation for current platform support and configuration requirements.

---

## Enterprise support

authentik Enterprise subscriptions over US$1,000 per year include ticket-based support, as listed on the [pricing page](https://goauthentik.io/pricing/). Enterprise Plus subscriptions include the support channels and response-time commitments defined in your agreement.

## Open and manage support tickets {#managing-tickets}

Use the Support center to open a ticket, reply to the support team, and track existing tickets.

1. Log in to the [Customer Portal](https://customers.goauthentik.io/).
2. In the top menu, click **Support**.
3. Open a new ticket or select an existing ticket.

You can also go directly to the [Support center](https://customers.goauthentik.io/l/support).

If you cannot access the Customer Portal, contact [hello@goauthentik.io](mailto:hello@goauthentik.io).

## Include diagnostic information

Include enough context for the support team to understand and reproduce the problem:

- The full authentik version, including the patch version.
- The installation method, such as Docker Compose or Kubernetes.
- A description of the problem and its impact.
- Steps that reproduce the problem, including the expected and observed behavior.
- Relevant logs, error messages, and configuration with credentials and other sensitive values removed.
- Recent deployment, configuration, or infrastructure changes that might be related.

Do not use a support ticket to report a suspected vulnerability. Follow the [security vulnerability reporting process](../security/policy.mdx#reporting-a-vulnerability) so that the security team can handle the report confidentially.

## Product version support

The [supported versions table](../security/policy.mdx#supported-versions) lists the releases that receive security fixes. Use the latest patch release within a supported version, and check your Enterprise agreement for its support commitments.

## Community support

For community support, join the [authentik Discord server](https://goauthentik.io/discord). To report a reproducible product defect, open an issue in the [authentik GitHub repository](https://github.com/goauthentik/authentik/issues).

---

## Get started with authentik Enterprise

Enable authentik Enterprise by installing a license key in the Admin interface. authentik Enterprise uses the same installation process and container images as the open source version; you do not need to reinstall authentik or deploy a separate Enterprise service.

authentik validates licenses locally. Installing and using a license does not require internet access. For an offline deployment, see [air-gapped licensing](#air-gapped-environments).

## Before you begin

You need a running, [supported version of authentik](../security/policy.mdx#supported-versions) and administrator access to its Admin interface. For a new deployment, [install authentik](../install-config/index.mdx) first.

If you already have a license key for this deployment, skip to [install the license key](#3-install-the-license-key).

## 1. Copy the Install ID

A license is bound to an authentik deployment by its Install ID.

1. Log in to the authentik Admin interface.
2. Navigate to **Enterprise** > **Licenses**.
3. Copy the value under **Your Install ID**.

In a [multi-tenant deployment](../sys-mgmt/tenancy.mdx), each tenant has its own Install ID and requires its own license.

## 2. Obtain a license key

To purchase a license, open the [Customer Portal](https://customers.goauthentik.io/) and select or create the organization that will own it. Provide the Install ID and the required [internal and external user capacity](./manage-enterprise.mdx#about-users-and-licenses). See [Purchase a license](./manage-enterprise.mdx#purchase-a-license) for the checkout steps.

After purchase, open the license's **Details** in the Customer Portal and copy the license key. If another person manages your subscription, ask them for the key or [access to the Customer Portal organization](./manage-enterprise.mdx#manage-organization-members).

To request a trial or discuss an Enterprise Plus agreement, contact [hello@goauthentik.io](mailto\:hello@goauthentik.io).

## 3. Install the license key

1. In the Admin interface, navigate to **Enterprise** > **Licenses**.
2. Click **Install**.
3. Paste the complete license key into **License key** and submit the form.
4. Check the installed license's user capacity and expiry date. **Current license status** shows the combined status and capacity of all active licenses for the deployment.

Enterprise features are available once the license is valid. Follow the [feature documentation](./enterprise-features.mdx) to configure them.

### If the key is rejected

Check that you copied the complete key, that it has not expired, and that it was issued for the Install ID shown on this deployment. A key issued for another deployment will not work. Check the server's clock if an unexpired key is rejected.

If the license installs but its status shows a capacity problem, compare the active internal and external user counts with the licensed capacity for each type. See [license status and enforcement](./manage-enterprise.mdx#license-expiry-and-capacity-enforcement), or contact [Enterprise support](./enterprise-support.mdx).

## Air-gapped environments

Use the same license installation steps in an air-gapped environment. Copy the Install ID from the deployment, obtain the license key on a connected system, and install it via the Enterprise > Licenses section of the admin interface.

The Customer Portal needs internet access to purchase or retrieve keys. Your authentik deployment does not contact it to install or validate a license, and there is no periodic online license check. Renewals follow the same transfer process; [update the installed key](./manage-enterprise.mdx#update-a-license-key) before it expires.

For image preparation, outbound-connection settings, and the complete offline license procedure, see [Air-gapped environments](../install-config/air-gapped.mdx#enterprise-licenses).

## Next steps

- Configure the [Enterprise features](./enterprise-features.mdx) you need.
- [Manage licenses and billing](./manage-enterprise.mdx), including renewals and user capacity.
- Use [Enterprise support](./enterprise-support.mdx) for installation and configuration help.

---

## authentik Enterprise

authentik Enterprise adds features for identity provisioning, security, compliance, and device access to your self-hosted deployment. Enable them by installing a license key. Enterprise uses the same container images and upgrade process as the open source version.

Licenses are validated locally, so Enterprise also works in [air-gapped environments](../install-config/air-gapped.mdx#enterprise-licenses).

## Set up and manage Enterprise

- [Get started](./get-started.mdx) to obtain and install a license on a new or existing deployment.
- [Explore Enterprise features](./enterprise-features.mdx) and follow their configuration guides.
- [Manage licenses and billing](./manage-enterprise.mdx) to check user capacity, replace a license key, or manage your Customer Portal organization.
- [Get Enterprise support](./enterprise-support.mdx) to open a ticket and share diagnostic information.

## Choose a plan

Enterprise and Enterprise Plus include the same product features. Support and purchase options depend on your plan and subscription; see [plan details](./enterprise-features.mdx#enterprise-and-enterprise-plus).

---

## Manage licenses and billing

Use **Enterprise** > **Licenses** in the authentik Admin interface to manage installed keys and check user capacity and expiry. Use the [Customer Portal](https://customers.goauthentik.io/) to purchase or renew subscriptions, retrieve keys, and manage billing and organization access.

For your first license, follow [Get started with authentik Enterprise](./get-started.mdx).

## Manage licenses {#license-management}

An authentik Enterprise license is bound to one Install ID and defines an expiry date and separate capacity for internal and external users. You can install multiple active licenses for the same Install ID; authentik adds their user capacities together.

In the Admin interface, navigate to **Enterprise** > **Licenses** to view:

- The Install ID for the current deployment.
- Forecasts for internal and external user counts.
- The latest expiry date, combined status, and total user capacity of installed licenses.
- The name, capacity, and expiry date of each license.

License validation and user counting happen locally. The deployment does not need internet access. See [air-gapped licensing](./get-started.mdx#air-gapped-environments) for transferring keys into a disconnected deployment.

### Update a license key

When a renewal or capacity change provides a replacement key, retrieve it from the license's **Details** in the Customer Portal. Transfer it into your environment if needed, then update authentik:

1. Navigate to **Enterprise** > **Licenses**.
2. Edit the license that the new key replaces.
3. Paste the replacement into **License key**.
4. Click **Save Changes**.

Verify the new expiry date and capacity on the **Licenses** page. Renewing the subscription in the Customer Portal does not update the key stored in your deployment; install the replacement key before the old one expires.

### Remove a license

Select a license on the **Licenses** page and click **Delete**. Removing an active license immediately removes its capacity from the combined license total. Install any replacement key before deleting the old key to avoid an unintended capacity violation.

## About users and licenses {#about-users-and-licenses}

authentik counts active internal and external users separately. Disabled users, the anonymous user, and service accounts, including [agent accounts](../users-sources/user/account-types/agent-accounts.mdx), do not consume licensed capacity.

- An **internal user** can access the authentik application dashboard and user settings. Employees and other members of your organization are typically internal users.
- An **external user** cannot access the application dashboard or user settings. Customers, partners, volunteers, and contractors who use authentik only to access another application can be external users.

You configure a user's type on the user account. To send external users directly to an application after authentication, configure the brand's [default application](../customize/branding/index.mdx#external-user-settings).

Either user type exceeding its licensed capacity triggers [capacity enforcement](#license-expiry-and-capacity-enforcement). Unused internal capacity does not cover excess external users, and unused external capacity does not cover excess internal users.

### Expand license capacity

To add capacity, either [purchase another license](#purchase-a-license) for the same Install ID or [open a support ticket](./enterprise-support.mdx) to change an existing subscription. Multiple active licenses add together, but their billing and renewal dates can differ.

Use the forecasts on **Enterprise** > **Licenses** as planning estimates. Before purchasing, compare the proposed capacity with the current counts for both user types.

## License expiry and capacity enforcement

authentik checks expiry dates and active user counts locally, including in air-gapped environments. The combined expiry is the latest expiry date among installed licenses. Only unexpired licenses contribute user capacity. When one of several licenses expires, the remaining licenses must still cover both user types.

authentik displays warnings and eventually restricts changes when licensing requirements are not met:

| Condition                                                                                                                      | authentik behavior                                                                                 |
| ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------- |
| The combined license expiry is within two weeks                                                                                | Administrators see an expiry warning.                                                              |
| The combined license has expired                                                                                               | Administrators see an expired-license warning, unless a capacity threshold below takes precedence. |
| User capacity is exceeded and the last valid usage record is over two weeks old                                                | Administrators see a user-capacity warning.                                                        |
| User capacity is exceeded and the last valid usage record is over four weeks old                                               | The Admin and User interfaces display the user-capacity warning.                                   |
| The combined license expired over six weeks ago, or capacity is exceeded and the last valid usage record is over six weeks old | The deployment enters read-only mode.                                                              |

Capacity thresholds use the last recorded valid status, not the date a key was installed. If the deployment has no valid usage record and its users exceed the licensed capacity, it can enter read-only mode immediately. Purchase enough capacity for both user types before installing the first key.

In read-only mode:

- Users can continue to authenticate and authorize access to applications.
- Administrators can read configuration but cannot change most objects.
- Administrators can still install, update, or remove licenses.
- Administrators can still update or delete users to restore licensed capacity.

After you install a valid license, renew an expired license, or reduce the relevant user count, authentik returns to standard read-write operation and removes the associated warning.

License status is cached and usage is recorded periodically. Open **Enterprise** > **Licenses** to refresh the combined status after correcting the license or user counts.

## Manage an organization

A Customer Portal organization contains its members, licenses, subscriptions, and billing information.

### Create an organization

1. Log in to the [Customer Portal](https://customers.goauthentik.io/).
2. On the **My organizations** page, click **Create an organization**.
3. Enter the organization name and notification email address.
4. Click **Create**.

To delete an organization, contact [hello@goauthentik.io](mailto:hello@goauthentik.io).

### Manage organization members

Customer Portal membership controls access to license keys and billing. It does not grant access to the authentik Admin interface.

- A **Member** can view the organization's licenses and license keys.
- An **Owner** has Member access and can invite or remove members, purchase or renew licenses, and edit the organization.

To invite a member:

1. On **My organizations**, select the organization.
2. Under **Pending invitations**, enter the person's email address and select a role.
3. Click **Invite**.

The person becomes a member after accepting the invitation from their email.

To remove a member, open the organization, find the person under **Membership**, and click **Remove**.

## Purchase a license

Before purchasing a license, copy the authentik deployment's [Install ID](./get-started.mdx#1-copy-the-install-id).

1. Log in to the [Customer Portal](https://customers.goauthentik.io/) and select the organization that will own the license.
2. Click **Purchase license**.
3. Enter the required internal and external user capacity.
4. Enter the **Install ID**.
5. Optionally, change the license name. The Customer Portal and authentik Admin interface use this name to identify the license.
6. Click **Continue**.
7. Enter the payment details, then click **Pay and subscribe**.

After the payment is validated, the license appears on the organization page. Click **Details** next to the license to copy its key, then [install the license key](./get-started.mdx#3-install-the-license-key) in authentik.

For a trial, Enterprise Plus, invoice billing, or a custom purchase, contact [hello@goauthentik.io](mailto:hello@goauthentik.io).

## Manage billing

1. In the Customer Portal, navigate to **Organizations** > **My organizations**.
2. Select the organization.
3. Click **Manage Billing**.

The billing page lets an organization owner update billing details and tax information, add payment methods, review invoices and payments, and manage subscriptions.

### Cancel a subscription

On the billing page, select the subscription and click **Cancel subscription**. The associated license remains valid through the end of the current billing period and does not renew automatically.

Canceling a subscription does not remove its license key from authentik. See [License expiry and capacity enforcement](#license-expiry-and-capacity-enforcement) to understand what happens after the license expires.

---

## Air-gapped environments

authentik can operate without internet access, including with an air-gapped Enterprise license. License installation and validation are performed locally and do not require an internet connection.

If you require an air-gapped authentik license, please let us know during the purchasing process.

Use this guide alongside the [Docker Compose](./install/docker-compose.mdx) or [Kubernetes](./install/kubernetes.mdx) installation instructions. Prepare the resources on a connected system, transfer them into your environment, and configure authentik before starting it.

## Prepare installation resources {#required-resources}

Choose an authentik release and obtain its deployment files and container images on a system with internet access. Use the same authentik version for the server, worker, and outposts, and choose images that support your hosts' CPU architecture.

### Container images

Mirror the images into an internal registry, or transfer image archives and load them onto the hosts that will run them.

| Component         | Image                                                           | When needed                                                                  |
| ----------------- | --------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| Server and worker | `ghcr.io/goauthentik/server`                                    | Every installation; both services use the same image                         |
| PostgreSQL        | The image specified by your Compose file or database deployment | When deploying PostgreSQL in a container                                     |
| LDAP outpost      | `ghcr.io/goauthentik/ldap`                                      | When using an LDAP outpost                                                   |
| Proxy outpost     | `ghcr.io/goauthentik/proxy`                                     | When using a separate proxy outpost; the embedded outpost runs in the server |
| RAC outpost       | `ghcr.io/goauthentik/rac`                                       | When using Remote Access Control                                             |
| RADIUS outpost    | `ghcr.io/goauthentik/radius`                                    | When using a RADIUS outpost                                                  |

The authentik images are also available on Docker Hub under `authentik/`. Include any additional images used by your deployment, such as an ingress controller or a database operator.

### Docker Compose file

Download the target release's `compose.yml` file using the installation guide or [release notes](/releases/). Transfer it into the air-gapped environment. Check every service's `image` value, including PostgreSQL, when preparing your mirrors.

### Helm chart {#helm-repositories}

Download the chart from https://charts.goauthentik.io on a connected system:

```shell
helm repo add authentik https://charts.goauthentik.io
helm repo update
helm pull authentik/authentik --version <chart-version>
```

Replace `<chart-version>` with the chart version for your chosen release. Transfer the resulting `authentik-<chart-version>.tgz` archive into the air-gapped environment, or publish it to an internal chart repository. Include the images required by any enabled chart dependencies, such as PostgreSQL.

## Configure authentik {#configuration}

Complete the secrets, database, and networking settings in your installation guide, then apply the settings below before the first startup. The examples use `registry.company` as an internal registry; replace it with your registry and replace `<authentik-version>` with the exact image tag you mirrored.

  

Add these settings to `.env`:

```shell
AUTHENTIK_IMAGE=registry.company/authentik/server
AUTHENTIK_TAG=<authentik-version>
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=registry.company/authentik/%(type)s:%(version)s
AUTHENTIK_DISABLE_STARTUP_ANALYTICS=true
AUTHENTIK_DISABLE_UPDATE_CHECK=true
AUTHENTIK_ERROR_REPORTING__ENABLED=false
```

`AUTHENTIK_IMAGE` changes the server and worker image. Update the PostgreSQL service's `image` in `compose.yml` to its mirrored location as well.

  
  

Merge these settings into your `values.yaml` file, keeping the secrets, database, and ingress settings from the installation guide:

```yaml
global:
    image:
        repository: registry.company/authentik/server
        tag: "<authentik-version>"

authentik:
    outposts:
        container_image_base: registry.company/authentik/%(type)s:%(version)s
    disable_startup_analytics: true
    disable_update_check: true
    error_reporting:
        enabled: false
```

Configure mirrored images for any enabled chart dependencies separately. Ensure that all cluster nodes can pull from your internal registry.

  

For managed Docker outposts, use an internal registry that the Docker host can pull from. The outpost controller pulls images when creating containers; preloading an archive alone is not sufficient. If you distribute images only as archives, [deploy the outposts manually](../add-secure-apps/outposts/manual-deploy-docker-compose.mdx).

The `container_image_base` setting controls images for managed outposts. An outpost's own `container_image` setting overrides it. Check existing overrides, and configure manually deployed outposts to use the mirrored images too. See [outpost configuration](../add-secure-apps/outposts/index.mdx#configuration).

### Outbound connections

The settings above disable update checks, startup analytics, and error reporting. Avatars require a separate change in the Admin interface after installation.

| Destination                              | Purpose                                                   | How to disable                                                                                |
| ---------------------------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| https://version.goauthentik.io           | Periodic update checks                                    | Set `disable_update_check` to `true`                                                          |
| https://goauthentik.io                   | Anonymous startup analytics                               | Set `disable_startup_analytics` to `true`                                                     |
| https://authentik.error-reporting.a7k.io | Error reporting, when enabled                             | Set `error_reporting.enabled` to `false`; it is opt-in, but the installation guides enable it |
| https://www.gravatar.com                 | Avatar checks by authentik and image loads by the browser | Set **Avatars** to `initials` in [System settings](../sys-mgmt/settings.mdx)                  |

The [events map](../sys-mgmt/events/index.mdx#event-map) includes a bundled basemap and needs no external tile server. If you set **Map tiles** under **System** > **Brands**, use an internally reachable tile source or clear the setting to restore the bundled map.

Review the services and URLs used by your configuration as well. External identity providers, CAPTCHA services, notification webhooks, and remotely hosted logos or backgrounds need network access from authentik or the user's browser. Use services and assets available inside your environment.

## Start authentik

  

If you use an internal registry, pull the mirrored images and start the services:

```shell
docker compose pull
docker compose up -d
```

If you transfer image archives, load them on the Docker host first and make sure their tags match the image references in `compose.yml`. Then run `docker compose up -d`.

  
  

Install from the transferred chart archive and your configured values:

```shell
helm upgrade --install authentik ./authentik-<chart-version>.tgz -f values.yaml
```

  

Complete the initial setup from your installation guide. In the Admin interface, open [System settings](../sys-mgmt/settings.mdx) and set **Avatars** to `initials` to stop authentik and browsers from requesting Gravatar images.

## Install an Enterprise license {#enterprise-licenses}

authentik always validates Enterprise licenses locally, including in connected deployments. You do not need an online activation step, a licensing proxy, or an outbound firewall exception.

1. In the air-gapped authentik Admin interface, navigate to **Enterprise** > **Licenses** and copy **Your Install ID**.
2. On a system with internet access, [obtain a license key](../enterprise/get-started.mdx#2-obtain-a-license-key) for that Install ID from the Customer Portal or the authentik team.
3. Transfer the license key into the air-gapped environment using your organization's file transfer process.
4. On **Enterprise** > **Licenses**, click **Install**, paste the key into **License key**, and submit the form.
5. Check **Current license status**, the user capacity, and the expiry date on the **Licenses** page.

Only the system accessing the Customer Portal needs internet access. The authentik deployment can remain disconnected throughout the process.

For renewals or capacity changes, retrieve and transfer the replacement key, then [update the installed license](../enterprise/manage-enterprise.mdx#update-a-license-key). License expiry and user capacity rules also apply offline; see [license enforcement](../enterprise/manage-enterprise.mdx#license-expiry-and-capacity-enforcement).

## Upgrades

Review the target version's [release notes](/releases/) and [back up your deployment](../sys-mgmt/ops/backup-restore.mdx) before upgrading. Download the updated Compose file or Helm chart on a connected system and mirror all required images for the target release, including any changed supporting-service images.

Transfer the resources, update your image references and version tags, and run the commands in [Start authentik](#start-authentik). Follow the [required upgrade sequence](./upgrade.mdx#important-considerations) and any additional migration instructions in the release notes. Keep the outbound-connection settings and internal registry configuration when merging a new Compose file or chart values.

With automatic update checks disabled, check the [release notes](/releases/) from a connected system to keep track of new releases and security fixes.

## Network requirements

An air-gapped installation still needs connectivity between its internal services. Allow the connections used by your deployment:

### Required ports

- Browsers, applications, and outposts must reach the authentik server, normally on HTTPS port 443 through a reverse proxy or ingress. The server's default container ports are 9000 for HTTP and 9443 for HTTPS.
- The server and worker must reach PostgreSQL, normally on port 5432.
- Email delivery needs access to your configured SMTP server, commonly on port 25, 465, or 587.
- Configured storage, directory servers, applications, and other integrations must be reachable on their respective ports.

### Outpost-specific ports

Every outpost must reach the authentik URL configured in `AUTHENTIK_HOST`, preferably over HTTPS. Allow clients to reach the outposts and outposts to reach their upstream services:

- LDAP outposts listen on container ports 3389 and 6636, commonly published as 389 and 636 for LDAP and LDAPS.
- Proxy outposts listen on container ports 9000 and 9443 and need access to the applications they proxy.
- RAC outposts need access to target devices over the configured remote access protocol. They do not require published inbound ports.
- RADIUS outposts listen on UDP port 1812.

See the [outpost documentation](../add-secure-apps/outposts/index.mdx) for deployment and configuration details.

---

## Automated install

To install authentik automatically (skipping the Out-of-box experience), you can use the following environment variables on the worker container:

These can't be defined using the file-based syntax (`file://`), so you can't pass them in as secrets in a Docker Compose installation.

### `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`

Configure the default password for the `akadmin` user using a pre-hashed Django password value. Only read on the first startup.

This stores the hash directly as authentik's local password verifier. Because authentik never sees the raw password, hashed-password imports do not propagate the password to LDAP or Kerberos integrations, even when password writeback is enabled. authentik validates imported hashes before storing them and rejects malformed values.

To generate a hash, run this command before your initial deployment and enter the password when prompted:

```bash
docker compose run --rm server hash_password
```

For automation, pass the password in the `PASSWORD` environment variable and pipe it through standard input to prevent exposing the password in your shell history:

```bash
printf '%s' "$PASSWORD" | docker compose run --rm server hash_password
```

Alternatively, redirect a file that contains the password into the command:

```bash
docker compose run --rm server hash_password < password.txt
```

The generated hash includes a random salt, so running the command multiple times for the same password produces different output. Use the complete output as the value of `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.

Password hashes contain `$` characters which Docker Compose interprets as variable references.

**In `.env` files**, use single quotes to prevent interpolation:

```bash
AUTHENTIK_BOOTSTRAP_PASSWORD_HASH='pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM='
```

**In `docker-compose.yml`** (inline environment), escape each `$` with `$$`:

```yaml
services:
    worker:
        environment:
            AUTHENTIK_BOOTSTRAP_PASSWORD_HASH: "pbkdf2_sha256$$1000000$$xKKFuYtJEE27km09BD49x2$$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
```

See the Docker Compose documentation on [`.env` file interpolation](https://docs.docker.com/compose/how-tos/environment-variables/variable-interpolation/) and [Compose file interpolation](https://docs.docker.com/reference/compose-file/interpolation/) for details.

### `AUTHENTIK_BOOTSTRAP_PASSWORD`

This option stores plaintext passwords in environment variables. Use [`AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`](#authentik_bootstrap_password_hash) instead.

Configure the default password for the `akadmin` user. Only read on the first startup.

Setting both `AUTHENTIK_BOOTSTRAP_PASSWORD` and `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH` will result in an error.

### Other hashed-password import paths

For post-install automation, hashed passwords can also be set via blueprints with the `password_hash` user attribute, or via the `/api/v3/core/users/<id>/set_password_hash/` API endpoint with the hash provided in the `password` field. The API endpoint requires the `authentik_core.reset_user_password` permission and can target regular users or service accounts.

These paths share the same validation and local-verifier-only behavior as `AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`.

### `AUTHENTIK_BOOTSTRAP_TOKEN`

Create a token for the default `akadmin` user. Only read on the first startup. The string you specify for this variable is the token key you can use to authenticate yourself to the API.

### `AUTHENTIK_BOOTSTRAP_EMAIL`

Set the email address for the default `akadmin` user.

## Kubernetes

In the Helm values, set the `akadmin` user password hash and token:

```yaml
authentik:
    bootstrap_password_hash: "pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM="
    bootstrap_token: "your-token-here"
    bootstrap_email: "admin@authentik.company"
```

When using password hashes in quoted YAML strings as shown above, no escaping of `$` characters is required. The `$` character only needs escaping when:

- Using Helm templating syntax (e.g., `{{ .Values.something }}`) where `$` has special meaning
- Referencing values from environment variable substitution in your values file

Or store the password hash in a secret and reference it via `envFrom`:

```yaml
global:
    envFrom:
        - secretRef:
              name: _some-secret_
```

where *some-secret* contains the environment variables as documented above.

---

## Beta and release candidate versions

You can test upcoming authentik versions before they are released as stable. There are two types of pre-release versions available:

- **Release Candidates (RC)**: Near-final versions that are feature-complete and undergoing final testing before a stable release. RCs are more stable than Beta versions and are recommended for testing in staging environments.
- **Beta versions**: Early builds that include new, or experimental features and may introduce bugs or breaking changes.

It is recommended to upgrade your installation to the latest stable release before switching from stable to an RC or Beta version.

Downgrading from RC or Beta versions is not supported. It is recommended to take a backup before upgrading, or test these versions on a separate installation. Upgrading from RC or Beta versions to the next stable release generally works, but is not officially supported.

## Release Candidate (RC) versions

Release candidates are available for testing before major version releases. To use an RC version, you need to specify the exact RC tag (e.g., `2026.5.0-rc2`).

Add the following block to your `.env` file, replacing `2026.5.0-rc2` with the desired RC version:

```shell
AUTHENTIK_TAG=2026.5.0-rc2
```

Next, pull the image and redeploy:

```shell
docker compose pull
docker compose up -d
```

Add the following block to your `values.yaml` file, replacing `2026.5.0-rc2` with the desired RC version:

```yaml
global:
    image:
        tag: 2026.5.0-rc2
        # pullPolicy: Always to ensure you always get the latest version
        pullPolicy: Always
```

Next, run the upgrade commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml
```

## Beta versions

Beta versions provide early access to major new features that are still in active development.

Add the following block to your `.env` file:

```shell
AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-next
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
```

Next, run the upgrade commands below.

Add the following block to your `values.yml` file:

```yaml
authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-next
        # pullPolicy: Always to ensure you always get the latest version
        pullPolicy: Always
```

Next, run the upgrade commands below.

```shell
docker compose pull
docker compose up -d
```

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml
```

If you are upgrading from an older Beta release to the most recent Beta release, you might need to run `kubectl rollout restart deployment`, because Helm needs to recreate the pods in order to pick up the new image (the tag doesn't change).

## Verify the installation

To verify whether the upgrade was successful, go to your Admin panel and navigate to the Overview dashboard. There, you can check the version number to ensure that you are using the RC or Beta version you intended.

---

## Email

This page covers both configuring authentik to send email and testing that email delivery is working.

Global email settings are used for administrator notifications, release and configuration alerts, [notification rules](../sys-mgmt/events/notifications.mdx), and any [Email stage](../../add-secure-apps/flows-stages/stages/email/) configured to use global settings.

Email stages can be configured to use their own stage-specific SMTP settings if you need them to send mail through a different server than the one used by the rest of authentik.

Some hosting providers block outgoing SMTP ports, in which case you will need to host an SMTP relay on a different port with a different provider.

## Before you begin

Have the following values ready:

- SMTP server hostname or IP address
- SMTP port
- SMTP server username and password, if authentication is required
- The sender address for `AUTHENTIK_EMAIL__FROM`
- The TLS mode required by your provider

## Configure global email settings

Set the global SMTP configuration in your deployment, then redeploy authentik.

Follow your mail provider's documentation and configure TLS mode as follows:

- STARTTLS, also called explicit TLS, often uses port `587`. Set `AUTHENTIK_EMAIL__USE_TLS=true` and leave `AUTHENTIK_EMAIL__USE_SSL=false`.
- SSL or implicit TLS often uses port `465`. Set `AUTHENTIK_EMAIL__USE_SSL=true` and leave `AUTHENTIK_EMAIL__USE_TLS=false`.
- Plain SMTP without TLS should leave both settings disabled.

Never enable `USE_TLS` and `USE_SSL` at the same time. In the Helm chart, apply the same rules to `email.use_tls` and `email.use_ssl`.

To configure global email settings, append the following block to your `.env` file:

```sh
# SMTP server
AUTHENTIK_EMAIL__HOST=localhost
AUTHENTIK_EMAIL__PORT=25
# Optionally authenticate (don't add quotation marks to your password)
AUTHENTIK_EMAIL__USERNAME=
AUTHENTIK_EMAIL__PASSWORD=
# STARTTLS / explicit TLS, usually on port 587
AUTHENTIK_EMAIL__USE_TLS=false
# Implicit TLS/SSL on the SMTP connection (`USE_SSL` is the variable name), usually on port 465
AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__TIMEOUT=10
# Sender email address; verify that the domain is valid.
AUTHENTIK_EMAIL__FROM=authentik@example.com
```

To configure global email settings, append the following block to your `values.yaml` file:

```yaml
# add this block under the `authentik:` block in your values.yaml file
# authentik:
email:
    # -- SMTP server from which emails are sent by authentik
    host: ""
    port: 25
    # -- Optional SMTP authentication credentials. Leave empty to disable authentication.
    username: ""
    # -- Optional SMTP authentication credentials. Leave empty to disable authentication.
    password: ""
    # -- STARTTLS / explicit TLS, usually on port 587.
    use_tls: false
    # -- Implicit TLS/SSL, usually on port 465 (`use_ssl` is the setting name).
    use_ssl: false
    # -- Connection timeout in seconds
    timeout: 10
    # -- Email 'from' address can either be in the format "foo@bar.baz" or "authentik <foo@bar.baz>"
    from: "authentik@example.com"
```

### When to use stage-specific settings

[Email stages](../../add-secure-apps/flows-stages/stages/email/) can either:

- use the global SMTP settings described above, or
- use their own stage-specific SMTP host, port, credentials, and TLS settings

## Test email delivery

After configuring SMTP, send a test message from the authentik server:

```shell
ak test_email <to_address>
```

To test a specific Email stage instead of the global settings, include `-S`:

```shell
ak test_email <to_address> [-S <stage_name>]
```

To run this command with Docker Compose:

```shell
docker compose exec worker ak test_email [...]
```

To run the command in the Kubernetes worker pod:

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak test_email [...]
```

## Google Workspace SMTP relay configuration

One reliable way to send email through Google is [Google's SMTP relay service](https://support.google.com/a/answer/2956491). Google also documents the broader setup flow in [Send email from a printer, scanner, or app](https://support.google.com/a/answer/176600?hl=en).

First, determine the outbound IP address used by authentik to send emails and add it to the Google Workspace **SMTP relay service** settings. Then configure the relay with these options:

- Set **Allowed Senders** to `Only addresses in my domains`.
- Set **Authentication** to `Only accept mail from the specified IP addresses`.
- Do not set **Require SMTP Authentication**.
- Select **Require TLS encryption**.

If you are using Docker Compose, set the following environment variables for authentik:

```sh
AUTHENTIK_EMAIL__HOST=smtp-relay.gmail.com
AUTHENTIK_EMAIL__PORT=587
AUTHENTIK_EMAIL__USE_TLS=true
AUTHENTIK_EMAIL__USE_SSL=false
AUTHENTIK_EMAIL__TIMEOUT=30
```

Redeploy the authentik containers, then use the `ak test_email` command to confirm that email delivery works.

If you are using the Kubernetes Helm chart, set the following variables in the `email` section of your authentik configuration file:

```yaml
email:
    host: "smtp-relay.gmail.com"
    port: 587
    use_tls: true
    use_ssl: false
    timeout: 30
```

Redeploy the authentik containers, then use the `ak test_email` command to confirm that email delivery works.

## SMTP server with TLS verification

If you are configuring authentik to send email via an SMTP server with TLS enabled, mount the certificate used for authentication in your authentik server and worker containers (for example a private CA bundle) and point `SSL_CERT_FILE` at it.

1. Add the following configuration to the server and worker services in your Docker Compose file:

```yaml
volumes:
    - /path/to/<cert_name>.crt:/etc/ssl/certs/<cert_name>.crt:ro
environment:
    - SSL_CERT_FILE="/etc/ssl/certs/<cert_name>.crt"
```

2. Redeploy the containers for the changes to take effect.

1) Create a `ConfigMap` with your certificate by running the following command on the Kubernetes host:

```sh
kubectl create configmap my-custom-cert --from-file=<cert_name>.crt -n <your_namespace>
```

2. Create a volume by adding the following configuration to your Kubernetes `values.yaml` file:

```yaml
volumes:
    - name: custom-ca
      configMap: # or use secret if preferred
          name: my-custom-cert
```

3. Add a `volumeMount` and environment variable to your server and worker containers by adding the following configuration to your Kubernetes `values.yaml` file in the appropriate locations:

```yaml
volumeMounts:
    - name: custom-ca
      mountPath: /etc/ssl/certs/ca-certificates.crt
      subPath: ca-certificates.crt
      readOnly: true
env:
    - name: SSL_CERT_FILE
      value: /etc/ssl/certs/ca-certificates.crt
```

4. Recreate the pods for the changes to take effect.

---

## High availability

High availability refers to system design that minimizes downtime even in the event of failures or disruptions.

authentik supports high availability in several ways:

- Multiple instances of the server and worker can be run in parallel, allowing for redundancy.
- The authentik database is PostgreSQL, which has extensive support for different [highly available setups](https://www.postgresql.org/docs/current/high-availability.html).
- Both authentik and PostgreSQL support active-passive deployments.

## Parallel server and worker instances

authentik server and worker instances are stateless. All session state and configuration data is stored in the database. This statelessness makes it easy to horizontally scale authentik deployments by adding more server and worker instances, ensuring resilience and fault tolerance.

If a server or worker instance goes offline, another instance can continue to serve traffic. If these instances are distributed among multiple hosts, it can provide even higher levels of resilience and fault tolerance.

## PostgreSQL high availability

PostgreSQL provides high availability through *replication* and *clustering*.

Refer to the [PostgreSQL High Availability, Load Balancing, and Replication documentation](https://www.postgresql.org/docs/current/high-availability.html) for more details.

authentik also supports:

- [PostgreSQL read replicas](./configuration/configuration.mdx#read-replicas) for query offloading
- [PostgreSQL connection poolers](./configuration/configuration.mdx#using-a-postgresql-connection-pooler) such as PgBouncer or Pgpool

Use the [PostgreSQL configuration reference](./configuration/configuration.mdx#postgresql-settings) to configure primary connections, TLS, replicas, and pooler compatibility.

## Active-passive authentik deployment

In an active-passive deployment, one authentik instance actively serves all requests while the other is on standby, prepared to assume control in the event of a failure.

The components of an active-passive authentik deployment include:

- **Active Instance**: Handles all user authentication requests, API calls, and background tasks. It is fully operational and serves live traffic.
- **Passive Instance**: Runs as a hot/warm standby. Does not handle incoming traffic or processing. Does not actively write to the database.
- **Shared Database**: Both instances connect to the same PostgreSQL database which ensures data consistency. Because authentik is stateless, there are no data conflicts.
- **Load Balancer**: A load balancer monitors the active instance's health. Upon detecting failure, it promotes the passive instance to active by redirecting all traffic to it. This failover can be triggered automatically or manually, depending on your failover strategy. When the original active authentik instance is restored, it can either remain passive or be promoted back to active (failback).

For more information on monitoring the health of an authentik instance, refer to the [Monitoring documentation](../sys-mgmt/ops/monitoring.mdx).

The following diagram shows a typical active-passive configuration:

```mermaid
graph TD
    subgraph authentikInstances["authentik instances"]
        A[Active authentik instance]@{stroke: #fd4b2d}
        P[Passive authentik instance]@{stroke: #fd4b2d}
    end

    U[Users]@{ shape: processes}
    L[Load Balancer]
    PG[(PostgreSQL Cluster)]

    U <-->|Traffic| L

    L <-->|Traffic + Health monitoring| A
    L ---|Health monitoring| P

    A <-->|Database traffic - Read and Write| PG
    P ---|Database traffic - Read only| PG

    style A stroke: #fd4b2d,stroke-width:2px
    style P stroke: #fd4b2d,stroke-width:2px
    style authentikInstances stroke:#fd4b2d,stroke-width:2px
```

This setup provides several advantages:

- **Resilient hosting options**: The ability to host each authentik deployment in separate environments. Different hardware, datacenters, or providers can be utilized for each deployment to increase resiliency and fault tolerance.
- **Continuity of service**: During maintenance windows, continuity of service can be assured by switching between active and passive instances.
- **Automatic failover**: A load balancer allows for automatic failover based on health monitoring, rather than waiting for administrators to detect an issue and manually failover.
- **Possibility of blue-green deployment**: The use of a load balancer also allows for blue-green methodology, assuming that appropriate changes are made to the database.

---

## Installation and Configuration

Everything you need to get authentik up and running!

The installation process is the same for the open-source edition and [authentik Enterprise](../enterprise/index.mdx). To enable Enterprise features, [get started with authentik Enterprise](../enterprise/get-started.mdx) after installing authentik.

For information about upgrading to a new version, refer to the Upgrade section in the relevant [Release Notes](../releases) and to our [Upgrade authentik](./upgrade.mdx) documentation.

---

## Reverse proxy

Use this page when authentik is exposed through a reverse proxy or load balancer.

authentik uses WebSockets for communication with Outposts. Your reverse proxy must support HTTP/1.1 or newer. HTTP/1.0 reverse proxies are not supported.

## Required proxy headers

When authentik is behind a reverse proxy, configure the proxy to set the following headers from the original request. The proxy should overwrite any corresponding headers supplied by the client. These headers tell authentik which host the client requested, whether the original connection used HTTP or HTTPS, what the client IP address was, and whether the request is attempting to upgrade to a WebSocket connection.

At a minimum, configure these headers in your reverse proxy:

- `X-Forwarded-Host` or `Host`

  Preserves the original host requested by the client. Required for security checks, correct URL handling, WebSocket handshakes, and communication with outposts and proxy providers.

- `X-Forwarded-Proto`

  Tells authentik whether the original client connection used HTTP or HTTPS.

- `X-Forwarded-For`

  Preserves the original client IP address so authentik can determine where the request came from.

- `Connection: Upgrade` and `Upgrade: WebSocket`

  Required to upgrade WebSocket requests when using HTTP/1.1.

It is also recommended to use a [modern TLS configuration](https://ssl-config.mozilla.org/).

## Trusted proxy networks

authentik only accepts the headers listed above, excluding `Connection` and `Upgrade`, when the request comes from a trusted proxy network. authentik does not use forwarded headers from other sources to determine the original host, scheme, or client address.

The trusted address is the source address from which the reverse proxy connects directly to authentik. In containerized deployments, this is typically the reverse proxy container or cluster network, not the client IP address.

By default, authentik trusts these proxy networks, but you can change the list of trusted proxy networks with [`AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`](./configuration/configuration.mdx#authentik_listen__trusted_proxy_cidrs):

- `127.0.0.0/8`
- `10.0.0.0/8`
- `172.16.0.0/12`
- `192.168.0.0/16`
- `fe80::/10`
- `::1/128`

Setting `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS` replaces the default list. If your reverse proxy or load balancer connects from an address outside the default networks, set this option to every address or network from which a trusted proxy connects directly to authentik. Do not include networks from which untrusted clients can connect directly to authentik.

For Docker Compose, set the value in your `.env` file:

```env
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS=<trusted_proxy_networks>
```

For Kubernetes deployments using the authentik Helm chart, set:

```yaml
authentik:
    listen:
        trusted_proxy_cidrs: "<trusted_proxy_networks>"
```

For more information, see [Configuration](./configuration/configuration.mdx#set-your-environment-variables).

If the proxy's source address is not trusted, authentik ignores its forwarded headers. This can cause authentik to:

- interpret an HTTPS request as HTTP and generate HTTP URLs
- display an endless loading indicator or an authentication error because the browser blocks mixed content
- log the reverse proxy address instead of the client address

## Caching static assets

If login pages load slowly, you can cache built-in `/static/*` assets at your reverse proxy or content delivery network (CDN). This optional step reduces requests to the origin and can improve load times, especially for users far from the server. A one-day time to live (TTL) is a reasonable choice for stable-name assets such as `/static/dist/assets/images/flow_background.jpg`, which can change on upgrade. Reserve longer, immutable caching for content-hashed filenames.

Limit the rule to `/static/*`: do not cache authentication pages, API responses, or signed, short-lived user uploads under `/files/`. If authentik runs under a subpath, include that prefix in the rule; see [`AUTHENTIK_WEB__PATH`](./configuration/configuration.mdx#authentik_web__path).

## Example: nginx

The following nginx configuration is a reasonable starting point. It proxies to authentik's HTTPS listener on port `9443`.

If you proxy to authentik's HTTP listener instead, change the upstream port to `9000` and change `proxy_pass https://authentik;` to `proxy_pass http://authentik;`.

```nginx
# Upstream where your authentik server is hosted.
upstream authentik {
    server <hostname of your authentik server>:9443;
    # Improve performance by keeping some connections alive.
    keepalive 10;
}

# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
    default upgrade;
    ''      '';
}

server {
    # HTTP server config
    listen 80;
    listen [::]:80;
    server_name sso.domain.tld;
    # 301 redirect to HTTPS
    return 301 https://$host$request_uri;
}
server {
    # HTTPS server config
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name sso.domain.tld;

    # TLS certificates
    ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem;
    add_header Strict-Transport-Security "max-age=63072000" always;

    # Proxy authentik
    # If authentik is served under a subpath, also review:
    # https://docs.goauthentik.io/install-config/configuration/#authentik_web__path
    location / {
        proxy_pass https://authentik;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade_keepalive;
    }
}
```

## Example: Traefik

This example uses Traefik's [Docker provider](https://doc.traefik.io/traefik/reference/install-configuration/providers/docker/) with Docker Compose labels. It assumes that Traefik already has a `websecure` entry point with TLS enabled and a valid certificate for your public hostname, and that Traefik and authentik share a Docker network.

Add these labels to the `server` service in authentik's Compose file, and replace `sso.domain.tld` with your public hostname:

```yaml
services:
    server:
        labels:
            traefik.enable: "true"
            traefik.http.routers.authentik.rule: "Host(`sso.domain.tld`)"
            traefik.http.routers.authentik.entrypoints: websecure
            traefik.http.routers.authentik.service: authentik
            traefik.http.services.authentik.loadbalancer.server.port: "9000"
```

Traefik terminates TLS for clients and forwards requests to authentik over HTTP on port `9000`. It sets the forwarded headers and passes WebSocket upgrades through without extra configuration.

Traffic between Traefik and authentik on port `9000` is unencrypted, so only attach trusted containers to the shared network. If Traefik should be the only way to reach authentik, remove the `9000` and `9443` port mappings from the `server` service.

If the authentik container is attached to more than one network, set the network Traefik should use with the `traefik.docker.network` label or the `providers.docker.network` option.

authentik sees requests coming from Traefik's address on the shared network. Docker's default address pools are within `172.16.0.0/12` and `192.168.0.0/16`, which authentik trusts by default. If you use a custom address pool or have changed `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`, make sure the list includes that network. See [Trusted proxy networks](#trusted-proxy-networks).

If another proxy or load balancer sits in front of Traefik, add its address to the entry point's [forwarded headers trusted IPs](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#forwarded-headers). Otherwise, Traefik replaces the forwarded headers that proxy sets.

If Traefik also protects other applications with authentik forward auth, do not apply that middleware to authentik's router, either directly or through the entry point. Doing so causes a redirect loop.

### Connect to authentik over HTTPS

To encrypt the connection between Traefik and authentik, route to port `9443` instead. Traefik verifies the upstream certificate, so authentik's default self-signed certificate does not work. Assign a [Web Certificate](../sys-mgmt/certificates.mdx#web-certificates) that covers `sso.domain.tld` to the [brand](../customize/branding/index.mdx#web-certificate) for that domain.

Change the port label to `"9443"` and add these labels:

```yaml
traefik.http.services.authentik.loadbalancer.server.scheme: https
traefik.http.services.authentik.loadbalancer.serverstransport: authentik-tls@file
```

Traefik connects to the container IP address, so it needs a [ServersTransport](https://doc.traefik.io/traefik/reference/routing-configuration/http/load-balancing/serverstransport/) that tells it which hostname to verify. Define it in a [file provider](https://doc.traefik.io/traefik/reference/install-configuration/providers/others/file/) directory:

```yaml title="traefik-dynamic.yml"
http:
    serversTransports:
        authentik-tls:
            serverName: sso.domain.tld
```

If Traefik does not have a file provider yet, start it with `--providers.file.directory=/etc/traefik/dynamic` and mount the directory that contains `traefik-dynamic.yml` at `/etc/traefik/dynamic`.

If a private CA issued the Web Certificate, mount the CA certificate into the Traefik container and add it to `rootCAs`:

```yaml title="traefik-dynamic.yml"
http:
    serversTransports:
        authentik-tls:
            serverName: sso.domain.tld
            rootCAs:
                - /etc/traefik/authentik-ca.pem
```

## Troubleshooting

- An endless loading indicator, a generic authentication error, or a browser error about blocked mixed content usually means that authentik is interpreting an HTTPS request as HTTP.
  1. Use the browser's developer tools to check whether the page is attempting to load an `http://` authentik URL from an `https://` page.
  2. Verify that the reverse proxy sets `X-Forwarded-Proto` to the original client scheme. For an HTTPS request, the proxy must send `X-Forwarded-Proto: https`, even if the proxy connects to authentik over HTTP on port `9000`.
  3. Verify that the address from which the proxy connects to authentik is included in `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`. authentik ignores forwarded headers from untrusted addresses.
- If Traefik returns `502 Bad Gateway`, check that Traefik can reach authentik on the shared network and that the port and scheme match: `9000` with HTTP or `9443` with HTTPS. On port `9443`, also check that the Web Certificate covers the `serverName` in the ServersTransport and that Traefik trusts the certificate issuer.
- CSRF errors when saving objects are usually caused by incorrect `Host` or `Origin` handling. See [Troubleshooting CSRF Errors](../troubleshooting/csrf.mdx).
- Incorrect client IP addresses usually mean the proxy IP is not covered by `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`.
- Broken outpost or proxy provider communication often means the WebSocket upgrade headers are missing or the proxy is not using HTTP/1.1 or newer.

---

## Upgrade authentik

Upgrading to the latest version of authentik, whether a new major release or a patch, involves running a few commands to pull down the latest images and then restarting the servers and databases.

## Get notified about new releases

Once an hour, authentik checks for a newer stable release and creates an [`update_available`](../sys-mgmt/events/event-actions.mdx#update_available) event when it finds one. The built-in `default-notify-update` [notification rule](../sys-mgmt/events/notifications.mdx) sends that event to the **authentik Admins** group through two default [transports](../sys-mgmt/events/transports.mdx): `default-local-transport`, which shows a notification in the Admin interface, and `default-email-transport`, which emails the group once [global email settings](./email.mdx) are configured. To deliver release notifications somewhere else, such as a chat channel, add a webhook transport to that rule.

The check is an outbound connection to `version.goauthentik.io`, so it does not run when [`AUTHENTIK_DISABLE_UPDATE_CHECK`](./configuration/configuration.mdx#authentik_disable_update_check) is set, which [air-gapped deployments](./air-gapped.mdx) are expected to do.

To follow releases outside of authentik:

- On the [goauthentik/authentik](https://github.com/goauthentik/authentik) repository, click **Watch**, select **Custom**, and then select **Releases**.
- Subscribe to [https://github.com/goauthentik/authentik/releases.atom](https://github.com/goauthentik/authentik/releases.atom) in an RSS or Atom reader.

Each version is documented in the [Release Notes](../../releases/), which list new features, fixes, and any breaking changes or manual steps that the upgrade requires.

## Important considerations

authentik does not support downgrading. Make sure to back up your database in case you need to revert an upgrade.

**Preview the release notes**: Be sure to carefully read the [Release Notes](../../releases/) for the specific version to which you plan to upgrade. The release might have special requirements or actions, or contain breaking changes.

**Database backup**: Before upgrading, make a backup of your PostgreSQL database. For general guidance, see [Backup and restore](../sys-mgmt/ops/backup-restore.mdx). For deployment-specific PostgreSQL guides, refer to the relevant guide for your deployment method ([Docker Compose](../troubleshooting/postgres/upgrade_docker.mdx) or [Kubernetes](../troubleshooting/postgres/upgrade_kubernetes.mdx)).

**Upgrade sequence**: Upgrades must follow the sequence of major releases; **do not skip** directly from an older major version to the most recent version.

Always upgrade to the latest minor version (`.x`) within each `major.minor` version before upgrading to the next major version. For example, if you're currently running `2025.2.1`, upgrade in the following order:

1. Upgrade to the latest `2025.2.x`.
2. Then to the latest `2025.4.x`.
3. Finally to the latest `2025.6.x`.

**Outposts**: The version of the authentik server and all authentik outposts must match. Ensure that all [outposts are upgraded](../add-secure-apps/outposts/upgrading.mdx) at the same time as the core authentik instance.

**Air-gapped environments**: Before upgrading an air-gapped deployment, mirror the target release's required images and artifacts. For details, see [Air-gapped environments](./air-gapped.mdx#upgrades).

## Upgrade authentik

In your terminal, navigate to your installation directory and follow these steps:

#### 1. Retrieve the latest `compose.yml` file

Download the `compose.yml` file using either `wget -O compose.yml https://docs.goauthentik.io/compose.yml` or `curl -O https://docs.goauthentik.io/compose.yml` or a similar process.

**2. Run upgrade commands**

```shell
docker compose pull
docker compose up -d
```

In your terminal, navigate to your installation directory and run the following commands:

```
helm repo update
helm upgrade --install authentik authentik/authentik -f values.yaml
```

Navigate to your authentik AWS CloudFormation stack. Click on the **Changesets** tab and **Create changeset**.

Select **Use existing template** and follow the prompts to upgrade.

To upgrade to a specific version, select **Replace existing template** and use the following URL: `https://authentik-cloudformation-templates.s3.amazonaws.com/authentik.ecs.VERSION.yaml` replacing `VERSION` with the version you want to upgrade to. You can use `latest` to upgrade to the latest version.

## Upgrade any outposts

Be sure to also [upgrade any outposts](../add-secure-apps/outposts/upgrading.mdx) when you upgrade your authentik instance.

## Verify your upgrade

You can view the current version of your authentik instance by logging in to the Admin interface, and then navigating to **Dashboards > Overview**.

![](./version1.png)

## Refresh PostgreSQL statistics after upgrading

Database migrations during an authentik upgrade can leave PostgreSQL with outdated query-planner statistics. If dashboards or other pages in the Admin interface are slower after the upgrade, connect to the authentik database and run:

```sql
ANALYZE;
```

You can run `ANALYZE` while authentik is serving requests, although its duration depends on the size and load of your database. It refreshes the statistics that PostgreSQL uses to plan queries. If queries remain slow, see [Troubleshoot slow PostgreSQL queries](../troubleshooting/postgres/slow-queries.mdx).

## Troubleshooting your upgrade

If you run the upgrade commands but your version on the Dashboard doesn't change, follow these steps:

1. Look at the server logs and search for an entry of `migration inconsistency`.
2. If you see this entry, revert to your database backup.
3. Now, upgrade to each subsequent higher version. That is, upgrade in sequence, do not skip directly to the most recent version.

---

## Account Lockdown

Account Lockdown is a security feature that allows administrators to quickly secure a user account during emergencies, such as suspected compromise or unauthorized access. Users can also lock down their own account if they believe it has been compromised.

## What Account Lockdown does

When triggered, Account Lockdown performs the following actions (all configurable):

- **Deactivates the user account**: The user can no longer log in
- **Sets an unusable password**: Invalidates the user's password
- **Terminates all active sessions**: Immediately logs the user out of all devices and applications
- **Revokes all tokens**: Invalidates API, app password, recovery, verification, and OAuth2 tokens and grants
- **Creates an audit event**: Records the lockdown with the provided reason (can trigger [notifications](#configure-notifications))

Account Lockdown cannot be triggered on the anonymous user or internal service accounts.

## Prerequisites

1. A **Lockdown Flow** must be configured on your Brand (**System** > **Brands**)
2. The flow must contain an [Account Lockdown Stage](../add-secure-apps/flows-stages/stages/account_lockdown/index.mdx) (Enterprise)
3. For self-service lockdown, configure a **Completion flow** on the stage

## Use the packaged lockdown blueprint

authentik includes a packaged lockdown blueprint that creates a default lockdown flow (`default-account-lockdown`) and a self-service completion flow (`default-account-lockdown-complete`).

The blueprint creates:

| Order | Stage                     | Purpose                          |
| ----- | ------------------------- | -------------------------------- |
| 0     | Prompt Stage              | Warning message and reason input |
| 10    | Account Lockdown Stage    | Executes lockdown actions        |
| 20    | Prompt Stage (admin only) | Shows a confirmation message     |

A separate completion flow (`default-account-lockdown-complete`) displays a message after self-service lockdowns.

### Step 1. Download the blueprint

Download the lockdown blueprint by running:

```shell
wget https://goauthentik.io/blueprints/example/flow-default-account-lockdown.yaml
```

Alternatively, use this link to view and save the file.

### Step 2. Import the blueprint file

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click **Import**.
3. Click **Choose file**, select `flow-default-account-lockdown.yaml`, and then click **Import**.

### Step 3. Set the lockdown flow on your brand

1. Navigate to **System** > **Brands**.
2. Edit your brand and set **Lockdown flow** to `default-account-lockdown`.

## Create a custom flow

1. Navigate to **Flows and Stages** > **Flows** and create a flow with:
   - **Designation**: Stage Configuration
   - **Authentication**: Require authenticated user
2. Add a Prompt Stage for warnings and reason collection
3. Add an Account Lockdown Stage
4. Optionally add an administrator-only completion Prompt Stage
5. Set this flow as **Lockdown flow** on your Brand

For stage configuration details, see the [Account Lockdown Stage documentation](../add-secure-apps/flows-stages/stages/account_lockdown/index.mdx).

## Trigger an Account Lockdown

### From a User's detail page

1. Navigate to **Directory** > **Users** and click on a user.
2. Click **Account Lockdown**.
3. Review the warning, enter a reason (recorded in the audit log), and click **Continue**.
4. If your flow includes an administrator-only completion stage, it is shown after the lockdown completes.

## Self-service Account Lockdown

Users can lock their own account from the User interface:

1. Navigate to **Settings**.
2. In the **Account Lockdown** section, click **Lock my account**.
3. Enter a reason and click **Continue**.

After lockdown, the user is redirected to the configured completion page. They cannot log back in until an administrator restores access.

### Configure the completion message

Since the user's session is deleted, the stage redirects to a separate unauthenticated flow:

1. Create a flow with **Authentication** set to **No authentication required**
2. Add a Prompt Stage with an alert field containing your message
3. On your Account Lockdown Stage, set **Completion flow** to this flow

## Configure notifications

Use Notification Rules to alert when lockdowns occur:

1. Navigate to **Customization** > **Policies** and create an **Event Matcher Policy**
2. Set **Action** to **User Write**
3. Set **Query** to `action = "user_write" and context.action_id = "account_lockdown"`
4. Navigate to **Events** > **Notification Rules** and create a rule
5. Select a notification transport, such as `default-email-transport`
6. Select a destination group, or enable **Send notification to event user** to notify the locked user
7. Bind the Event Matcher Policy to the rule

## Restore access after lockdown

1. Navigate to **Directory** > **Users** and find the locked user (shown as inactive).
2. Click **Activate** to re-enable the account.
3. Use **Set password** or **Create recovery link** to set a new password.
4. Advise the user to re-enroll MFA devices.

## Troubleshooting

| Issue                         | Solution                                                                         |
| ----------------------------- | -------------------------------------------------------------------------------- |
| "No lockdown flow configured" | Set a lockdown flow on your Brand (**System** > **Brands**)                      |
| Self-service shows login page | Configure a **Completion flow** on the stage with **No authentication required** |
| Warning message not showing   | Ensure **Initial value expression** is enabled and field type is an alert type   |

---

## Security Policy

# Security Policy

---

## Hardening authentik

authentik is secure by default, but you can tighten it further. Most of the changes below cost something in convenience. Apply the ones that match your threat model rather than all of them at once.

## Authentication

### Password policy

The shipped password policy requires 8 characters and runs a zxcvbn strength check, failing anything scoring 2 or below. It is bound to the default password change flow only, so it does not apply to enrollment flows or to passwords an administrator sets directly. Bind it, or a policy like it, anywhere else a user can choose a password.

Two changes bring the policy in line with the [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html#password):

- Raise the minimum length to 15 characters. NIST allows 8 characters only when the password is one factor of MFA, and the shipped authentication flow skips [MFA validation](../add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx) for users with no authenticator enrolled. If MFA is mandatory in your deployment, 8 characters remains sufficient.
- Enable **Check haveibeenpwned.com**, which covers NIST's requirement to compare passwords against commonly used, expected, or compromised values.

The haveibeenpwned.com check needs outbound network access, so it does not work on [air-gapped instances](../install-config/air-gapped.mdx). Air-gapped deployments need an [Expression policy](../customize/policies/types/expression/index.mdx) that checks against a locally held list instead.

For the remaining options, see [Password policy](../customize/policies/types/password.mdx). A [password expiry policy](../customize/policies/types/password-expiry.mdx) also exists, though NIST no longer recommends routine forced rotation.

### Multi-factor authentication

Requiring a second factor is the single most effective change you can make to an authentication flow. Add an [Authenticator Validation stage](../add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx) to your authentication flow and review these settings:

- **Not configured action** defaults to **Continue**, which lets a user with no authenticator sign in with a password alone. Set it to **Force the user to configure an authenticator**, or to **Deny the user access** if you enroll authenticators out of band.

- Restrict **Device Classes** to the methods you accept. All six are enabled by default; limiting the stage to WebAuthn removes phishable factors such as TOTP and SMS.

- Set **WebAuthn User verification** to **Required**. The default, **Preferred**, lets an authenticator prove possession without confirming who is holding it.

- Use **WebAuthn Device type restrictions** to limit authentication to approved hardware. Configure the same allowlist on the [WebAuthn authenticator setup stage](../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx) so new enrollments match.

  The filter only applies to devices that have a stored device type. Devices enrolled before authentik 2024.4, and authenticators whose AAGUID authentik does not recognize, have no stored type and pass the filter untouched. To make the restriction enforceable, delete those enrollments and have the users re-enroll.

- **Last validation threshold** defaults to `seconds=0`, which validates on every attempt. Only raise it if you deliberately want to skip validation for users who recently used a device.

- Leave the four throttling factors at their default of `1`. They apply exponential back-off to code-based methods, doubling the lockout after each consecutive failure: one second, then two, then four. Setting a factor to `0` turns the back-off off entirely.

Recovery flows deserve the same scrutiny. A recovery flow that only requires an emailed link reduces the whole account to the security of the user's mailbox.

### Account enumeration

The [Identification stage](../add-secure-apps/flows-stages/stages/identification/index.mdx) ships with enumeration protection on, but two of its defaults still leak.

- Keep **Pretend user exists** enabled, as it is by default. With it off, an unknown identifier fails at this stage while a valid one continues, which tells an attacker which is which.
- Disable **Show matched user**, which is enabled by default. It shows the matched account's username and avatar on the next step, and falls back to echoing whatever was typed for an unknown identifier, so the two cases look different.
- Limit **User Fields** to the identifiers you need. The default flow accepts both email and username, which doubles the values an attacker can test per account.
- Bind a policy to the **Enrollment flow**, **Recovery flow**, and **Passwordless flow**, or delete those flows, if they should not be reachable. Unlinking them here only removes them from the login screen; the flows stay live at `/if/flow/<slug>/`.

### Brute-force resistance

Combine these controls to slow down credential stuffing:

- Use a [Reputation policy](../customize/policies/types/reputation.mdx) to react to repeated failures from a username or client IP. Each failed login scores -1 and each success +1, and the policy passes when the score is at or **below** its threshold, so it passes for bad actors. Bind it to a [CAPTCHA stage](../add-secure-apps/flows-stages/stages/captcha/index.mdx) to challenge low-reputation requests, or to the authentication flow with **Negate** enabled to deny them. Binding it to a flow without **Negate** locks out everyone except the attacker. Score limits live under **System** > **Settings** as **Reputation: lower limit** and **Reputation: upper limit**.
- Add a CAPTCHA stage unconditionally, either standalone or inline on the Identification stage, if you would rather not make it reputation-dependent.
- Bind a [GeoIP policy](../customize/policies/types/geoip.mdx) to restrict sign-ins to expected countries, or to require extra verification elsewhere.
- Configure [notification rules](../sys-mgmt/events/notifications.mdx) on `login_failed` and `suspicious_request` so spikes surface instead of only being recorded.

## Sessions

### Session lifetime

The [User Login stage](../add-secure-apps/flows-stages/stages/user_login/index.mdx) controls how long an authenticated session lasts.

- **Session duration** defaults to `seconds=0`, which ends the session when the browser closes. Any explicit duration makes the session persistent instead, surviving browser restarts for that long. Set one only if you need it, and keep it short.
- **Remember device** defaults to `days=30`. That is a signed cookie identifying the user on this device, outliving the session itself. Set it to `seconds=0` if you do not want it.
- **Remember me offset** defaults to `seconds=0`, which hides the remember-me option. Leave it there, or keep any offset short.
- Enable **Terminate other sessions**, off by default, so a new sign-in invalidates the user's existing sessions.

### Session binding

The User Login stage can bind a session to the network and location it was created from, then terminate it when the client moves beyond the configured strictness. This limits how far a stolen session cookie travels. A cookie replayed from within the same permitted ASN or region still works, so treat binding as relocation detection rather than as replay protection.

- **Network binding** can bind to ASN; ASN and network; or ASN, network, and IP.
- **GeoIP binding** can bind to continent; continent and country; or continent, country, and city.

Both default to no binding. When a bound session moves, authentik terminates it and records a logout event naming what changed.

Stricter bindings cause more spurious logouts. Users on mobile networks, on VPNs, or behind load-balanced egress change ASN or IP mid-session as a matter of course. Start with the loosest binding that meets your requirements and read the resulting logout events before tightening it.

Each binding type needs its own database: network binding uses the ASN database ([`AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__ASN`](../install-config/configuration/configuration.mdx#authentik_events__context_processors__asn)), GeoIP binding uses the GeoIP City database ([`AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__GEOIP`](../install-config/configuration/configuration.mdx#authentik_events__context_processors__geoip)).

A missing database fails the lookup, which counts as a broken binding and terminates the session. authentik only runs the check once a client's IP changes, never at login, so a missing database can stay hidden long after you enable binding.

## Administrative access

### Limit superusers

Any account in a group with **Superuser Privileges** can change every object in authentik, including the flows that protect it. Grant the smallest set of permissions that lets an administrator do their job:

- Use [roles](../users-sources/roles/index.mdx) and [access control](../users-sources/access-control/index.mdx) to assign specific object and global permissions instead of superuser membership.
- Review superuser group membership regularly, and require phishing-resistant MFA on every superuser account.

### Impersonation

Impersonation lets an administrator act as another user. Both settings live under **System** > **Settings** and are enabled by default:

- Disable **Impersonation** if you do not need it. This applies globally, superusers included.
- Keep **Require reason for impersonation** enabled so every use carries a justification.

Impersonation always generates `impersonation_started` and `impersonation_ended` events. Configure a [notification rule](../sys-mgmt/events/notifications.mdx) on them so use is visible in real time rather than at audit.

### Tokens and app passwords

API tokens and app passwords bypass flow-based authentication, including MFA.

Review existing tokens under **Directory** > **Tokens and App passwords**, and prefer [service accounts](../users-sources/user/account-types/service-accounts.mdx) with scoped permissions over tokens tied to a superuser.

### Audit events

[Events](../sys-mgmt/events/index.mdx) are authentik's audit log. Two settings under **System** > **Settings** govern retention:

- **Event retention** defaults to `days=365`. Raise it to match your requirements, or forward events to an external system and lower it. authentik stamps the expiry when it writes the event, so a change only affects events recorded afterwards.
- **GDPR compliance**, enabled by default, deletes a user's events along with the user. Disable it if your audit requirements outweigh that, bearing local data protection obligations in mind.

Notification rules give early warning of administrative activity: `model_created`, `model_updated`, and `model_deleted` for configuration changes, or `secret_view` for reading a token or certificate. See [event actions](../sys-mgmt/events/event-actions.mdx) for the full list.

## Restricting configuration changes

Expressions, blueprints, and CAPTCHA stages all let a highly privileged user change how authentik behaves. By default authentik limits them to superusers and users holding the relevant permissions, and logs every change. To remove the ability entirely, block the corresponding API endpoints in front of authentik, for example at your [reverse proxy](../install-config/reverse-proxy.mdx).

Once you do, the affected objects can only be edited through [blueprints on the file system](../customize/blueprints/index.mdx#as-a-local-file). Restrict access to that file system, and to whatever deploys files onto it, with the same care.

### Expressions

[Expressions](../customize/policies/types/expression/index.mdx) run custom Python inside authentik to modify its behavior. To stop every user, superusers included, from creating or editing them, block:

- `/api/v3/policies/expression*`
- `/api/v3/propertymappings*`
- `/api/v3/stages/prompt/prompts*`
- `/api/v3/managed/blueprints*`

### Blueprints

Blueprints manage authentik configuration as code. They carry the same permission requirements as expressions, but because they drive the API at a lower level they can create other objects outright. To stop every user from creating or editing them, block:

- `/api/v3/managed/blueprints*`

### CAPTCHA stage

The CAPTCHA stage verifies a user while authenticating or authorizing an application. It supports several providers, including Google's reCAPTCHA and Cloudflare's Turnstile, so the URL of the JavaScript snippet it loads is editable. Depending on your threat model, a malicious insider could point it somewhere else. To stop every user from creating or editing CAPTCHA stages, block:

- `/api/v3/stages/captcha*`
- `/api/v3/managed/blueprints*`

## Deployment

### Secret key

[`AUTHENTIK_SECRET_KEY`](../install-config/configuration/configuration.mdx#authentik_secret_key) signs session cookies and backs several other cryptographic operations. Generate it from a cryptographically secure source, keep it out of version control, and supply it through a secret manager rather than a plaintext environment file. Rotating it invalidates every active session, so change it if it leaks, not as routine maintenance.

### Trusted proxy headers

[`AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`](../install-config/configuration/configuration.mdx#authentik_listen__trusted_proxy_cidrs) decides which source addresses may set proxy headers such as `X-Forwarded-For`. It defaults to loopback plus every private range, which is broader than most deployments need.

Narrow it to the addresses of your actual reverse proxies. Any untrusted client that can reach authentik directly from a listed range can spoof its own client IP, which undermines reputation policies, GeoIP policies, session binding, and the accuracy of the audit log all at once.

### Database connections

[`AUTHENTIK_POSTGRESQL__SSLMODE`](../install-config/configuration/configuration.mdx#postgresql-settings) defaults to `disable`, which validates no certificate at all. Unless the database is reached over a trusted local socket, set it to `verify-ca`, or to `verify-full` where hostname verification is available.

### Embedded outpost

The embedded outpost runs inside the authentik server and serves proxy provider traffic. If you run standalone outposts, or no proxy providers at all, set `AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST` to `true` to shut it off.

### Logging and error reporting

- Keep [`AUTHENTIK_LOG_LEVEL`](../install-config/configuration/configuration.mdx#authentik_log_level) at its `info` default in production. `trace` is a debugging level and can put session cookies and request headers into your logs.
- [`AUTHENTIK_ERROR_REPORTING__ENABLED`](../install-config/configuration/configuration.mdx#authentik_error_reporting) is disabled by default. If you enable it, leave `AUTHENTIK_ERROR_REPORTING__SEND_PII` disabled, or point the DSN at a Sentry instance you control.

## HTTP headers

### Content Security Policy (CSP)

Content Security Policy mitigates content injection. authentik does not set a CSP on its own interface, so it depends on your installation; we recommend setting the header at a [reverse proxy](../install-config/reverse-proxy.mdx).

authentik already sets a restrictive CSP on user-uploaded files under `/media`. Do not overwrite a header authentik has set, as replacing that one weakens it. Add your header only where none exists.

authentik needs at least these locations allowed:

```
default-src 'self';
img-src https: data:;
object-src 'none';
frame-ancestors 'self';              # Same-origin framing is used by the flow executor and SAML
style-src 'self' 'unsafe-inline';    # Required due to Lit/ShadowDOM
script-src 'self' 'unsafe-inline';   # Required for generated scripts
```

Get this wrong and the client silently fails to load code it needs, so test before rolling it out. Your deployment may need more locations, for example:

- when using a CAPTCHA service
- when using Sentry
- when using custom JavaScript in a prompt stage
- when using Spotlight Sidecar for development
- when using images hosted over HTTP

`frame-ancestors 'none'` is stricter, but the flow executor and the SAML POST bindings intentionally permit same-origin framing. Use `'self'` unless you have confirmed nothing in your deployment relies on it.

### Other headers

authentik already sends `X-Frame-Options` on its own responses. At the reverse proxy, consider adding:

- `Strict-Transport-Security`, once every host under the domain is served over HTTPS.
- `Referrer-Policy: strict-origin-when-cross-origin` or stricter, so flow URLs carrying tokens do not leak in referrers.
- `X-Content-Type-Options: nosniff`.

---

## AKQL search syntax

AKQL (authentik Query Language) is the advanced search syntax used in the authentik Admin interface and API. Use AKQL to filter long lists, such as events, users, and groups, with structured expressions like `action = "login"` or `context.geo.country = "Germany"`.

AKQL is built on [DjangoQL](https://github.com/ivelum/djangoql).

## Where AKQL is available

AKQL is available on lists and fields backed by the query language:

- **Events** > **Logs**: See [Logging events](./events/logging-events.mdx#advanced-queries).
- **Directory** > **Users**: See [Manage users](../users-sources/user/user_basic_operations.mdx#advanced-queries).
- **Directory** > **Groups**: See [Manage groups](../users-sources/groups/manage_groups.mdx#advanced-queries).
- **Event Matcher policies**: the **Query** field on an [Event Matcher policy](../customize/policies/types/event-matcher.mdx#what-it-matches).
- **REST API list endpoints**: the `search` query parameter on endpoints that return an AKQL autocomplete schema. See [Use AKQL through the API](#use-akql-through-the-api).

Each area exposes its own searchable fields. See [Searchable fields](#searchable-fields).

If the search string is not a valid AKQL expression, authentik falls back to a plain case-insensitive substring search across that list's default search fields. For example, `bob` runs as plain search, while `username = "bob"` runs as AKQL.

## Query structure

An AKQL query is built from comparisons in this format:

```text
<field> <operator> <value>
```

**Example**:

```text
username = "bob"
```

You can combine comparisons with `and` and `or`, and use parentheses to group conditions.

### Fields

A field is an attribute that you can filter on, such as `username`, `action`, or `is_active`. The available fields depend on the list that you search.

For related objects and JSON values, use dot notation. For example, use `user.username` for a nested user value on an event, and `context.geo.country` for a value inside the event context.

### Operators

The valid operators depend on the field type.

| Operator         | Meaning                                | Field types             |
| ---------------- | -------------------------------------- | ----------------------- |
| `=`              | Equal to                               | All field types         |
| `!=`             | Not equal to                           | All field types         |
| `>`              | Greater than                           | Numbers, dates, strings |
| `>=`             | Greater than or equal to               | Numbers, dates, strings |
| `<`              | Less than                              | Numbers, dates, strings |
| `<=`             | Less than or equal to                  | Numbers, dates, strings |
| `~`              | Contains, case-insensitive             | Strings, dates          |
| `!~`             | Does not contain, case-insensitive     | Strings, dates          |
| `startswith`     | Starts with, case-insensitive          | Strings                 |
| `not startswith` | Does not start with, case-insensitive  | Strings                 |
| `endswith`       | Ends with, case-insensitive            | Strings                 |
| `not endswith`   | Does not end with, case-insensitive    | Strings                 |
| `in (...)`       | Matches any value in the list          | All field types         |
| `not in (...)`   | Matches none of the values in the list | All field types         |

The `~` and `!~` operators perform a case-insensitive substring match, not a regular-expression match. For example, `username ~ "adm"` matches `akadmin` and `administrator`.

### Values

Values are typed. The way you write the value tells AKQL how to interpret it.

| Type    | Syntax                                    | Examples             |
| ------- | ----------------------------------------- | -------------------- |
| String  | Double quotes or single quotes            | `"bob"`, `'login'`   |
| Integer | Whole number                              | `42`, `-7`           |
| Float   | Decimal or exponent number                | `3.14`, `1e3`        |
| Boolean | `True` or `False`                         | `is_active = False`  |
| Null    | `None`                                    | `email = None`       |
| List    | Comma-separated values inside parentheses | `("ana", "akadmin")` |

Keep the following rules in mind:

- Operators and keywords such as `and`, `or`, `not`, `in`, `startswith`, and `endswith` are lowercase.
- Boolean and null values use `True`, `False`, and `None`.
- Strings support escape sequences such as `\"`, `\\`, `\n`, `\t`, and `\u00e9`.
- You can compare a field to `None` only when that field is nullable.

### Combine conditions

Use `and` and `or` to combine comparisons.

**Examples**:

```text
action = "login" and user.username = "bob"
```

```text
action = "login" or action = "logout"
```

```text
(action = "login" or action = "logout") and user.username = "bob"
```

When you mix `and` and `or`, use parentheses so the grouping is clear.

AKQL does not support a standalone `not` operator for a whole expression. Use `!=` for "not equal to" and `!~` for "does not contain". The `not` keyword is valid only in `not in`, `not startswith`, and `not endswith`.

## Field types

Each searchable field has a type. The field type determines which operators and values it accepts.

### Choice fields

Choice fields, such as an event's `action` or a user's `type`, accept only a fixed set of values. The Admin interface suggests valid values as you type.

### Date and time fields

Date and time fields, such as an event's `created` timestamp, use quoted timestamp values.

Supported formats:

- `"YYYY-MM-DD"`, for example `"2024-01-30"`.
- `"YYYY-MM-DD HH:MM"`, for example `"2024-01-30 09:00"`.
- `"YYYY-MM-DD HH:MM:SS"`, for example `"2024-01-30 09:00:15"`.

**Examples**:

```text
created > "2024-01-01"
```

```text
created >= "2024-01-30 09:00" and created < "2024-01-30 17:00"
```

The `~` operator on a date field performs a substring match on the text form of the timestamp. This is useful for matching a whole day.

```text
created ~ "2024-01-30"
```

### JSON and nested fields

Some searchable fields, such as a user's `attributes` or an event's `context`, contain JSON objects. Use dot notation to query values inside them.

**Examples**:

```text
attributes.department = "engineering"
```

```text
context.geo.country = "Germany"
```

Values inside JSON fields can be strings, Booleans, or numbers2026.8, so a numeric attribute is matched by its value rather than its text form.

**Examples**:

```text
attributes.seat_count > 5
```

```text
attributes.onboarded = True
```

For related objects and JSON objects, query a nested value such as `user.username`, `brand.name`, or `context.http_request.path`. A comparison against the root object, such as `user = "bob"`, is not valid AKQL.

Autocomplete suggests a known subset of nested paths. You can still query other JSON key paths that exist in the stored data.

## Searchable fields

The fields available to AKQL are specific to each list.

### Events

Available in **Events** > **Logs** and in the **Query** field on Event Matcher policies.

| Field              | Type      | Description                                                                           |
| ------------------ | --------- | ------------------------------------------------------------------------------------- |
| `action`           | Choice    | The [event action](./events/event-actions.mdx), such as `login`.                      |
| `event_uuid`       | String    | The event's unique identifier.                                                        |
| `app`              | String    | The application or authentik component that emitted the event.                        |
| `client_ip`        | String    | The client IP address associated with the event.                                      |
| `user.pk`          | Integer   | The acting user's primary key.                                                        |
| `user.username`    | String    | The acting user's username.                                                           |
| `user.email`       | String    | The acting user's email address.                                                      |
| `brand.pk`         | String    | The primary key of the [brand](../customize/branding/index.mdx) active for the event. |
| `brand.app`        | String    | The brand's app label.                                                                |
| `brand.name`       | String    | The brand's name.                                                                     |
| `brand.model_name` | String    | The brand's model name.                                                               |
| `context.*`        | JSON      | Arbitrary event context.                                                              |
| `created`          | Date/time | When the event occurred.                                                              |

Common event context paths include:

- `context.http_request.path`, `context.http_request.method`, `context.http_request.request_id`, `context.http_request.user_agent`, and `context.http_request.args.*`.
- `context.geo.country`, `context.geo.city`, and other geolocation keys when [GeoIP](./ops/geoip.mdx) is configured.
- `context.authorized_application.name` and other details for the application involved in the event.

### Users

Available in **Directory** > **Users**.

| Field          | Type    | Description                                                             |
| -------------- | ------- | ----------------------------------------------------------------------- |
| `username`     | String  | The user's username.                                                    |
| `name`         | String  | The user's display name.                                                |
| `email`        | String  | The user's email address.                                               |
| `path`         | String  | The user's path within the directory.                                   |
| `is_active`    | Boolean | Whether the account is active.                                          |
| `type`         | Choice  | The user type, such as `internal` or `external`.                        |
| `attributes.*` | JSON    | Any [custom attribute](../users-sources/user/user_ref.mdx) on the user. |

### Groups

Available in **Directory** > **Groups**.

| Field          | Type    | Description                                |
| -------------- | ------- | ------------------------------------------ |
| `name`         | String  | The group's name.                          |
| `is_superuser` | Boolean | Whether the group grants superuser access. |
| `attributes.*` | JSON    | Any custom attribute on the group.         |

## Examples

### Event examples

```text
action = "login"
```

```text
app startswith "authentik"
```

```text
user.username in ("ana", "akadmin")
```

```text
context.geo.country = "Germany"
```

### User examples

```text
is_active = False
```

```text
email endswith "@authentik.company"
```

```text
attributes.department = "engineering"
```

### Group examples

```text
is_superuser = True
```

```text
attributes.role = "admin"
```

## Use AKQL through the API

API list endpoints that support AKQL accept the query in the `search` query parameter. URL-encode the query string.

**Example**:

```http
GET /api/v3/core/users/?search=username%20%3D%20%22bob%22
```

The response pagination object includes an `autocomplete` field that describes the searchable schema for the endpoint. The Admin interface uses this schema for autocomplete suggestions.

## Use AKQL in an Event Matcher policy

Use the **Query** field on an [Event Matcher policy](../customize/policies/types/event-matcher.mdx) to match events with AKQL.

1. In the Admin interface, navigate to **Customization** > **Policies**.
2. Create or edit an **Event Matcher Policy**.
3. In the **Query** field, enter a query that uses the [event fields](#events).

**Example**:

```text
action = "login_failed" and context.geo.country != "United States"
```

The policy passes when the event matches the query. If you configure other fields on the policy, such as **Action** or **App**, the event must match those fields and the AKQL query.

## Autocomplete and keyboard shortcuts

AKQL search fields offer autocomplete suggestions for fields, operators, and values where suggestions are available.

If an operator or value does not appear in the autocomplete menu, enter it manually.

The following keyboard shortcuts are available in AKQL search fields:

---

## Background tasks

authentik uses background tasks to run various operations independently and asynchronously, separated from the continuous web requests processed for general user interaction. These background tasks are run by the [worker](./ops/worker.mdx).

## What are background tasks used for?

Here is a non-exhaustive list of what background tasks are used for:

- Outposts: manage [outpost](../add-secure-apps/outposts/index.mdx) deployments, send notifications to outposts when a refresh is needed
- Housekeeping: clean up old objects, check for updates, etc.
- Blueprints: import and apply [Blueprints](../customize/blueprints/index.mdx)
- Synchronization: sync users to and from authentik, from sources and to providers. This is used by:
  - [SCIM Provider](../add-secure-apps/providers/scim/index.mdx)
  - [Google Workspace Provider](../add-secure-apps/providers/gws/index.mdx)
  - [Microsoft Entra Provider](../add-secure-apps/providers/entra/index.mdx)
  - [SSF Provider](../add-secure-apps/providers/ssf/index.mdx)
  - [Kerberos Source](../users-sources/sources/protocols/kerberos/index.mdx)
  - [LDAP Source](../users-sources/sources/protocols/ldap/index.mdx)
- Enterprise [license management](../enterprise/manage-enterprise.mdx#license-management)
- Event Notifications: send [Notifications](./events/notifications.mdx) when events are created
- Emails: send emails when triggered by one of the email stages or otherwise

## Schedules

authentik runs some tasks on a schedule. Schedules can be [configured](#schedule-configuration) or manually triggered by clicking the play arrow.

When you manually trigger a schedule using the play arrow, it will run immediately but the "Next run" time will not be updated. The "Next run" field only reflects when the automatic scheduler will dispatch the task according to its cron schedule.

## Tasks statuses

A task can have the following statuses:

- **Successful**: the task executed successfully. No extra action is required.
- **Warning**: the task emitted a warning. Look at the task logs for further information. See [Failed tasks](#failed-tasks) for more details.
- **Error**: the task failed to process. Either the task threw an exception, or reported another error. Look at the task logs for further information. See [Failed tasks](#failed-tasks) for more details.
- **Waiting to run**: the task has been queued for running, but no worker has picked it up yet, either because none are available, they are already busy, or because it's just been queued.
- **Waiting for dependencies**: the task is waiting for other tasks to finish before starting.
- **Consumed**: the task has been picked up by a worker.
- **Pre-processing**: the task is being prepared to run.
- **Running**: the task is currently running.
- **Post-processing**: the task has finished running and is being cleaned up.

## Manage background tasks

### View system tasks

You can view and manage all background tasks and schedules from the Admin interface.

However, by default, tasks are shown *as close as possible* to their relevant objects. For instance, LDAP source synchronization tasks and schedules are shown on the LDAP source detail page.

When a task or a schedule cannot be associated to an object (for example, housekeeping tasks), it is referred to as "standalone" and is displayed under **Dashboards** > **System Tasks**. Note that tasks created from a schedule are associated to that schedule and thus are not considered standalone. Both schedule and task items can be expanded to view additional details about them.

If you cannot find the object to which a task or schedule is attached, deselect the "Show only standalone tasks/schedules" toggle on the **System Tasks** page to show all tasks and schedules, including the ones that are attached to objects.

By default, successful tasks are hidden to minimize the number of shown items. Deselect "Exclude successful tasks" to display them.

### Schedule configuration

When the authentik system creates a schedule it is assigned a default interval. The schedule uses a format based on [unix-cron](https://man7.org/linux/man-pages/man5/crontab.5.html).

To change that interval, click the Edit icon for the specific schedule and update it.

Some tasks are required to run at regular intervals. For tuning reasons we recommend editing the intervals only for synchronization schedules, not for other types of schedules.

If the "Next run" field appears to be in the past, this is normal and expected. It simply means the scheduler will dispatch the task the next time the scheduler runs. By default, the scheduler runs every 60 seconds (configurable via [`AUTHENTIK_WORKER__SCHEDULER_INTERVAL`](../install-config/configuration/configuration.mdx#authentik_worker__scheduler_interval)).

Schedules can also be *paused* to prevent new tasks from being created. They can still be triggered manually while paused. When you un-pause a schedule, it will be triggered immediately.

### Failed tasks

When a task fails, i.e. when the code throws an exception, the task will be retried as many times as the value configured in [`AUTHENTIK_WORKER__TASK_MAX_RETRIES`](../install-config/configuration/configuration.mdx#authentik_worker__task_max_retries). Tasks that self-reported an error or a warning will not be retried.

Failed tasks will be displayed like any other tasks. Each task can be expanded to show its logs. The logs are split into two parts: "Current execution logs" for the current execution, and "Previous execution logs" for logs from previous executions that happened before a retry was initiated. The information contained in the logs indicates either a transient error (a network connection failed for example), a misconfiguration (wrong password set in the LDAP source for example), or a bug in authentik.

#### Restart tasks

To restart a task, click the retry arrow next to the task. It will be queued again and picked up by a worker.

To retry tasks created from a schedule, we recommend manually triggering the schedule (click the Run arrow beside the schedule) instead of restarting one of its tasks.

---

## Certificates

Certificates in authentik are used for:

- Signing and verifying SAML requests and responses
- Signing JSON web tokens for OAuth and OIDC
- Connecting to remote Docker hosts using the Docker integration
- Verifying LDAP servers' certificates
- Encrypting outposts' endpoints

## Default certificate

Every authentik installation generates a self-signed certificate on first startup. The certificate is named `authentik Self-signed Certificate` and is valid for 1 year.

This certificate serves as the default for all OAuth2/OIDC providers, as these don't require certificate configuration on both sides (JWT signatures are validated using the [JWKS](../users-sources/sources/protocols/oauth/index.mdx#jwks) URL).

While this certificate can be used for SAML providers/sources, remember that it's only valid for a year. Since some SAML applications require valid certificates, you might need to rotate them regularly.

For SAML use-cases, you can generate a certificate with a longer validity period (at your own risk).

## Certificate considerations

### OAuth and SAML

For OAuth and SAML providers, in the vast majority of cases, certificate expiry does not matter. Most service providers don't check whether certificates are expired. What usually matters is that the signature is valid.

However, there are some notable exceptions; for example, the Slack SAML integration does check for certificate expiry.

We recommend checking your service provider's documentation for specific requirements.

### Proxy provider and brands

We recommend using a certificate generated outside of authentik that matches your Fully Qualified Domain Name (FQDN), preferably issued by a publicly trusted certificate authority.

### Radius EAP-TLS

We recommend using a certificate generated outside of authentik. A privately issued certificate is sufficient.

## Download SAML certificates

To download a certificate for SAML configuration:

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click on the name of the provider.
3. Click the **Download** button found under **Download signing certificate**. The contents of this certificate will be required when configuring the service provider.

## Certificate recommendations

It is generally not recommended to use short-lived certificates for SAML/OIDC signing operations as the main priority is that the signature is valid. Frequently changing certificates can be problematic as it requires updating configuration in authentik and potentially in connected applications.

## External certificates

To use externally managed certificates (e.g., from Certbot or HashiCorp Vault), you can use the discovery feature.

### Certificate discovery

authentik can automatically discover and import certificates from a designated directory. This allows you to use externally managed certificates with minimal configuration.

Certificate discovery can be manually initiated by restarting the `certificate_discovery` system task from the authentik Admin interface under **Dashboards** > **System Tasks**.

#### Mounted directories

- **Docker Compose**: A `certs` directory is mapped to `/certs` within the worker container.
- **Kubernetes**: You can mount custom Secrets or Volumes under `/certs` and configure them in the worker Pod specification.

When a new key pair is added or changed, authentik automatically triggers an outpost refresh.

When a new key pair is added with a private key that already exists in the database, authentik updates the existing key pair's certificate instead of creating a duplicate one.

### Manual imports

Since authentik 2022.9, you can import certificates with any folder structure directly. Run commands within the worker container to import certificates in different ways:

#### Import certificate with private key

Use this option when you need to import a complete certificate keypair that authentik can use for signing or encryption:

```shell
ak import_certificate --certificate /certs/mycert.pem --private-key /certs/private.pem --name mycert
```

#### Import certificate for trust only

Use this option when you only need to establish trust with an external system and don't need the private key:

```shell
ak import_certificate --certificate /certs/othercert.pem --name othercert
```

These commands import certificates under the specified names. They are safe to run as cron jobs, as authentik only re-imports certificates when they change.

#### Naming conventions

authentik uses the following rules to import certificates:

- **Root directory files**: Files in the root directory are imported based on their filename
  - `/foo.pem` will be imported as the keypair `foo`
  - Files are classified as private keys if they contain `PRIVATE KEY`, otherwise as certificates

- **Certbot convention**: Files named `fullchain.pem` or `privkey.pem` will use their parent folder's name
  - Files in paths containing `archive` are ignored (to better support certbot setups)

- **[Kubernetes TLS Secrets](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod)**: Files named `tls.crt` or `tls.key` will use their parent folder's name
  - Files named `tls-combined.pem`, `ca.crt`, or `key.der` are ignored (to better support [cert-manager setups](https://cert-manager.io/docs/usage/certificate/#additional-certificate-output-formats))

- **Flexible organization**: Files can use any directory structure and extension

#### Directory structure example

Below is an example of a valid certificate directory structure:

```text
certs/
├── baz
│   └── bar.baz
│       ├── fullchain.pem
│       └── privkey.pem
├── foo.bar
│   ├── fullchain.pem
│   └── privkey.pem
├── foo.baz
│   ├── key.der
│   ├── tls.crt
│   └── tls.key
├── foo.key
└── foo.pem
```

## Web certificates

You can configure the certificate used by authentik's core webserver, which allows for compact and self-contained authentik installations, even though most deployments use reverse proxies.

### Let's Encrypt integration

To use Let's Encrypt certificates with Certbot in Docker Compose deployments, create or edit the `compose.override.yml` file in the same directory as your authentik Docker Compose file. The example below demonstrates the use of the AWS Route 53 DNS plugin:

```yaml
services:
    certbot:
        image: certbot/dns-route53:v4.0.0
        volumes:
            - ./certs/:/etc/letsencrypt
        # Variables depending on DNS Plugin
        environment:
            AWS_ACCESS_KEY_ID: ...
        command:
            - certonly
            - --non-interactive
            - --agree-tos
            # Replace your@email.com with the email you wish to use
            - -m your@email.com
            # Replace authentik.company with your actual domain
            - -d authentik.company
            # Again, match with your provider
            - --dns-route53
```

For other DNS providers and detailed setup instructions, see the official [Certbot Docker documentation](https://eff-certbot.readthedocs.io/en/latest/install.html#alternative-1-docker). Certbot provides Docker images for many popular DNS providers.

The Certbot container only runs once. You'll need to set up a separate mechanism for regular certificate renewals.

Run `docker compose up -d` to create and start the Certbot container and generate your certificate. The certificate should appear in authentik within minutes. If it doesn't, restart the worker container (this can happen due to permission issues set by Certbot).

For Kubernetes or AWS deployments, you can use similar approaches with appropriate certificate management tools for your platform.

Navigate to **System** > **Brands**, edit any brand, and select your preferred certificate.

---

## Data Exports

authentik enterprise allows you to export user and event data in CSV format for backup or analysis purposes.

The content included in a data export matches that returned by the API endpoints for the respective object types.

For detailed instructions on exporting users and events, see [Export users](../users-sources/user/user_basic_operations.mdx#export-users-) and [Export events](events/logging-events.mdx#export-events) respectively.

You can access past data exports from the **Events** > **Data Exports** page. On this page you can view the query used for a specific export, search exports by data type and user, download completed exports and delete exports that you no longer need.

## Permissions

Creating or viewing a data export requires [view permission](../users-sources/access-control/permissions.mdx) on the object type being exported in addition to the respective permission for data exports.

---

## Object attributes

## About object attributes

Object attributes let you define structured, reusable attribute fields for Users, Groups, Application entitlements, and Device access groups. When you define an object attribute, authentik displays it as a labeled field in the relevant create and edit forms. You can group related attribute fields and optionally validate submitted values.

Attributes remain editable in the **Attributes** field on an object. However, when an attribute has an object attribute definition, its generated form field is authoritative. When you save the object, authentik overwrites any value entered directly in **Attributes** for the same key.

## Default object attribute definitions

authentik includes definitions for common attributes. These defaults are disabled by default; [enable a definition](#enable-or-disable-an-object-attribute-definition) when you want its labeled field on forms.

| Key                   | Description                                      |
| --------------------- | ------------------------------------------------ |
| `given_name`          | The user's given (first) name                    |
| `family_name`         | The user's family (last) name                    |
| `settings.locale`     | The user's preferred locale, for example `en-US` |
| `address_street`      | Street address                                   |
| `address_locality`    | City or locality                                 |
| `address_region`      | State, province, or region                       |
| `address_postal_code` | Postal or ZIP code                               |
| `phone_number`        | Telephone number                                 |
| `unix_shell`          | Login shell, used by the LDAP provider           |
| `employee_number`     | Employee or personnel number                     |
| `employee_job_title`  | Job title                                        |
| `employee_department` | Department name                                  |

## Object attribute fields

The following fields are available when defining an object attribute:

| Field                 | Required | Description                                                                                                 |
| --------------------- | -------- | ----------------------------------------------------------------------------------------------------------- |
| Label                 | Yes      | The display name of the attribute in the Admin interface                                                    |
| Key                   | Yes      | The attribute key. Can be nested via dot notation, for example: `settings.locale`                           |
| Group                 | No       | Groups attributes under a shared heading on forms. Attributes without a group are rendered ungrouped        |
| Enabled               | Yes      | Controls whether the attribute is shown on forms for the selected object type                               |
| Type                  | Yes      | The attribute type: Text, Number, or Boolean                                                                |
| Object type           | Yes      | The object type that the attribute applies to: User, Group, Application entitlement, or Device access group |
| Attribute is required | No       | Enforces whether a value is required for the attribute on the selected object type                          |
| Attribute is unique   | No       | Enforces whether the value must be unique across all instances of the selected object type                  |
| Regex                 | No       | A regular expression that the value of the attribute is validated against                                   |

## Use object attributes

### Create an object attribute definition

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Directory** > **Object attributes** and click **Create**.
3. Enter a **Label**, for example `Employee ID`.
4. Enter a **Key**, for example `employee_id`.
5. Select a **Type** for the attribute: Text, Number, or Boolean.
6. Select the **Object type** the attribute applies to: User, Group, Application entitlement, or Device access group.
7. Optionally set a **Group**, for example `Employment`, to group the attribute field with related attribute fields.
8. Optionally set **Attribute is required**, **Attribute is unique**, or a **Regex** pattern for validation.
9. Click **Create**.

Create or edit an object of that type, then confirm that the new field appears on the form.

### Enable or disable an object attribute definition

Disable an object attribute definition when you want to remove the attribute field on forms without losing the values already stored on objects.

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Directory** > **Object attributes**.
3. Select an object attribute definition and click **Edit**.
4. Toggle **Enabled**, then click **Update**.

Disabling a definition removes the field from forms and stops Regex and uniqueness validation for that key. When you re-enable an object attribute definition, stored values remain present and validation resumes on subsequent saves.

### Use object attributes in property mappings

**Example**: SAML property mapping:

```python
return ak_obj_attr(request.user, "given_name", user.name)
```

**Example**: Nested attribute value in an OAuth2 scope mapping:

```python
return {
    "locale": ak_obj_attr(request.user, "settings.locale", "en-US")
}
```

Always use `ak_obj_attr()` with a fallback (e.g., "en-US"). An object attribute definition does not guarantee that every object has a value for that key.

## Validation

### Uniqueness

If an object attribute definition has **Attribute is unique** enabled, authentik rejects a save when another object already stores the same value for that key. Uniqueness is only enforced while the object attribute definition is enabled.

### Existing data

Creating an object attribute definition does not validate values already stored on existing objects. Validation runs when an object is saved, so an object created before the definition existed can hold a value that does not match the definition's regex.

## Considerations and limitations

- Array values are not currently supported for object attributes, whether set through the UI, blueprints, or direct API calls to the affected objects. Only Text, Number, or Boolean values are supported. Support for array values is tracked in [this issue](https://github.com/goauthentik/authentik/issues/24250).
- Definitions are metadata. They do not create database constraints and do not migrate existing values.
- Validation is applied on save, not retroactively.

---

## Object Lifecycle Management

Object Lifecycle Management allows you to automate periodic reviews of authentication settings for groups, roles, and applications.

You can schedule reviews, track progress, and notify reviewers automatically.

## Lifecycle rules

Lifecycle rules define how often reviews are scheduled, the time before a review becomes overdue, who needs to approve a review, and how reviewers are notified.

You can create and configure Lifecycle rules via the **Events** > **Lifecycle Rules** page.

### Rule scope

A lifecycle rule can be scoped to:

- **A specific object**: The rule applies only to that individual Application, Group, or Role.
- **An entire object type**: The rule applies to all objects of that type (e.g., all applications).

Multiple rules can apply to the same object. For example, you can have a type-level rule that schedules quarterly reviews for all applications and an object-specific rule that schedules monthly reviews for a critical application. Each rule creates its own independent review cycle, so the object may have multiple concurrent reviews visible on its **Lifecycle** tab.

### Rule settings

A lifecycle rule has the following settings:

| Setting                        | Description                                                                                                                                   |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Object type**                | The type of object this rule applies to.                                                                                                      |
| **Object**                     | *(Optional)* A specific object to apply this rule to. If left empty, the rule applies to all objects of the selected type.                    |
| **Interval**                   | How often reviews are scheduled (e.g., every 60 days). After a review is completed, the next review will be scheduled after this interval.    |
| **Grace period**               | The time period reviewers have to complete the review before it becomes overdue. Must be shorter than the interval.                           |
| **Reviewer groups**            | Groups whose members can submit reviews.                                                                                                      |
| **Min reviewers**              | The minimum number of reviews required from members of any reviewing group.                                                                   |
| **Min reviewers is per group** | When enabled, the minimum number of reviewers is required from each reviewer group separately. When disabled, it's a total across all groups. |
| **Explicit reviewers**         | Individual users who must all submit a review, in addition to the reviewer groups requirement.                                                |
| **Notification transports**    | How reviewers are notified about pending, overdue, and completed reviews.                                                                     |

### Reviewer requirements

Each rule's review is considered complete independently. A review is considered complete when all of the following conditions are met:

1. All explicit reviewers have submitted their reviews.
2. The minimum number of reviews from reviewer group members has been reached (either per group or in total, depending on the setting).

For example, if a rule has:

- Two explicit reviewers (Alice and Bob)
- Two reviewer groups (Security Team and Compliance Team)
- **Min reviewers** is set to 2
- **Min reviewers is per-group** is enabled

Then the review requires approval from: Alice, Bob, at least 2 members of the Security Team, and at least 2 members of the Compliance Team.

## Review states

Each lifecycle rule creates its own review for the objects it governs. When multiple rules apply to the same object, each rule's review has its own independent state and progresses through its own review cycle. You can view all pending or overdue reviews on the **Events** > **Reviews** page. You can also view all of an object's current reviews on the **Lifecycle** tab of the object's detail page.

| State        | Description                                                                            |
| ------------ | -------------------------------------------------------------------------------------- |
| **Pending**  | A review has been initiated and is waiting for reviewers.                              |
| **Overdue**  | The grace period has passed without the review being completed.                        |
| **Reviewed** | All required reviews have been received and the review is complete.                    |
| **Canceled** | The review was canceled, typically because the lifecycle rule was deleted or modified. |

### Object review workflow

The following steps illustrate the workflow for an object lifecycle review process:

1. When a lifecycle rule is created or when the interval since the last completed review has elapsed, a new **Pending** review is created for the object and the rule's reviewers are notified.
2. Reviewers submit their reviews (with an optional note).
3. After all of the rule's requirements are met, the review transitions to the **Reviewed** state.
4. If the grace period passes without all requirements being met, the review becomes **Overdue** and reviewers receive an alert.
5. After the interval passes, a new review cycle begins for that rule.

If multiple rules apply to the same object, each rule runs its own review cycle independently. An object can have multiple concurrent reviews, each tracked separately on the **Lifecycle** tab.

## Reviewer workflow

To review and approve an object for a lifecycle rule, follow the steps below. A reviewer can be either a user set as an explicit reviewer or a member of a configured reviewer group.

1. After a new review cycle starts, you receive a notification that a review is due through the configured notification transports.

2. Click on the link in the notification to navigate to the object's detail page.

   Alternatively, you can navigate to the **Events** > **Reviews** page and enable "Only show reviews where I am a reviewer" filter to see reviews awaiting your action.
   Here, you can click on the object to navigate to its detail page.

   In both cases, you will be taken to the **Lifecycle** tab of the object's detail page, which lists all active reviews for the object.

3. Review the object's current configuration.

4. Go back to the **Lifecycle** tab.

5. Find the review for the relevant rule and click **Review** to submit your review, optionally including a note.

6. After all of the rule's reviewer requirements are met, that review automatically transitions to the **Reviewed** state.

### Submit a review

When a review is in the **Pending** or **Overdue** state, authorized reviewers can submit their approval. Each reviewer can only submit one review per rule per review cycle. When submitting a review, reviewers can optionally include a note explaining their decision.

Only authorized reviewers can submit reviews:

- Members of the configured reviewer groups
- Users listed as explicit reviewers

### Notifications

Reviewers are notified at the following events:

| Event            | Severity | Description                                                     |
| ---------------- | -------- | --------------------------------------------------------------- |
| Review initiated | Notice   | An object has entered the Pending review state.                 |
| Review overdue   | Alert    | The grace period has passed and the review is still incomplete. |
| Review completed | Notice   | All required reviews have been received.                        |

Configure notification transports on the lifecycle rule to control how these notifications are delivered (UI notification, email, webhook, etc.).

---

## System settings

System settings control system-wide behavior. They can be changed through the authentik Admin interface or API.

Environment-level and deployment settings are documented in the [configuration options](../install-config/configuration/configuration.mdx).

### Base URL2026.8

The base URL under which this authentik instance is reachable, for example `https://authentik.company`.

While this setting is empty, authentik displays a warning in the Admin interface until a value is provided. You can seed it at install time with the [`AUTHENTIK_WEB__BASE_URL`](../install-config/configuration/configuration.mdx) configuration option, but the value set here always takes precedence. A trailing slash is removed automatically. Defaults to an empty string.

Set this to the scheme and host only, without a path. All of authentik is served under [`AUTHENTIK_WEB__PATH`](../install-config/configuration/configuration.mdx#authentik_web__path) (`/` by default), and that prefix is already part of every link authentik generates. So even when you serve authentik under a subpath, for example `AUTHENTIK_WEB__PATH=/authentik/`, the base URL stays `https://authentik.company`, and generated links resolve under `https://authentik.company/authentik/`.

This setting is currently unused until it can be marked as required, starting from authentik version 2026.11.

### Avatars

Configure how authentik should show avatars for users. The following values can be set:

Default: `gravatar,initials`

- `none`: Disables per-user avatars and just shows a 1x1 pixel transparent picture
- `gravatar`: Uses Gravatar with the user's email address
- `initials`: Generated avatars based on the user's name
- Any URL: If you want to use images hosted on another server, you can set any URL.

  Additionally, these placeholders can be used:

  - `%(username)s`: The user's username
  - `%(mail_hash)s`: The email address, md5 hashed
  - `%(upn)s`: The user's UPN, if set (otherwise an empty string)

You can also use an attribute path like `attributes.something.avatar`, which can be used in combination with the file field to allow users to upload custom avatars for themselves.

Multiple modes can be set, and authentik will fall back to the next mode when no avatar could be found. For example, setting this to `gravatar,initials` will attempt to get an avatar from Gravatar, and if the user has not configured one there, it will fall back to a generated avatar.

### Allow users to change name

Enable the ability for users to change their name, defaults to `true`.

### Allow users to change email

Enable the ability for users to change their email address, defaults to `false`.

### Allow users to change username

Enable the ability for users to change their usernames, defaults to `false`.

### Event retention

Configure how long [Events](./events/index.mdx) are retained for within authentik. Default value is `days=365`. When forwarding events to an external application, this value can be decreased. When changing this value, only new events are affected.

### Reputation: lower limit

Configure a lower limit for [Reputation Policy](../customize/policies/types/reputation.mdx). Defaults to `-5`.

### Reputation: upper limit

Configure an upper limit for [Reputation Policy](../customize/policies/types/reputation.mdx). Defaults to `5`.

### Footer links

This option allows you to add linked text (footer links) on the bottom of flow pages. You can also use this setting to display additional static text to the flow pages, even if no URL is provided.

The URL is limited to web and email addresses. If the name is left blank, the URL will be shown.

This is a global setting. All flow pages that are rendered by the [Flow Executor](../add-secure-apps/flows-stages/flow/executors/if-flow.mdx) will display the footer links.

### GDPR compliance

When enabled, all the events caused by a user will be deleted upon the user's deletion. Defaults to `true`.

### Impersonation

Globally enable/disable impersonation. Defaults to `true`.

### Require reason for impersonation

Require administrators to provide a reason for impersonating a user. Defaults to `true`.

### Default token duration

Default duration for generated tokens. Defaults to `minutes=30`.

### Default token length

Default length of generated tokens. Defaults to 60.

---

## Tenancy

This feature is in alpha. Use at your own risk.

This feature is available from 2024.2 and is not to be confused with [brands](../customize/branding/index.mdx), which were previously called tenants.

## About tenants

Starting with version 2024.2, authentik allows an administrator or operator to create multiple tenants. This means that an operator can manage several different and distinct authentik installations, each with its own Install ID and license(s). The relationship between a tenant and its installation (Install ID) is 1:1. For each tenant, there is a unique Install ID.

Expression policies currently have access to all tenants.

The data for each tenant is stored in a separate PostgreSQL schema, providing full separation of user data. License data for the tenant is also stored in the schema.

Note that creating and managing multiple tenants is handled using authentik APIs, not in the Admin interface. For typical authentik installations in which only a single tenant is needed, the default tenant is automatically created by authentik, and does not need to be managed in the Admin interface.

### Licensing

For each additional tenant (beyond the default one), one or more licenses are required; a license key cannot be used for more than one tenant. Note that the license for the default tenant must be valid and up-to-date in order to create additional tenants.

A single tenant and its corresponding installation can have multiple license keys. For example, a company might purchase one license for 50 users, and then later in the same year need to buy another license for 50 more users, due to company growth. Both licenses are associated to the one installation, the one tenant.

Learn more in [Manage Enterprise licensing](../enterprise/manage-enterprise.mdx#license-management).

### Important considerations

- Upon creating another tenant, a new schema will be created by cloning the `template` schema. This special schema is like a tenant with no data created in it. Cloning an existing schema instead of creating a new one and running migrations on it is done for efficiency purposes.

- Files are isolated on a per-tenant basis, with each tenant folder named according to the schema\_name. For example, `/data/media/t_example`. The same is true regardless of the storage backend.

- Using an [embedded outpost](../add-secure-apps/outposts/embedded/embedded.mdx) with multi-tenancy is not currently supported. Disable the embedded outpost with `AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true` configuration setting.

## Usage

To create one or more additional tenants (beyond the default tenant) use the following instructions.

### 1. Configure authentik to allow multiple tenants

First, enable the multi-tenancy feature with the `AUTHENTIK_TENANTS__ENABLED=true` [configuration setting](../install-config/configuration/configuration.mdx).

Next, set `AUTHENTIK_TENANTS__API_KEY` to a random string. This string will be used to authenticate to the tenancy API. This key allows the creation of recovery keys for every tenant hosted by authentik, so be sure to *store it securely*. Be aware that creating a recovery key allows access to all data stored inside a tenant.

Be sure to disable the embedded outpost with `AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true` because it is not supported with tenants.

### 2. Create a new tenant with authentik API endpoints

Tenants are created using the API routes associated. Search for `tenant` in the [API browser](/api/reference/authentik) for the available endpoints.

When creating a tenant you must specify a `name`, used for display purposes, and a `schema_name`, used to create the PostgreSQL schema associated with the tenant.

The `schema_name` must start with `t_` and not be more than 64 characters long.

There is always at least one tenant, `public`. This is the default tenant and cannot be deleted. Despite its name, it is not freely available to the world. Instead, it is stored in the `public` schema of the PostgreSQL database.

### 3. Associate the new tenant with a domain

By default, all requests that do not explicitly belong to a tenant are redirected to the default tenant. Thus, after creating a tenant, you must associate a domain for which incoming requests will be redirected to said tenant.

You can do so with API endpoints. After creating a domain `example.org` that is associated to the tenant `t_example`, all requests made to `example.org` will use the `t_example` tenant. However, requests made to `authentik.tld`, `subdomain.example.org` and any other domain that is not associated with the `t_example` tenant will use the default tenant.

In summary, if you access a domain that is not explicitly associated with a specific tenant, it will be routed to the default tenant.

---

## User offboarding

User offboarding lets you schedule the deactivation or deletion of a user account for a future date and time. You can also revoke the user's sessions and tokens when the offboarding runs.

For example, you can schedule an offboarding as soon as you know an employee's last day instead of relying on an administrator to update the account that day.

## Choose an offboarding action

Each offboarding performs one of the following actions:

- **Deactivate**: Marks the user as inactive so that they can no longer log in. The user account and its data remain in authentik.
- **Delete**: Permanently deletes the user account.

You can apply either action with the following options:

- **Revoke sessions**: Ends the user's active sessions.
- **Revoke tokens**: Revokes the user's tokens and related credentials.

Both options are enabled by default. Leave them enabled to prevent existing sessions or credentials from retaining access after the offboarding runs.

## Schedule a user offboarding

You cannot schedule an offboarding for your own account or for an internal service account. Each user can have only one pending offboarding.

1. In the Admin interface, navigate to **Directory** > **Users**.
2. Select the user, and then click **Schedule Offboarding** in the **Actions** section.
3. Select **Deactivate** or **Delete** for the **Action**.
4. In **Scheduled for**, enter a future date and time.
5. Configure **Revoke sessions** and **Revoke tokens**.
6. Click **Schedule**.

The **Schedule Offboarding** button changes to **Cancel Offboarding**. You can also find the scheduled offboarding under **Events** > **Offboardings**.

## Monitor user offboardings

The **Events** > **Offboardings** page shows pending offboardings by default. Disable **Only show pending offboardings** to include available completed, failed, and canceled records.

| State         | Description                                                                                         |
| ------------- | --------------------------------------------------------------------------------------------------- |
| **Pending**   | The offboarding is waiting for its scheduled date and time.                                         |
| **Completed** | The offboarding completed successfully.                                                             |
| **Failed**    | The offboarding did not complete after five attempts. Changes from failed attempts are rolled back. |
| **Canceled**  | An administrator canceled the offboarding before it ran. The canceled record remains in the list.   |

authentik checks for due offboardings every five minutes. The action normally starts within five minutes after the scheduled time, but a task backlog can delay it further. If an attempt fails, authentik retries the complete offboarding action. After five failed attempts, the offboarding is marked **Failed** and is not retried again.

After an offboarding completes, authentik writes a **User Offboarded** event to the [events log](./events/index.mdx). The event identifies the administrator who scheduled the offboarding, the selected action, and whether session and token revocation were enabled.

A successful **Delete** action removes the offboarding record with the user account. The **User Offboarded** event remains in the audit log.

## Cancel a user offboarding

To cancel a pending offboarding, use either of these methods:

- On the user's details page, click **Cancel Offboarding**, review the scheduled action, and confirm the cancellation.
- On the **Events** > **Offboardings** page, select the offboarding, click **Cancel**, and confirm the cancellation.

Canceling changes the offboarding to **Canceled** and allows you to schedule another offboarding for the user. You cannot cancel an offboarding that targets your own account.

---

## I can't access an application

If your user is a superuser, or has the attribute `goauthentik.io/user/debug` set to true (can also be set on a group level):

![](./authentik_user_debug.png)

Afterwards, try to access the application again. You will now see a message explaining which policy denied you access:

![](./access_denied_message.png)

---

## Troubleshooting CSRF Errors

With some proxy setups, you might run into CSRF errors when attempting to create/save objects in authentik. This is usually caused by either the *Origin* or *Host* header being incorrect.

If authentik is running behind a reverse proxy, review the [Reverse proxy](../install-config/reverse-proxy.mdx) guide as well.

Open the system info API endpoint of your authentik instance by going to *[https://authentik.company/api/v3/admin/system/](https://authentik.company/api/v3/admin/system/)*. Take note of the value of *HTTP\_HOST*, make sure it matches the domain you're accessing authentik at, and make sure it does *not* include any port numbers.

When submitting a POST request by updating/creating an object, open the browser's developer tools and check the *Network* tab. Open the POST request and look at the request headers. Make sure the value of *Origin* matches your authentik domain, without any ports.

---

## Troubleshooting Email sending

Some hosting providers block outgoing SMTP ports, in which case you'll have to host an SMTP relay on a different port with a different provider.

To test if an email stage, or the global email settings are configured correctly, you can run the following command:

```shell
ak test_email <to address> [-S <stage name>]
```

If you omit the `-S` parameter, the email will be sent using the global settings. Otherwise, the settings of the specified stage will be used.

To run this command with Docker Compose, use

```shell
docker compose exec worker ak test_email [...]
```

To run this command with Kubernetes, use

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak test_email [...]
```

---

## Troubleshooting Forward auth

## Set the log level to `trace`

Setting the log level to trace configures the outpost to trace-log all the headers given in forward auth requests.

This is helpful to confirm that certain required Headers are correctly forwarded from the reverse proxy.

### When using the embedded outpost

When using the [embedded outpost](../add-secure-apps/outposts/embedded/embedded.mdx), the logs output identically to all other authentik logs. Refer to the [Capturing authentik logs](./logs/logs.mdx) documentation for instructions on how to enable `trace` logging.

### When using a standalone outpost

When using a standalone outpost, the logs output to that specific container. Refer to the [Capturing outpost logs](./logs/outpost_logs.mdx) documentation for instructions on how to enable `trace` logging.

## Ensure `/outpost.goauthentik.io` is accessible

Everything under `/outpost.goauthentik.io` should be publicly accessible, as URLs under this path are used for authentication.

To check this, run `curl -v https://app.company/outpost.goauthentik.io/ping`. A correct setup should return a `HTTP/2 204` status code.

---

## Errors when uploading icons

There are two common causes for icon and image upload problems when authentik uses local file storage.

First, verify that your deployment meets the [File storage requirements](../customize/files.mdx#storage-requirements).

## 1. Permissions problems

This section applies to Docker Compose and other deployments that use bind mounts, where host filesystem permissions determine whether authentik can write to the mounted data directory.

This issue is most likely caused by permissions. Docker creates bound volumes as root, but the authentik processes do not run as root.

This will cause issues with icon uploads (for Applications), background uploads (for Flows) and local backups.

For Docker Compose, run these commands in the directory of your Compose file:

```shell
sudo chown 1000:1000 data/
sudo chown 1000:1000 custom-templates/
sudo chmod ug+rwx data/
sudo chmod ug+rx certs/
```

Alternatively, If you are using Kubernetes, ensure that the volume mounted at `/data` is writable by the authentik container.

## 2. Legacy `/media` mounts after upgrading

If you upgraded from an older release and existing files still appear, but the upload controls are missing in **Customization** > **Files**, or you cannot upload new files, check your local storage mount path.

Current authentik versions expect local file storage at `/data`, with media files stored under `/data/media`. A legacy mount to `/media` will still allow older files to be read through compatibility handling, while preventing new uploads and file management.

Update your deployment to use the current storage layout.

Examples:

```yaml
# Docker Compose
volumes:
    - ./data:/data
    - ./custom-templates:/templates
```

For Kubernetes deployments, mount your persistent storage at `/data` instead of `/media`.

If you previously stored files under a path mounted to `/media`, move that data so it is available under `/data/media` inside the authentik container.

---

## Troubleshooting LDAP Synchronization

To troubleshoot LDAP sources, you can run the command below to run a synchronization in the foreground and see any errors or warnings that might happen directly

```shell
docker compose run --rm worker ldap_sync *slug of the source*
```

or, for Kubernetes, run

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak ldap_sync *slug of the source*
```

Starting with authentik 2023.10, you can also run the command below to explicitly check the connectivity to the configured LDAP Servers:

```shell
docker compose run --rm worker ldap_check_connection *slug of the source*
```

or, for Kubernetes, run

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak ldap_check_connection *slug of the source*
```

---

## I can't log in to authentik

In case you can't log in anymore, perhaps due to an incorrectly configured stage or a failed flow import, you can create a recovery key.

This recovery key will give whoever has the link direct access to your instances. Keep this key safe.

To create the key, run the following command:

```shell
docker compose run --rm server create_recovery_key 10 akadmin
```

For Kubernetes, run

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak create_recovery_key 10 akadmin
```

or, for CLI, run

```shell
uv run ak create_recovery_key 10 akadmin
```

This will output a link that can be used to instantly gain access to authentik as the user specified above. The link is valid for the amount of minutes specified above, in this case, 10 minutes.

## Can't access initial setup flow during installation steps

If you're unable to access the initial setup flow (`/if/flow/initial-setup/`) immediately after installing authentik, first try restarting the containers because this often resolves temporary issues.

However, if the issue persists after restarting, you can directly set the admin password using the following commands:

Docker Compose deployments:

```bash
docker compose exec server ak changepassword akadmin
```

Kubernetes deployments:

```bash
kubectl exec -it deployment/authentik-server -c server -- ak changepassword akadmin
```

After following the prompts to set a new password, you can then log in via: `https://authentik.company/if/flow/default-authentication-flow/?next=%2F`

After logging in, you can set the email address and other settings for the account by navigating to **Directory** > **Users** and editing the user account.

This method bypasses the initial setup flow and should only be used as a last resort. The initial setup flow is the recommended method to configure the administrator user.

---

## Missing admin group

If all of the Admin groups have been deleted, or misconfigured during sync, you can use the following command to gain access back.

Run the following command, where *username* is the user you want to add to the newly created group:

```shell
docker compose run --rm server ak create_admin_group username
```

or, for Kubernetes, run

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak create_admin_group username
```

---

## Missing Permissions system_exception events

This error can occur during initial setup, when authentik bootstraps the embedded Outpost, while the database migrations are not finished yet.

The error should be temporary and not occur after initial installation.

If it does, you can run the following command to ensure all permissions exist:

```shell
docker compose run --rm worker repair_permissions
```

or, for Kubernetes, run

```shell
kubectl exec -it deployment/authentik-worker -c worker -- ak repair_permissions
```

If the error persists after running this command, please open an Issue on [GitHub](https://github.com/goauthentik/authentik/issues/)

---

## Access requests

## About access requests

Access requests allow users to request access to an application when they need it, rather than requiring an administrator to provision access in advance.

Each request is evaluated against configured request rules and routed to one or more reviewers. When approved, access is granted for a defined period and expires automatically.

This supports just-in-time and least-privilege access models. Users retain minimal standing access and request elevated access only when necessary, while authentik records every request and decision for auditing.

Access requests provide:

- A self-service way for users to request access through the [user interface](../../users-sources/user/user-interface.mdx).
- Rule-based routing to the appropriate reviewers.
- Time-limited access grants that expire automatically, without manual cleanup.
- Audit events for request creation, approval, and denial.

## Terminology

| Term                 | Description                                                                                                                                                                                                                                                      |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Access request       | A request from a specific user for access to an application. A request can be pending, approved, or denied.                                                                                                                                                      |
| Request rule         | A configuration that determines which request flow is used, who reviews requests, and how reviewers are notified. If no request flow is set on the request rule, it falls back to the request flow value set on the [brand](../../customize/branding/index.mdx). |
| Request rule binding | A binding between a request rule and a requestable application. It also determines which users or groups can request access.                                                                                                                                     |
| Reviewer             | A user or group authorized to approve or deny an access request.                                                                                                                                                                                                 |
| Expiry               | The period for which access granted through an approved request remains valid.                                                                                                                                                                                   |

## Access request lifecycle

1. A user logs in to authentik, opens the **Discover** page, and selects a requestable application, optionally also choosing an application entitlement.
2. authentik creates the access request and evaluates it against the request rules bound to the selected application.
3. authentik runs the configured request flow, if any, to collect required information such as a justification.
4. The assigned reviewers are notified based on the request rule's configuration, and the request appears in their pending-request queue.
5. A reviewer approves or denies the request. Requesters cannot approve their own requests.
6. If approved, authentik grants access to the application and starts the expiry timer.
7. When the access period ends, authentik automatically revokes access.

## Request rules

Request rules determine whether a request flow is used, who reviews requests, and how reviewers are notified. Users, groups, and policies are bound to a request rule to determine who is authorized to review access requests.

Request rules are bound to an application, which makes the application requestable via the **Discover** page in the [user interface](../../users-sources/user/user-interface.mdx). Users, groups, and policies can be bound to request rule bindings to determine which users are eligible to request access to the application. If a request rule binding has no users, groups, or policies bound to it, every user is eligible to request access to the application, following the same convention as application access. Reviewer eligibility works differently: a request rule with no users, groups, or policies bound to it has no one who can approve requests against it.

## Request flows

Submitting a request executes a request flow. Use this to collect a justification, require re-authentication or MFA before elevation, or run policies against the requester.

Configure a **Request flow** on either:

- The request rule itself.
- As a default for the [brand](../../customize/branding/index.mdx). Used as a fallback when the request rule does not specify a request flow.

authentik includes a `default-request` flow that is empty. This flow can be configured with any required stages and policies. Any prompt data entered by a requester during a request flow is shown to the reviewer in the **Requester notes** field. Request flows can be left empty if you don't require user interaction.

## Configure access requests

### Create a request rule

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Applications** > **Request rules**.
3. Click **New Request Rule** and set the following fields:
   - **Rule Name**: The name for the rule.
   - **Minimum reviewers**: The minimum number of reviewers who must approve a request.
   - **Minimum reviewers is per-group** *(optional)*: When enabled, fulfilling the request requires at least that many reviewers from each of the reviewer groups bound to this rule. When disabled, the value is a total across all reviewer groups.
   - **Notify**: Select one of the following options to determine who is notified of new access requests:
     - **Everyone who can approve**
     - **Only individually-selected reviewers**
     - **A random subset (of size “minimum reviewers”) of everyone who can approve**
   - **Notification transports** *(optional)*: The [notification transports](../../sys-mgmt/events/transports.mdx) used to notify reviewers.
   - **Request flow** *(optional)*: The [request flow](#request-flows) presented to the user when requesting access.
4. Click **Create Request Rule**.

### Define users or groups to review access requests

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Applications** > **Request rules**.
3. Expand the request rule by clicking the chevron (**>**) next to its name.
4. Click **Create or bind...**.
5. Select the users, groups, or policies that will review access requests for that request rule.
   You can bind as many users, groups, and policies as necessary.

### Make an application requestable

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Applications** > **Applications** and click the application name that you want to make requestable.
3. Open the **Request rules** tab, click **Create or bind...**, then select **Bind existing rule**
   - **Rule**: The request rule that is used.
   - **Pending expiry**: How long a request against this binding stays pending before it automatically lapses if not approved or denied.
   - **Maximum granted expiry**: The maximum duration a grant approved against this binding can last. Requesters can ask for less, but never more.
   - **Additional entitlements** *(optional)*: Application entitlements granted alongside access to this object when a request is approved.
4. Click **Create Request Rule Binding**.

### Define users or groups that can request access to the application

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Applications** > **Applications** and click the application name that you want to make requestable.
3. Open the **Request rules** tab, and expand a request rule by clicking the chevron (**>**) next to its name.
4. Click **Create or bind...**.
5. Select the users, groups, or policies that can request access to the application via that request rule.
   You can bind as many users, groups, and policies as necessary.

### Verify the configuration

1. Log in as a test user who does not have access to the application.
2. Open the **Discover** page and confirm that the application is offered as requestable.
3. Click the application, submit an access request, and confirm that it appears in the reviewer's queue.
4. Approve it, confirm that access is granted, and that the corresponding events are recorded.

## Requester experience

### Requesting access

Users see requestable applications as cards on the **Discover** page of the [user interface](../../users-sources/user/user-interface.mdx) under the **Browse** tab. Selecting a card opens the request dialog and runs the configured request flow.

### View pending requests

Users can view their pending access requests under the **My Requests** tab on the **Discover** page.

## Reviewer experience

### Approving and denying access requests

Reviewers see pending requests on the **Discover** page of the [user interface](../../users-sources/user/user-interface.mdx) under the **For My Review** tab. The requester, the requested application, and the time since the request was made are listed.

Reviewers click the **Review** button and can approve or deny the request, and optionally add **Notes** before clicking the **Submit** button. Reviewers also see any prompt data that a requester entered in the request flow, in the **Requester notes** field.

### Admin interface

Administrators can view all access requests via the access requests page (**Applications** > **Access Requests**). Each row represents an access request and shows the request's: requester, creation date and time, requested application, and status. Each access request can be expanded by clicking its chevron (**>**) to show **Requester Data** and **Targets**. This is all the prompt data that the requester entered during the request flow, for example a justification for why the require access.

If the administrator account is set as a reviewer in the associated request rule, they can click **Fulfill** and approve or deny the access request.

## Events and auditing

Each stage of a request is recorded as an event and can be matched in event matcher policies:

- `access_request_created`
- `access_request_approved`
- `access_request_denied`
- `access_request_revoked`

Pair an event matcher policy with a notification rule to alert security teams of access events via Slack, email, or webhooks. See [Events](../../sys-mgmt/events/index.mdx) and [Notifications](../../sys-mgmt/events/notifications.mdx) for more information.

## Considerations and limitations

- A user cannot approve their own request.
- Approved access is time-bound; plan expiry durations so that they match how long the work actually takes.
- Request rules depend on policies. A misconfigured policy can leave requests with no eligible reviewer.

## Troubleshooting

| Symptom                                        | Cause and resolution                                                                                                 |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| An application does not appear as requestable. | The user is not bound to the request rule binding on the application.                                                |
| A request has no reviewers.                    | No rule is bound to the application, the bound policies did not pass, or the only matched reviewer is the requester. |
| A reviewer cannot action a request.            | The reviewer is the requester, or is not matched by the request rule's bindings.                                     |

---

## Applications

Applications, as defined in authentik, are used to configure and separate the authorization/access control and the appearance of a specific software application in the **Application Dashboard** page.

When a user logs into authentik, they see a list of the applications for which authentik is configured to provide authentication and authorization (the applications that they are authorized to use).

Applications are the "other half" of providers. They typically exist in a 1-to-1 relationship; each application needs a provider and every provider can be used with one application. Applications can, however, use specific, additional providers to augment the functionality of the main provider. For more information, see [Backchannel providers](./manage_apps.mdx#backchannel-providers).

Furthermore, the [RAC (Remote Access Control)](../providers/rac/index.mdx) feature uses a single application and a single provider, but multiple "endpoints". An endpoint defines each remote machine.

For information about creating and managing applications, refer to [Manage applications](./manage_apps.mdx).

## Appearance

Applications are displayed to users when:

- The user has access defined via policies (or the application has no policies bound)
- A valid Launch URL is configured/could be guessed, this consists of URLs starting with http\:// and https\://

The following options can be configured:

- *Name*: This is the name shown for the application card

- *Launch URL*: The URL that is opened when a user clicks on the application. When left empty, authentik tries to guess it based on the provider

  You can use placeholders in the launch URL to build them dynamically based on the logged-in user. For example, you can set the Launch URL to `https://goauthentik.io/%(username)s`, which will be replaced with the currently logged-in user's username.

  For a reference of all fields available, see [the API schema for the User object](https://api.goauthentik.io/reference/core-users-retrieve/).

  Only apps with launch URLs that begin with `http://` or `https://`, or that use relative paths, appear on the user's **Application Dashboard** page. To keep an app accessible but remove it from that page, use the **Hide from Application Dashboard** option (see [Hide applications](./manage_apps.mdx#hide-applications)).

- *Icon (URL)*: Optionally configure an icon for the application. You can select from files uploaded to the [Files](../../customize/files.mdx) library or enter an absolute URL.

- *Publisher*: Text shown in the application card's expandable kebab menu (⋮)

- *Description*: Text shown in the application card's expandable kebab menu (⋮)

---

## Manage applications

Managing the applications that your team uses involves several tasks, from initially adding the application and provider, to controlling access and visibility of the application, to providing access URLs.

### Create an application and provider pair

To add an application to authentik and have it display on users' **Application Dashboard** page, follow these steps:

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.

By default, if you click **New Application**, you are prompted to create the new application and a new provider. However, you can use the drop-down menu beside **New Application** to explicitly select either:

- **with New Provider...** to create the application and configure a new provider at the same time.
- **with Existing Provider...** if you have already created a provider separately, and now you want to create the application and connect it to the provider.

3. In the **New application** box, define the application details, the provider type and configuration settings, and bindings for the application.
   - **Application**: provide a name, an optional group for the type of application, the policy engine mode, and optional UI settings.

   - **Choose a Provider**: select the provider types for this application.

   - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and any additional required configurations.

   - **Configure Bindings**: optionally create a [binding](../bindings-overview/index.mdx) between the application and a policy, group, or user. Application bindings control whether users can view and access the application from their **Application Dashboard** page. If you do not define any bindings, all users have access to the application. For more information, see [policy-driven authorization](#policy-driven-authorization), [application entitlements](#application-entitlements), and [hiding an application](#hide-applications).

4. On the **Review and Submit Application** panel, review the configuration for the new application and its provider, and then click **Create Application**.

## Use bindings to control access

By default, all users can access applications when no bindings are defined on the application.

You can bind policies, groups, and users to grant access to an application. When nothing is bound, everyone has access. Use a policy when access depends on runtime context, such as time of day, geographic region, request data, or user attributes.

When multiple policies, groups, or users are attached, use **Policy engine mode** to configure how authentik evaluates the binding results:

- `All`: the user must pass every binding.
- `Any`: the user must pass at least one binding.

The most common ways to control access to an application by using bindings are:

1. [Create a policy binding](../../customize/policies/working_with_policies.mdx#bind-a-policy-to-an-application) that determines whether a user can access an application.
2. [Bind a user or group to the application](#bind-a-user-or-group-to-an-application).

### Policy-driven authorization

To use a [policy](../../customize/policies/index.mdx) to control which users or groups can access an application, click an application in the applications list, open the **Policy / Group / User Bindings** tab, and click **Create or bind...**. You can then create a new policy and bind it to the application, or select **Bind an existing policy** under **Bind Existing...**.

### Bind a user or group to an application

You can bind a user or group to an application either when you create a new application and provider or later, after the application is created.

#### When creating an application and provider

Follow the instructions for [creating a new application and provider](#create-an-application-and-provider-pair). On the **Configure Bindings** step, click **Bind existing policy/group/user**. Select **Group** or **User**, choose the group or user to bind to the application, configure any additional binding settings, and then click **Save Binding**.

#### Add binding to an existing application

To bind a user or group to an existing application, click the application in the applications list, open the **Policy / Group / User Bindings** tab, and click **Create or bind...**. Under **Bind Existing...**, select **Bind a user** or **Bind a group**, choose the user or group to bind to the application, configure any additional binding settings, and then click **Create**.

## Application entitlements

2024.12

Application entitlements can be used through authentik to manage authorization *within an application* (what areas of the app users or groups can access). Entitlements are scoped to a single application and can be bound to multiple users and/or groups (binding policies is not currently supported), giving them access to the entitlement. An application can either check for the name of the entitlement (via the `entitlements` scope), or via attributes stored in entitlements.

An authentik admin can create an entitlement [in the Admin interface](#create-an-application-entitlement) or using the [authentik API](/api).

Because entitlements exist within an application, names of entitlements must be unique within an application. This also means that entitlements are deleted when an application is deleted.

### Use entitlements

Entitlements to which a user has access can be retrieved using the `user.app_entitlements()` function in property mappings/policies. This function needs to be passed the specific application for which to get the entitlements. For example:

```python
entitlements = [entitlement.name for entitlement in request.user.app_entitlements(provider.application)]
return {
    "entitlements": entitlements,
}
```

### Attributes

Each entitlement can store attributes similar to user and group attributes. These attributes can be accessed in property mappings and passed to applications via `user.app_entitlements_attributes`. For example:

```python
attrs = request.user.app_entitlements_attributes(provider.application)
return {
    "my_attr": attrs.get("my_attr")
}
```

### Create an application entitlement

1. Open the Admin interface and navigate to **Applications > Applications**.
2. Click the name of the application for which you want to create an entitlement.
3. Click the **Application entitlements** tab at the top of the page, and then click **New Entitlement**. Provide a name for the entitlement, enter any optional **Attributes**, and then click **Create**.
4. In the list, locate the entitlement to which you want to bind a user or group, and then click the caret (>) to expand the entitlement details.
5. In the expanded area, click **Bind existing group/user**.
6. In the binding modal, select **Group** or **User**, and then select the group or user.
7. Optionally, configure additional settings for the binding, and then click **Create** to create the binding and close the box.

## Hide applications

To hide an application without modifying its policy settings or removing it, you can use the **Hide from Application Dashboard** option on the application. The application will no longer appear on the **Application Dashboard** page.

Keep in mind that users still have access, so they can still authorize access when the login process is started from the application.

Before authentik 2026.5, an application was hidden by setting its **Launch URL** to `blank://blank`. Existing applications using that value are automatically migrated to using the **Hide from Application Dashboard** option upon upgrading.

## Launch URLs

To give users direct links to applications, you can now use a URL like `https://authentik.company/application/launch/<slug>/`. If the user is already logged in, they will be redirected to the application automatically. Otherwise, they'll be sent to the authentication flow and, if successful, forwarded to the application.

## Backchannel providers

Backchannel providers can augment the functionality of applications by using additional protocols. The main provider of an application provides the SSO protocol that is used for logging into the application. Then, additional backchannel providers can be used for protocols such as [SCIM](../providers/scim/index.mdx) and [LDAP](../providers/ldap/index.mdx) to provide directory syncing.

Note that any access restrictions that are configured on an application apply to all of its backchannel providers.

To create a backchannel provider and then add it to an existing application, follow these instructions:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **Create**.

- **Choose a Provider Type**: The protocol for a backchannel provider must be [SCIM](../providers/scim/index.mdx), [LDAP](../providers/ldap/index.mdx), [Google Workspace (GWS)](../providers/gws/index.mdx), [Microsoft Entra ID](../providers/entra/index.mdx), or [Shared Signals Framework (SSF)](../providers/ssf/index.mdx).
- **Configure the Provider**: Enter any required configurations.

3. Click **Finish** to save the provider.
4. Edit the application by going to **Applications** > **Applications**, and clicking the edit icon beside the application that you want to edit.
5. In the **Backchannel Providers** field, click the Add icon (**+**), select the backchannel provider that you just created, and click **Add**.
6. Click **Update**.

---

## Bindings in authentik

A binding connects one authentik object to another object that uses it. Bindings let authentik answer two common questions:

- Where should authentik evaluate this [policy](../../customize/policies/index.mdx), user, or group?
- Where should authentik insert this [stage](../flows-stages/stages/index.mdx) into a flow?

A policy answers "should this request pass?" A policy binding decides where authentik asks that question.

For a step-by-step guide, see [Work with bindings](./work-with-bindings.mdx).

## Binding types

The two most common binding types are policy bindings and flow-stage bindings.

- **Policy Bindings** attach a policy, user, or group to a target that supports policy binding.
- **Flow-stage bindings** attach a stage to a flow and define where that stage runs.

Use a policy binding when you want to control whether a target is allowed, denied, or shown. Use a flow-stage binding when you want to place a stage into a flow and decide when it should run.

## Where bindings are used

The policy binding system is shared by several authentik objects. You can bind policies, users, and groups to these targets:

| Target                  | What the binding controls                                |
| ----------------------- | -------------------------------------------------------- |
| Flow                    | Whether the user can start or continue using the flow.   |
| Flow-stage binding      | Whether a specific stage applies to a user in that flow. |
| Application             | Whether the user can view and access the application.    |
| Application entitlement | Whether the user has access to an entitlement.           |
| Source                  | Whether the source can be used for login or enrollment.  |
| Device                  | Whether the device passes the configured access checks.  |
| Device access group     | Whether the device is part of the access group.          |
| Notification rule       | Whether the notification rule applies.                   |
| RAC endpoint            | Whether the user can access the Remote Access endpoint.  |

Stages themselves are not policy binding targets. A stage is attached to a flow through a flow-stage binding, so when you bind a policy to a stage in a flow, you are binding it to that flow-stage binding.

Because of this, the same stage can be reused in multiple flows, and each flow can apply different policies, users, groups, order, and evaluation settings to that stage.

## Relationships

```mermaid

flowchart TD
    subgraph Directory
        user[User]
        group[Group]
    end

    subgraph Policy
        policy[Policy]
        policy_binding[Policy binding]
    end

    subgraph Application
        application[Application]
        application_entitlement[Application entitlement]
    end
    subgraph Sources
        source[Source]
    end
    subgraph Endpoint devices
        device[Device]
        device_access_group[Device access group]
    end
    subgraph Events
        notification_rule[Notification rule]
    end
    subgraph RAC provider
        endpoint[Endpoint]
    end
    subgraph Flows
        flow[Flow]
        flow_stage_binding[Flow-stage binding]
        stage[Stage]
    end

    policy --> policy_binding
    user --> policy_binding
    group --> policy_binding

    policy_binding --> application
    policy_binding --> application_entitlement
    policy_binding --> source
    policy_binding --> device
    policy_binding --> device_access_group
    policy_binding --> notification_rule
    policy_binding --> flow
    policy_binding --> endpoint

    flow_stage_binding --> stage
    flow --> flow_stage_binding

    policy_binding --> flow_stage_binding
```

## Policy bindings

A policy binding attaches one policy, user, or group to a target:

- A policy object can evaluate runtime data, request context, source data, user attributes, and other conditions.
- A user binding passes when the current user matches that user.
- A group binding passes when the current user is a member of that group.

User and group bindings are useful when you want a direct allow or deny rule without creating a separate policy object.

Policy bindings are commonly used with applications, sources, flows, flow-stage bindings, and [application entitlements](../applications/manage_apps.mdx#application-entitlements). For example, you can bind a group directly to an application so that only members of that group can view and launch the application.

Bindings are evaluated according to the target's **Policy engine mode**:

- `Any`: the target passes when any binding passes.
- `All`: the target passes only when every binding passes.

authentik evaluates enabled bindings in ascending order. This order is most noticeable when you read logs or combine multiple policies that return messages.

Bindings also support these options:

- **Negate**, which flips the pass or fail result of the binding.
- **Timeout**, which limits how long authentik waits for policy execution.
- **Failure Result**, which controls whether a policy error is treated as pass or fail.

Policy bindings attached directly to a flow are evaluated before the flow starts. In authentication and enrollment flows, that usually means that user- and group-based checks on the flow itself cannot pass until the user has already been identified elsewhere.

If a target has no applicable bindings, authentik treats the result as passing.

## Flow-stage bindings

A flow-stage binding attaches a stage to a flow and defines the order in which that stage runs. Flow-stage bindings are also called stage bindings.

authentik uses flow-stage bindings while building the [flow plan](../flows-stages/flow/planner.mdx). The flow plan determines which stages a user sees and in what order.

This matters because stages are reusable objects. The same stage can appear in multiple flows, but each flow-stage binding can have its own settings. When you bind a policy to a stage in a specific flow, you bind it to that flow-stage binding, not to the reusable stage definition itself.

### Stage-binding policy evaluation

Flow-stage bindings have two policy evaluation options:

- **Evaluate when flow is planned**: authentik evaluates policies while building the flow plan.
- **Evaluate when stage is run**: authentik evaluates policies immediately before presenting the stage.

At least one of these options must be enabled, and both can be enabled at the same time. For the full behavior and guidance on choosing the right setting, see [Flow Planner](../flows-stages/flow/planner.mdx#planning-and-stage-policies).

## What to remember

- Stages are attached to flows through flow-stage bindings.
- Policies, users, and groups can all be bound through the same policy binding system.
- The same stage can behave differently in different flows because each flow-stage binding has its own settings and bindings.
- A policy bound directly to a flow is evaluated earlier than a policy bound to a flow-stage binding.

## Common examples

### Restrict an application

By default, applications are accessible to all users. Bind a group or policy to an application when you want to limit access to specific users.

### Run a stage only for some users

Bind a policy, user, or group to the flow-stage binding when a stage should appear only for certain users in that flow. For example, require an MFA stage only for specific users.

### Scope access inside an application

Use [application entitlements](../applications/manage_apps.mdx#application-entitlements) when you need to control access to parts of an application after the user already has access to the application. For example, control which users have access to administrator functions within an application.

---

## Work with bindings

Bindings are configured from the object that uses them. The exact page depends on what you want the binding to control.

For the concepts behind each binding type, see [Bindings in authentik](./index.mdx).

## Choose the right task

| Task                                 | Start here                                                                                                                                                               | Use when                                                            |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------- |
| Add a stage to a flow                | [Bind a stage to a flow](../flows-stages/stages/index.mdx#bind-a-stage-to-a-flow)                                                                                        | You want a flow to include a stage.                                 |
| Control whether a stage runs         | [Bind users and groups to a flow's stage binding](../flows-stages/stages/index.mdx#bind-users-and-groups-to-a-flows-stage-binding)                                       | You want a stage to run only for specific users or groups.          |
| Attach a policy to a target          | [Bind a policy to a flow, stage binding, application, or source](../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-flow-stage-application-or-source) | You want a policy to decide whether a target passes.                |
| Control application access           | [Use bindings to control access](../applications/manage_apps.mdx#use-bindings-to-control-access)                                                                         | You want to limit who can view and launch an application.           |
| Control access inside an application | [Create an application entitlement](../applications/manage_apps.mdx#create-an-application-entitlement)                                                                   | You want to grant access to a feature, role, or area inside an app. |

## General workflow

Most policy, group, and user bindings follow this pattern:

1. Log in to authentik as an administrator and open the Admin interface.
2. Open the object that should use the binding, such as an application, source, flow, or flow-stage binding.
3. Open the **Policy / Group / User Bindings** tab or expand the binding details for the object.
4. Click **Create or bind...**.
5. Create a new policy or bind an existing policy, group, or user.
6. Configure the binding options, and then click **Create**.

Flow-stage bindings use the **Stage Bindings** tab on a flow. From that tab, you can bind an existing stage or create a new stage and bind it to the flow.

## Important behavior

- If an application has no bindings, all users can access it.
- If another policy binding target has no applicable bindings, authentik treats the result as passing.
- User and group bindings require authentik to know the current user. In authentication and enrollment flows, bind user- or group-based checks to a flow-stage binding after the user is identified.
- If a stage decision depends on data collected during the flow, enable **Evaluate when stage is run** on the flow-stage binding. For more information, see [Planning and stage policies](../flows-stages/flow/planner.mdx#planning-and-stage-policies).

---

## Outposts

An outpost is a single deployment of an authentik component, essentially a service, that can be deployed anywhere that allows for a connection to the authentik API.

An outpost is required if you use any of the following types of providers with your application:

- [LDAP Provider](../providers/ldap/index.mdx)
- [Proxy Provider](../providers/proxy/index.mdx)
- [RADIUS Provider](../providers/radius/index.mdx)
- [RAC Provider](../providers/rac/index.mdx)

These types of providers use an outpost for increased flexibility and speed. Instead of the provider logic being implemented in authentik Core, these providers use an outpost to handle the logic, which provides improved performance.

An additional advantage of using an outpost is that outposts, like authentik itself, do not require access to the wider internet. Transactions between the application, the provider, and the outpost occur via the authentik API, and support single sign-on operations in firewalled or airgapped deployments and offline connections to remote machines that are not on the internet.

An outpost is given permissions to access the authentik API using a service account and token, both of which are auto-generated when you create a new outpost. The outpost is granted rights to only the application/provider pairs configured (and other necessary related objects such as certificates).

Any change made to the outpost's associated app or provider immediately triggers an event to update the configuration data stored on the outpost, via websockets. Websockets are used also by the outpost to send healthchecks to the authentik Core.

## Create and configure an outpost

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Outposts** and then click **Create**.

![](./outpost-create.png)

3. Set the following values:
   - **Name**: define a name for the outpost.
   - **Type**: select the outpost type (Proxy, LDAP, Radius, RAC).
   - **Integration**: select either Docker or Kubernetes, or optionally select `----` and [manually deploy the outpost](#outpost-integrations).
   - **Applications**: select the applications that you want the outpost to serve.
   - **Advanced settings (optional)**: for further optional configuration settings, refer to [Configuration](#configuration) below.

4. Click **Create**.

Upon creation, a service account and a token is generated. The service account only has permissions to read the outpost and provider configuration. This token is used by the outpost to connect to authentik.

## Outpost integrations

authentik can manage the deployment, updating, and general lifecycle of an outpost. To communicate with the underlying platforms on which the outpost is deployed, authentik has several built-in integrations.

- If you've deployed authentik on Docker Compose, authentik automatically creates an integration for the local docker socket (See [Docker](./integrations/docker.mdx)).
- If you've deployed authentik on Kubernetes, with `kubernetesIntegration` set to true (default), authentik automatically creates an integration for the local Kubernetes Cluster (see [Kubernetes](./integrations/kubernetes.mdx)).

To deploy an outpost with these integrations, select them during the creation of an outpost. A background task is started, which creates the container/deployment. The outpost deployment can be monitored from the **Dashboards > System Tasks** page in the Admin interface.

To deploy an outpost manually, see:

- [Kubernetes](./manual-deploy-kubernetes.mdx)
- [Docker Compose](./manual-deploy-docker-compose.mdx)

## Configuration

Outposts fetch their configuration from authentik. Below are all the options you can set, and how they influence the outpost.

```yaml
# Log level that the outpost will set
# Allowed levels: trace, debug, info, warning, error
# Applies to: non-embedded
log_level: debug
# Interval at which the outpost will refresh the providers
# from authentik. For caching outposts (such as LDAP), the
# cache will also be invalidated at that interval.
# (Format: hours=1;minutes=2;seconds=3).
refresh_interval: minutes=5
########################################
# The settings below are only relevant when using a managed outpost
########################################
# URL that the outpost uses to connect back to authentik
authentik_host: https://authentik.tld/
# Disable SSL Validation for the authentik connection
authentik_host_insecure: false
# Optionally specify a different URL used for user-facing interactions
# Applies to: proxy outposts
authentik_host_browser:
# Template used for objects created (deployments/containers, services, secrets, etc)
object_naming_template: ak-outpost-%(name)s
# Use a specific docker image for this outpost rather than the default. This also applies to Kubernetes
# outposts.
# Applies to: non-embedded
container_image:
########################################
# Docker outpost specific settings
########################################
# Network the outpost container should be connected to
# Applies to: non-embedded
docker_network: null
# Optionally disable mapping of ports to outpost container, may be useful when using docker networks
# (Available with 2021.9.4+)
# Applies to: non-embedded
docker_map_ports: true
# Optionally additional labels for docker containers
# (Available with 2022.1.2)
# Applies to: non-embedded
docker_labels: null
########################################
# Kubernetes outpost specific settings
########################################
# Replica count for the deployment of the outpost
# Applies to: non-embedded
kubernetes_replicas: 1
# Namespace to deploy in, defaults to the same namespace authentik is deployed in (if available)
kubernetes_namespace: authentik
# Any additional annotations to add to the ingress object, for example cert-manager
kubernetes_ingress_annotations: {}
# Name of the secret that is used for TLS connections, leave empty to disable TLS
kubernetes_ingress_secret_name: authentik-outpost-tls
# pathType to use on routes. Defaults to `Prefix`. Some ingress-nginx deployments need this to be set to `ImplementationSpecific`.
# Service kind created, can be set to LoadBalancer for LDAP outposts for example
kubernetes_service_type: ClusterIP
# Disable any components of the kubernetes integration, can be any of
# - 'secret'
# - 'deployment'
# - 'service'
# - 'prometheus servicemonitor'
# - 'ingress'
# - 'traefik middleware'
kubernetes_disabled_components: []
# If the above docker image is in a private repository, use these secrets to pull.
# NOTE: The secret must be created manually in the namespace first.
# Applies to: non-embedded
kubernetes_image_pull_secrets: []
# Optionally configure an ingress class name. If not set, the ingress will use the cluster's
# default ingress class
# (Available with 2022.11.0+)
# Applies to: proxy outposts
kubernetes_ingress_class_name: null
# Optionally apply an RFC 6902 compliant patch to the Kubernetes objects.
# For an understanding of how this works, refer to the link below:
# https://github.com/kubernetes-sigs/kustomize/blob/master/examples/jsonpatch.md
#
# This value expects a mapping where the key represents
# the Kubernetes component that shall be patched.
# It can be any of the same values supported by `kubernetes_disabled_components`.
#
# For example use this patch to add custom resource requests and limits
# to the outpost deployment:
#
# deployment:
#   - op: add
#     path: "/spec/template/spec/containers/0/resources"
#     value:
#       requests:
#         cpu: 2000m
#         memory: 2000Mi
#       limits:
#         cpu: 4000m
#         memory: 8000Mi
kubernetes_json_patches: null
# Disable strict x509 validation for Kubernetes API server.
#
# On some older Kubernetes clusters, the root certificate may have been
# generated without certain x509 extensions. `urllib3`, which is used in
# the official kubernetes client, introduced stricter validation for
# certificates in version 2.4.0 which will cause `certificate verify failed`
# errors to appear in outpost logs. This option disables the stricter
# validation and allows the outpost to connect to the Kubernetes API server
# even with older certificates.
#
# It is recommended to only enable this option if you are experiencing
# certificate validation issues and understand the security implications
# of disabling strict x509 validation.
kubernetes_disable_x509_strict: false
```

## Prometheus Metrics

Each authentik outpost has a Prometheus metrics endpoint accessible under port `:9300/metrics`. This endpoint is not mapped via Docker, as the endpoint doesn't have any authentication.

For the embedded outpost, the metrics of the outpost and the metrics of the core authentik server are both returned under the same endpoint.

---

## Manual Outpost deployment in Docker Compose

To deploy an outpost with Docker Compose, use the appropriate snippet from the options below and add it to your Compose file. The `${AUTHENTIK_TAG}` variable must be declared in your `.env` file and match the tag used by both the server and worker.

You can also run the outpost in a separate Compose project, you just have to ensure that the outpost container can reach your application container.

### Proxy outpost

```yaml
services:
    authentik_proxy:
        image: ghcr.io/goauthentik/proxy:${AUTHENTIK_TAG}
        # Optionally specify the container's network, which must be able to reach the core authentik server.
        # networks:
        #   - foo
        ports:
            - 9000:9000
            - 9443:9443
        environment:
            AUTHENTIK_HOST: https://authentik.company
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
            # Optional setting to be used when `authentik_host` for internal communication doesn't match the public URL.
            # AUTHENTIK_HOST_BROWSER: https://external-domain.tld
```

### LDAP outpost

```yaml
services:
    authentik_ldap:
        image: ghcr.io/goauthentik/ldap:${AUTHENTIK_TAG}
        # Optionally specify the container's network, which must be able to reach the core authentik server.
        # networks:
        #   - foo
        ports:
            - 389:3389
            - 636:6636
        environment:
            AUTHENTIK_HOST: https://authentik.company
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
```

### RAC outpost

```yaml
services:
    rac_outpost:
        image: ghcr.io/goauthentik/rac:${AUTHENTIK_TAG}
        # Optionally specify the container's network, which must be able to reach the core authentik server.
        # networks:
        #   - foo
        environment:
            AUTHENTIK_HOST: https://authentik.company
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
```

### RADIUS outpost

```yaml
services:
    radius_outpost:
        image: ghcr.io/goauthentik/radius:${AUTHENTIK_TAG}
        # Optionally specify the container's network, which must be able to reach the core authentik server.
        # networks:
        #   - foo
        ports:
            - 1812:1812/udp
        environment:
            AUTHENTIK_HOST: https://authentik.company
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
```

---

## Manual Outpost deployment on Kubernetes

Use the following manifest, replacing all values surrounded with `__`.

Afterwards, configure the proxy provider to connect to `<service name>.<namespace>.svc.cluster.local`, and update your Ingress to connect to the `authentik-outpost` service.

```yaml
apiVersion: v1
kind: Secret
metadata:
    labels:
        app.kubernetes.io/instance: __OUTPOST_NAME__
        app.kubernetes.io/name: authentik-outpost
    name: authentik-outpost-api
type: Opaque
stringData:
    AUTHENTIK_HOST: "__AUTHENTIK_URL__"
    AUTHENTIK_INSECURE: "true"
    AUTHENTIK_TOKEN: "__AUTHENTIK_TOKEN__"
---
apiVersion: v1
kind: Service
metadata:
    labels:
        app.kubernetes.io/instance: __OUTPOST_NAME__
        app.kubernetes.io/name: authentik-outpost
    name: authentik-outpost
spec:
    ports:
        - name: http
          port: 9000
          protocol: TCP
          targetPort: http
        - name: https
          port: 9443
          protocol: TCP
          targetPort: https
    type: ClusterIP
    selector:
        app.kubernetes.io/instance: __OUTPOST_NAME__
        app.kubernetes.io/name: authentik-outpost
---
apiVersion: apps/v1
kind: Deployment
metadata:
    labels:
        app.kubernetes.io/instance: __OUTPOST_NAME__
        app.kubernetes.io/name: authentik-outpost
    name: authentik-outpost
spec:
    selector:
        matchLabels:
            app.kubernetes.io/instance: __OUTPOST_NAME__
            app.kubernetes.io/name: authentik-outpost
    template:
        metadata:
            labels:
                app.kubernetes.io/instance: __OUTPOST_NAME__
                app.kubernetes.io/name: authentik-outpost
        spec:
            containers:
                - image: ghcr.io/goauthentik/proxy
                  name: proxy
                  ports:
                      - containerPort: 9000
                        name: http
                        protocol: TCP
                      - containerPort: 9443
                        name: https
                        protocol: TCP
                  envFrom:
                      - secretRef:
                            name: authentik-outpost-api
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
    annotations:
        # This example includes annotations for common ingress controllers,
        # remove annotations not used
        nginx.ingress.kubernetes.io/affinity: cookie
        nginx.ingress.kubernetes.io/proxy-buffer-size: 16k
        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: 32k,
        nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
        traefik.ingress.kubernetes.io/affinity: "true"
    labels:
        app.kubernetes.io/instance: __OUTPOST_NAME__
        app.kubernetes.io/name: authentik-outpost
    name: authentik-outpost
spec:
    ingressClassName: nginx
    rules:
        - host: __EXTERNAL_HOSTNAME__
          http:
              paths:
                  - path: /
                    pathType: Prefix
                    backend:
                        service:
                            name: authentik-outpost
                            port:
                                name: http
```

---

## Upgrading an Outpost

Outposts deployed using the [Docker](./integrations/docker.mdx) or [Kubernetes](./integrations/kubernetes.mdx) integrations are managed by authentik and are upgraded automatically. Outposts deployed manually via [Docker](./manual-deploy-docker-compose.mdx) or [Kubernetes](./manual-deploy-kubernetes.mdx) must be upgraded by updating the outpost's image tag to the new version.

To check if any outposts are out-of-date, navigate to **Applications** > **Outposts** and look for a message in the **Health and Version** column.

A red warning message will be shown on any outposts running outdated versions:

![](./outpost-upgrade.png)

An up-to-date outpost will show a green message indicating the last successful connection with authentik:

![](./outpost-upgrade2.png)

---

## Providers

A provider is an authentication method, a service that is used by authentik to authenticate the user for the associated application. Common providers are OpenID Connect (OIDC)/OAuth2, LDAP, SAML, a generic proxy provider, and others.

Providers are the "other half" of [applications](../applications/index.mdx). They typically exist in a 1-to-1 relationship; each application needs a provider and every provider can be used with one application.

You can create a new provider in the Admin interface, or you can use the [**New Application** option](../applications/manage_apps.mdx#create-an-application-and-provider-pair) to create a new application and its provider at the same time.

Applications can use additional providers to augment the functionality of the main provider. For more information, see [Backchannel providers](../applications/manage_apps.mdx#backchannel-providers).

When you create certain types of providers, you need to select specific [flows](../flows-stages/flow/index.mdx) to apply to users who access authentik via the provider. To learn more, refer to our [default flow documentation](../flows-stages/flow/default-flows.mdx).

You can also create a SAML provider by uploading an SP metadata XML file that contains the service provider's configuration data. SAML metadata is used to share configuration information between the Identity Provider (IdP) and the Service Provider (SP). An SP metadata XML file typically contains the SP certificate, the entity ID, the Assertion Consumer Service URL (ACS URL), and a logout URL (SingleLogoutService).

To learn more about each provider type, refer to the documentation for each provider:

---

## Glossary

This glossary provides definitions for common terms used throughout the authentik documentation.

---

## Export configurations to blueprints

## Global export

To migrate existing configurations to blueprints, run `ak export_blueprint` within any authentik Worker container. This will output a blueprint for most currently created objects. Some objects will not be exported as they might have dependencies on other things.

Exported blueprints don't use any of the YAML tags; they just contain a list of entries as they are in the database.

Note that fields which are write-only (for example, OAuth Provider's Secret Key) will not be added to the blueprint, as the serialization logic from the API is used for blueprints.

Additionally, default values will be skipped and not added to the blueprint.

## Flow exports

A specific flow with its attached stages, policies, and other objects can be exported.

This export can be triggered via the API or the Admin interface by clicking the **Export** button (download icon) next to the flow in the flow list.

## Clean up

Exports from either method will contain a (potentially) long list of objects, all with hardcoded primary keys and no ability for templating/instantiation. This is because currently, authentik does not check which primary keys are used where. It is assumed that for most exports, there'll be some manual changes done regardless, to filter out unwanted objects, adjust properties, etc.

---

## Blueprints

Blueprints provide a way to template, automate, and distribute authentik configuration. Blueprints can be used to automatically configure instances, manage infrastructure-as-code without any external tools, and to distribute application configurations. Blueprints are YAML files, whose format is described further in [File structure](./v1/structure).

Blueprints are used to manage authentik's default flows and other system objects. authentik's `default-authentication-flow` is, under the covers, created by a blueprint.

Custom blueprints can be used to replace or modify default blueprints. You can create a new flow that's based on the `default-authentication-flow` but adds an additional stage or policy.

## Apply blueprints

To *apply* a blueprint means that the content in the blueprint file is instantiated and then implemented by authentik. Blueprints can be applied in one of two ways:

- as a *blueprint instance* (a new instance of any authentik configuration, which you can then further customize)
- as an *imported flow* (to add a new flow, or to revert to the default, out-of-box flow)

To learn how to apply, create, modify, and manage blueprints, refer to [Working with blueprints](./working_with_blueprints.mdx).

### Blueprint instances

A Blueprint *instance* is an instantiation of a blueprint. Each instance refers to a YAML file that's either mounted into the authentik (worker) container, in an OCI registry, or the local database. (See [Blueprint storage](#blueprint-storage) for more information.)

Multiple instances can be created from a single blueprint file. A blueprint instance populates settings in the blueprint file marked with the [`!Context` tag](../../customize/blueprints/v1/tags/#context) from the instance's context object. To create a new instance using the Admin UI, select **Blueprints > New Blueprint**, give the new instance a unique name, choose the blueprint file, and supply your customizations in the *Context* section. Context objects must parse as JSON or YAML.

authentik watches for file modification/creation events in the blueprint directory. When a new blueprint file is created, authentik will automatically trigger a *discovery*. A successful discovery will automatically create and apply a new blueprint instance. When a blueprint file is modified, authentik will trigger an *apply* if an instance using this file exists.

authentik also scans the blueprint directory on an interval and compares each blueprint file to the copy in its database. Files that are new or modified will be discovered and applied. The default interval is 60 minutes. The interval can be changed in **System Tasks > Schedules** under `authentik.blueprints.v1.tasks.blueprints_discovery`.

To prevent authentik from creating a blueprint instance automatically from a blueprint file, add or edit the YAML `metadata/labels` block and disable automatic instantiation:

```
metadata:
  labels:
    blueprints.goauthentik.io/instantiate: "false"
```

### Imported flow

You can apply an example flow by selecting **Import** on either the **Flows** page or the **Blueprints** page. Then, on the **Import Flow Blueprint** modal, select **Local path** to choose one of the example blueprints bundled with authentik, or select **File upload** to import a downloaded or exported `.yaml` file from your local file system. After applying the flow, you can decide if you want to further customize the flow, or just use it as it is.

This YAML file is validated and applied directly after having been uploaded or selected from an available local path. The file is not monitored afterward or automatically applied on startup like blueprint instances.

Be aware that if you [modify and save](../../add-secure-apps/flows-stages/flow/#flow-configuration-options) an existing default flow, what you get is a merged version of the two: the *original flow* (which is based on the blueprint) *plus any changes you made to the flow*. If you want to revert any modifications that you made to the default flow and get a fresh start with the original default flow, you have to *first* delete the modified flow, and *then* [apply the flow's blueprint](./working_with_blueprints.mdx#import-and-apply-a-blueprint) again.

Flow imports are blueprint files, which may contain objects other than flows (such as policies, users, groups, etc).

You should only import files from trusted sources and review blueprints before importing them.

## Blueprint execution

When a blueprint is applied, all entries are processed within a single **atomic database transaction**. This means:

- If any entry fails validation or encounters an error, the **entire blueprint is rolled back**
- No partial changes are committed - it's all-or-nothing
- This ensures database consistency and prevents incomplete configurations

Additionally, all blueprints have access to built-in context variables:

- `goauthentik.io/enterprise/licensed`: boolean indicating if an enterprise license is active
- `goauthentik.io/rbac/models`: dictionary of available RBAC models

When you create or edit a blueprint instance, these context variables can be accessed using the `!Context` tag in the YAML file (or in the UI under **Advanced settings** on the Create/Edit page).

**Example**:

```yaml
conditions:
    - !Context goauthentik.io/enterprise/licensed
```

## Blueprint storage

When you add a new blueprint instance you can define from where the `.yaml` file is accessed and read by authentik: as a local file, in an OCI registry, or internally in authentik's database.

### As a local file

The authentik container by default looks for blueprints in `/blueprints`. Underneath this directory, there are a couple of default subdirectories:

- `/blueprints/default`: default blueprints for default flows, tenants, etc
- `/blueprints/example`: example blueprints for common configurations and flows
- `/blueprints/system`: system blueprints for authentik managed Property mappings, etc

Any additional `.yaml` file in `/blueprints` will be discovered and automatically instantiated, depending on their labels.

To disable existing blueprints, an empty file can be mounted over the existing blueprint.

File-based blueprints are automatically removed when they become unavailable. However, none of the objects created by those blueprints are affected.

Please note that, by default, blueprint discovery and evaluation is not guaranteed to follow any specific order.

If you have dependencies between blueprints, you should use [meta models](./v1/meta#authentik_blueprintsmetaapplyblueprint) to make sure that objects are created in the correct order.

### In an OCI registry

Blueprints can also be stored in remote [OCI](https://opencontainers.org/) compliant registries. This includes GitHub Container Registry, Docker hub, and many other registries.

To download a blueprint via OCI, set the path to `oci://ghcr.io/<username>/<package-name>:<ref>`. This will fetch the blueprint from an OCI package hosted on GHCR.

To fetch blueprints from a private registry with authentication, credentials can be embedded in the address.

Blueprints are re-fetched each execution, so when using changing tags, blueprints will automatically be updated.

To push a blueprint to an OCI-compatible registry, [ORAS](https://oras.land/) can be used with this command

```
oras push ghcr.io/<username>/blueprint/<blueprint name>:latest <yaml file>:application/vnd.goauthentik.blueprint.v1+yaml
```

### Internally in authentik's database

Blueprints can be stored in authentik's database, which allows blueprints to be managed via external configuration management tools like Terraform.

Modifying the contents of a blueprint will trigger its reconciliation. Blueprints are validated on submission to prevent invalid blueprints from being saved.

---

## Working with blueprints

For an overview of what blueprints are, how they're executed, and where they are stored, see the [Blueprints overview](./index.mdx) documentation.

To export configurations (including custom flows) to create a blueprint, read our [Export](./export.mdx) documentation.

The docs below cover applying, creating, editing, and managing blueprints.

## Apply a blueprint

To *apply* a blueprint is to have authentik read and execute the contents of a blueprint file. authentik provides many out-of-the-box blueprints, which can be applied either as a [blueprint instance](./index.mdx#blueprint-instances) or as an [imported flow](./index.mdx#imported-flow).

### Create and apply a new blueprint

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Customization** > **Blueprints**.
3. Click **Create** and define the new blueprint instance.
   - **Name**: provide a descriptive name.
   - **Enabled**: toggle on or off. Disabled blueprints cannot be applied.
   - **Blueprint**: select the source for this instance. You can choose a file from a **Local path**, an **OCI Registry**, or **Internal** (paste file contents directly, stored in database).
   - **Additional settings**:
     - **Context**: add any [`key:value` context variable](./index.mdx#blueprint-execution) used in the blueprint instance.
4. Click **Create** to save the new blueprint instance. This file is read and applied regularly by authentik.

### Import and apply a blueprint

You can import and apply a blueprint from either the **Flows** page or the **Blueprints** page. This validates and applies the blueprint immediately, but it does not create a blueprint instance that is monitored or automatically re-applied.

#### Flows page

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Flows and Stages > Flows**, then click **Import**.
3. Choose how to import the blueprint:
   - **File upload**: upload a `.yaml` file from your local file system. Typically this is a downloaded example flow or a file you [exported](./export.mdx).
   - **Local path**: select one of the blueprints available on the authentik server, such as a bundled [example flow](../../add-secure-apps/flows-stages/flow/flows.mdx).
4. Click **Import**.

#### Blueprints page

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Customization > Blueprints**.
3. Click **Import**.
4. Choose **File upload** to upload a `.yaml` file, or choose **Local path** to select a blueprint available on the authentik server.
5. Click **Import**.

### Apply an existing blueprint

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Customization** > **Blueprints**.
3. Select the blueprint instance from the list.
4. Under **Actions**, click the **Apply** icon.

### Download an example flow, upload it, and apply it

1. Download one of the [example flows](../../add-secure-apps/flows-stages/flow/flows.mdx).
2. Navigate to **Customization** > **Blueprints** and click **Import**.
3. Choose **File upload**, select the downloaded `.yaml` file, and click **Import**.

## Edit a blueprint instance or flow

- To edit a blueprint instance, navigate to **Customization** > **Blueprints** in the Admin interface and click the **Edit** icon of the instance. Alternatively, edit the YAML file directly.

- To edit a flow, navigate to **Flows and Stages > Flows** in the Admin interface and click **Edit** next to the flow you want to modify.

## Delete a blueprint instance or flow

- To delete a blueprint instance, go to **Customization** > **Blueprints**, select the checkbox next to the instance, and click **Delete**. You can recreate and apply it by creating a new blueprint instance and selecting the file in the **Create** page, under **Path**.

- To delete a flow, navigate to **Flows and Stages** > **Flows**, select the checkbox next to the flow, and click **Delete**. You can re-import the flow later by repeating the import steps in the previous section.

---

## Custom CSS

You can add custom CSS to further customize the look of authentik. Some areas where custom CSS can be applied include:

- The [flow executor](https://api.goauthentik.io/flow-executor/) (login and enrollment pages)
- The user library and its application cards

Custom CSS is an advanced feature. Improper use may lead to unexpected behavior or visual issues. Test changes in a safe environment before applying them to production.

## Concepts

authentik's design system is built around several key concepts that help manage and apply styles consistently. Understanding these concepts is essential for working with custom CSS effectively.

### Web components

authentik's interface is built using [Lit](https://lit.dev/) web components (also known as custom HTML elements). Lit is a lightweight library that serves as the foundation of authentik's front-end architecture. Each component encapsulates its own structure, styles, and behavior, enabling modular and reusable UI elements.

authentik's base stylesheet includes CSS styles and variables that ensure a consistent look across all components. Many web components also define their own styles, which can override or extend the base styles. Style encapsulation is a key feature of web components: styles defined within a component don't leak out to affect other parts of the application, and external styles don't affect the component's internals.

Despite this encapsulation, many authentik web components are designed with theming in mind, exposing specific CSS parts and variables that you can target for customization.

### CSS variables

CSS variables (also called CSS custom properties) define colors, spacing, typography, and other design elements throughout authentik. By overriding these variables in your custom CSS, you can change the interface's look and feel at a high level without targeting individual elements.

There's no comprehensive documentation of authentik's CSS variables. However, authentik uses [Patternfly 4](https://pf4.patternfly.org/developer-resources/global-css-variables/) and [Patternfly 5](https://v5-archive.patternfly.org/developer-resources/global-css-variables/) as its underlying design systems, which provide extensive documentation on their CSS variables.

### CSS parts

The [`::part` selector](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/::part) and [`part` attribute](https://developer.mozilla.org/en-US/docs/Web/CSS/part) allow web components to expose specific elements within their shadow DOM for external styling. This provides a controlled way to customize component appearance without breaking encapsulation.

When customizing authentik, start by modifying CSS variables to achieve broad changes. If you need finer control, use the `::part` selector to target specific component parts.

## Modes of appearance

### Color scheme

A [color scheme preference](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/color-scheme) is a user-agent-provided hint indicating **light** or **dark** mode. The browser's color scheme can influence how certain built-in elements render, such as form controls and scrollbars. When no preference is set, authentik typically defaults to light mode.

### Theme

A theme is a higher-order concept encompassing the overall look and feel of authentik, composed of CSS variables, CSS parts, and other styling rules. A theme should also accommodate user preferences and system settings, such as light or dark mode.

When customizing authentik's appearance, think of the theme as the primary way to define the visual experience rather than targeting individual elements directly.

### Viewport considerations

When customizing styles that depend on viewport size, use [responsive design principles](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/CSS_layout/Responsive_Design). In authentik's design system, this means leveraging CSS variables that automatically adapt to viewport size rather than hardcoding styles for specific breakpoints.

```css title="❌ Static units"
ak-library::part(card-header-icon) {
    font-size: 24px;
    margin-bottom: 16px;
}
```

```css title="✅ Responsive units"
ak-library::part(card-header-icon) {
    font-size: 2rem;
    margin-block-end: var(--pf-global--spacer--md);
}
```

Many interface elements are aware of their container size and adjust their layout accordingly. Test your customizations across different viewport sizes (mobile, tablet, and desktop).

## Accessibility

Users may have accessibility preferences set in their operating system or browser, such as high contrast mode or reduced motion. authentik's base theme respects these preferences to ensure a good experience for all users. Keep accessibility in mind so your customizations remain usable regardless of accessibility settings.

### User agent hints

authentik's interface uses web standards APIs to detect **user agent hints** and determine the preferred visual experience. Where possible, authentik prioritizes system or browser-level preferences.

However, authentik also applies its own theming rules to ensure a consistent and visually appealing experience. This means authentik respects user preferences while maintaining a cohesive look.

For example:

```css title="❌ Direct styling"
body {
    background-color: white;
    color: black;
}

@media (prefers-color-scheme: dark) {
    body {
        background-color: black;
        color: white;
    }
}
```

This directly styles the `body` element based on the color scheme preference. While this works in simple scenarios, it leads to inconsistencies and maintenance challenges as the application evolves. Compare this with a theme-based approach:

```css title="✅ Theme-based styling"
:root {
    --ak-global--Color--100: black;
    --ak-global--BackgroundColor--100: white;
}

html[data-theme="dark"] {
    --ak-global--Color--100: white;
    --ak-global--BackgroundColor--100: black;
}

body {
    background-color: var(--ak-global--BackgroundColor--100);
    color: var(--ak-global--Color--100);
}
```

Here, CSS variables define colors and backgrounds, with values adjusted based on the theme. This approach is more modular and maintainable—theme changes happen in one place without modifying individual element styles throughout the application.

### Contrast ratios (`prefers-contrast`)

The [Web Content Accessibility Guidelines (WCAG)](https://www.w3.org/WAI/standards-guidelines/wcag/) recommend minimum contrast ratios between text and background colors.

User agents may adjust color rendering to meet these guidelines based on accessibility settings. The [`prefers-contrast` media feature](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-contrast) detects user preferences for increased or decreased contrast.

When customizing styles, modify CSS variables before targeting specific elements. Keep in mind that users may prefer either less or more contrast, so avoid hardcoding high-contrast styles that could conflict with their preferences.

### Transparency (`prefers-reduced-transparency`)

User agents may adjust transparent elements to ensure sufficient visibility based on accessibility settings. The [`prefers-reduced-transparency` media feature](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-transparency) detects user preferences for reduced transparency effects.

When customizing styles involving transparency, consider baking transparency effects into your color choices rather than relying on CSS opacity or alpha values.

### Motion (`prefers-reduced-motion`)

User agents may reduce or eliminate animations and transitions. The [`prefers-reduced-motion` media feature](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion) detects user preferences for reduced motion.

A preference for reduced motion doesn't necessarily mean eliminating all motion. Animations that indicate state changes or provide important context may still be appropriate.

### Localization (`html[lang]`)

The authentik interface supports [multiple languages and regional settings](../../developer-docs/translation.mdx). Depending on the detected locale and your instance's localization settings, the interface may adjust text direction (left-to-right or right-to-left), date formats, and other locale-specific elements.

Your custom CSS can accommodate these variations using the `[lang]` attribute selector:

```css title="Changing font for Japanese locale"
html[lang="ja"],
html[lang^="ja-"] {
    --ak-font-family-sans-serif:
        "M PLUS 2", "Noto Sans JP", "Hiragino Kaku Gothic Pro", "ヒラギノ角ゴ Pro W3", メイリオ,
        Meiryo, "ＭＳ Ｐゴシック", var(--ak-generic-sans-serif);
}
```

## Examples

### Enforce a specific color scheme

You can enforce a specific color scheme in the Admin interface by navigating to **System** > **Brands** and clicking **Edit** for a brand. Expand **Other global settings** and modify the **Attributes** field with the following YAML:

```yml title="Default a brand to dark mode"
settings:
    theme:
        base: dark
```

To enforce a theme for a specific user, navigate to **Directory** > **Users**, click the **Edit** icon for a user, and modify the **Attributes** field:

```yml title="Default a user to light mode"
settings:
    theme:
        base: light
```

authentik's base theme prioritizes accessibility and may adjust colors and styles based on user preferences or system settings. The browser or operating system may also override the enforced theme to respect user accessibility settings, such as high contrast mode.

Think carefully before enforcing a specific color scheme, as it may conflict with the user's accessibility needs. Overriding accessibility settings may also have legal implications under accessibility laws and regulations in certain jurisdictions.

### Hide the locale selector

Use this when a brand should use a fixed language and users do not need to select another language on authentication flows.

```css
ak-flow-executor::part(locale-select) {
    display: none;
}
```

## Troubleshooting

Custom CSS can be powerful, but it can also lead to unexpected results if not implemented carefully. Here are some common issues and solutions.

### My custom CSS is being overridden by authentik's base styles

- [x] Ensure your CSS selectors are specific enough to override the base styles. You may need to increase specificity or use `!important` sparingly.
- [x] Use browser developer tools to inspect elements and see which styles are being applied and where they come from.

The element you're trying to style may be within a web component's shadow DOM, making it harder to target. Use the `::part` selector to target exposed parts of the component. If the element is nested within another web component, the `part` must be exported by the parent component to be accessible.

### Do I have to use CSS parts and CSS variables?

authentik doesn't require CSS parts or CSS variables. You can use standard CSS selectors to target elements directly. However, direct element styling is more prone to breaking with updates, as internal structures may change without notice.

Direct element styling tends to break when authentik updates, since internal structures can change without notice—especially for complex pages like the flow executor. CSS parts are more limited in scope but provide a stable theming API and a more predictable upgrade experience.

### Custom CSS doesn't seem to be working at all

- [x] View your authentik instance in a private or incognito browser window to rule out caching issues.
- [x] Ensure your CSS is correctly formatted and free of syntax errors.
- [x] Confirm that no runtime errors appear in the browser's developer console that might prevent CSS from being applied.
- [x] Verify that the CSS appears in the page's source code using browser developer tools.

If you're still having trouble, the issue may stem from your CDN or reverse proxy caching old versions of your page. Your brand may also not be applicable for the domain you're accessing.

### Where can I find documentation on available CSS Variables and Parts?

There's currently no comprehensive documentation on available CSS variables and parts in authentik. You can inspect the rendered HTML using browser developer tools to identify the CSS variables and parts applied to various elements.

Look for CSS variables prefixed with `--ak-` and `--pf-` to identify those defined by authentik and Patternfly respectively. HTML elements with the `part="..."` attribute indicate which parts are available for styling.

### The UI looks broken after upgrading authentik. What should I do?

The upgrade may have introduced changes to the base theme, which could conflict with your custom CSS. In addition to reviewing the release notes for any changes, you may need to adjust your custom CSS to accommodate the new base styles. Avoiding direct element styling and instead relying on CSS variables and parts can help reduce the likelihood of breakage after upgrades.

### I've locked myself out of authentik with a broken theme. How do I recover?

If you've locked yourself out of authentik due to a broken theme, you can use the recovery token to regain access. To generate a recovery token, run the following command in your terminal:

```sh
uv run ak create_recovery_key 10 akadmin
```

Using a recovery token will disable custom CSS, allowing you to log in, navigate to the **System** > **Brands** page, and remove or fix the broken custom CSS.

---

## Branding

As an authentik administrator, you can customize your instance's appearance and behavior using brands. Brands apply to a single domain, a domain wildcard, or can be set as default, in which case the brand will be applied when no other brand matches the domain.

The main settings that control your instance's appearance and behavior are the **Branding settings** on your brand, and the default flows that you specify.

## Create or edit a brand

To create or edit a brand:

1. Log in as an administrator, open the authentik Admin interface, and navigate to **System** > **Brands**.
2. Click **Create** to add a new brand, or click the **Edit** icon next to an existing brand to modify it.
3. Define the configurations in the following settings:

### Branding settings

The brand settings define the visual identity of the brand, including:

- **Branding title**: Displayed in the browser tab (document title) and throughout the UI.
- **Logo**: Displayed in the upper-left corner.
- **Favicon**: Shown on the browser tab.
- **Default flow background** 2025.4: Default background image for the flow executor. See [Flow configuration options](../../add-secure-apps/flows-stages/flow/index.mdx#flow-configuration-options) to override this image on a per-flow basis.
- **Custom CSS** 2025.4: Add custom CSS to further customize the look of authentik. See [Custom CSS documentation](./custom-css.mdx) for more information.

Logo, favicon, and default flow background use the shared file picker. See [File picker values](../../customize/file-picker.mdx).

### External user settings

You can configure authentik to redirect external users to a default application after they log in (if they weren't originally redirected from a specific application). To do this:

1. Open the authentik Admin interface and navigate to **System** > **Brands**.
2. Click the **Edit** icon for the relevant brand.
3. Under **External user settings** select a **Default application**.

### Default flows

You can explicitly select, in your instance's Brand settings, the *default flows* to use for the current brand. You can optionally configure these default flows ([learn more about each default flow](../../add-secure-apps/flows-stages/flow/default-flows.mdx)):

- **Authentication** flow: the flow used to authenticate users. If left empty, the first applicable flow sorted by the slug is used.
- **User switch flow**: the authentication flow used when [switching between users](../../users-sources/user/user-switching.mdx) signed in on the same browser. If left empty, user switching is disabled. To reuse the default authentication flow for switching, select it here explicitly.
- **Invalidation Flow**: for typical use cases, select the `default-invalidation-flow` (Logout) flow. This flow logs the user out of authentik when the application session ends (user logs out of the app).
- **Recovery flow**: if set, the user can access an option to recover their login credentials.
- **Unenrollment flow**: if set, users are able to unenroll themselves using this flow. If no flow is set, option is not shown.
- **User settings flow**: if set, users are able to configure details of their profile.
- **Device code flow**: if set, the OAuth Device Code profile can be used, and the selected flow will be used to enter the code.

If a default flow is *not* set in the brand, then authentik selects any flow that:

- matches the required designation
- comes first sorted by slug
- is allowed by policies

This means that if you want to select a default flow based on policy, you can leave the brand default empty.

## Other global settings

### Web Certificate

The **Web Certificate** option can be used to configure which certificate authentik uses when its accessed directly via HTTPS (via port 9443).

### Client Certificates2025.4

When using the [Mutual TLS Stage](../../add-secure-apps/flows-stages/stages/mtls/index.mdx) and accessing authentik directly, this setting specifies which certificate authorities are trusted to issue client certificates.

### Attributes

Attributes such as locale, theme settings (light/dark mode), and custom attributes can be set to a per-brand default value here. Any custom attributes can be retrieved via [`group_attributes()`](../../users-sources/user/user_ref.mdx#object-properties).

To set the UI language for a brand, add `settings.locale` with a supported locale code. For example, to use English across the default brand:

```yaml
settings:
    locale: en
```

To hide the language selector on authentication flows, see [Hide the locale selector](./custom-css.mdx#hide-the-locale-selector).

## Image optimization

When you use images and icons for a brand's logo, favicon, etc., be aware of the following optimization tips:

- Use an SVG version of the image.
- Trim excess whitespace from around the logo. You can use an SVG editor such as Inkscape, Sketch, or Adobe Illustrator.
- Adjust the viewBox: Ensure the SVG’s `viewBox` attribute tightly wraps the actual logo content. This helps in scaling the logo appropriately.
- Remove fixed dimensions: delete any fixed width and height attributes from the SVG. This allows the logo to scale responsively within its container.
- Check if your SVG needs `preserveAspectRatio` to retain its shape when resized.
- Wordmark logos: aim for an aspect ratio of approximately 7:1 (width to height).
- Icon logos: use a 1:1 aspect ratio, ensuring the icon fills the entire viewBox and is centered.
- The SVG tool [SVGOMG](https://svgomg.net/) is useful for trimming any excess metadata that might affect how the browser rasterizes the image.

---

## Policy bindings and evaluation

This page covers policy bindings: where they apply, how authentik evaluates them, and which options affect the result. For the broader binding model, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.mdx). For step-by-step instructions, see [Working with policies](./working_with_policies.mdx).

## Where policies can be bound

In authentik, a stage is attached to a flow through a stage binding. When you attach a policy to a stage inside a flow, you are binding the policy to that stage binding, not directly to the stage definition itself. To learn more, see [Bindings](../../add-secure-apps/bindings-overview/index.mdx).

| Binding target | What it controls                                       | How to configure it                                                                              |
| -------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
| Flow           | Whether the user can start or continue using the flow  | [Bind a policy to a flow](./working_with_policies.mdx#bind-a-policy-to-a-flow)                   |
| Stage binding  | Whether a specific stage runs in that flow             | [Bind a policy to a stage binding](./working_with_policies.mdx#bind-a-policy-to-a-stage-binding) |
| Application    | Whether the user can access the application            | [Bind a policy to an application](./working_with_policies.mdx#bind-a-policy-to-an-application)   |
| Source         | Whether the source can be used for login or enrollment | [Bind a policy to a source](./working_with_policies.mdx#bind-a-policy-to-a-source)               |

In the same binding UI, you can also bind a user or group directly. These bindings are simple membership checks and are useful when you want a direct allow or deny rule without creating a separate policy object.

## Validate prompt data with policies

Some stages also have their own policy hooks. The most common example is the [Prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx), which supports **Validation Policies**.

Use prompt-stage validation policies when the decision depends on data the user has just entered, such as:

- password complexity
- password history
- matching two prompt fields
- validating an email domain during enrollment

Prompt-stage validation is often the right place for [Password](./types/password.mdx), [Password Uniqueness](./types/password-uniqueness.mdx), and [Expression](./types/expression/index.mdx) policies.

## How authentik evaluates policies

When a flow, stage binding, application, or source has multiple bindings, authentik evaluates them in order.

### Policy engine mode

Every policy binding target has a **Policy engine mode**:

- `Any`: the target passes when any binding passes.
- `All`: the target passes only when every binding passes.

The default mode is `Any`.

### Order

Bindings are evaluated in ascending order. This matters most when you inspect logs or when you are combining multiple policies that produce end-user messages.

### Enabled bindings only

Disabled bindings are skipped entirely.

### Direct user and group bindings

Bindings to users and groups are evaluated alongside policy bindings:

- A user binding passes when the current user matches.
- A group binding passes when the current user is a member of that group.

These are a simple way to mix static membership checks with policy-based logic.

### No bindings means pass

If a target has no applicable bindings, authentik treats the result as passing.

## Binding options

Bindings have a few important options beyond the target and order.

### Negate

**Negate** flips the pass or fail result of the binding. This is useful when you want to express "everyone except this group" or turn an allow-style policy into a deny-style rule without copying it.

Negation only changes the boolean result. Any messages returned by the policy are left unchanged.

### Timeout

**Timeout** limits how long authentik waits for a policy execution before it is terminated. This is especially relevant for expression policies or other policy types that can call external systems. The default is 30 seconds.

### Failure result

If a policy errors during execution, **Failure Result** decides whether authentik should treat that failure as pass or fail.

Use this carefully:

- Fail closed when the policy protects access to something sensitive.
- Fail open only when availability is more important than enforcement for that specific check.

### Execution logging

Individual policies can enable **Execution logging**. When enabled, authentik logs every execution of that policy, not only failures and exceptions. This is helpful while debugging complex access rules.

## Common patterns

### Limit application access with a group or policy

Bind a group directly when the rule is static. Bind a policy when access depends on runtime context such as network, source, prompt data, or request history.

### Run a stage only for some users

Bind a policy to the stage binding, not just to the flow. The stage will only run when that binding passes.

### Validate user input

Attach validation policies directly to the prompt stage when the decision depends on the values the user just entered.

---

## Policies

Policies are reusable checks in authentik. They let you control whether a user can access an application, whether a stage in a flow should run, whether a source can be used, or whether data entered in a prompt stage is valid.

If you are new to policies, start here:

- [Working with policies](./working_with_policies.mdx) shows how to create a policy and bind it to a flow, stage, application, or source.
- [Policy bindings and evaluation](./bindings.mdx) explains where policies are attached and how authentik combines the results.
- [Types of policies in authentik](./types/index.mdx) groups the built-in policy types by use case.
- [Expression policies](./types/expression/index.mdx) covers Python-based policies for custom logic.

## How policies fit together

Every policy setup has three parts:

1. A **policy** defines a single check, such as "is the client in an allowed country?" or "did the user enter an acceptable password?"
2. A **binding** decides where that policy applies, such as a flow, stage binding, application, or source.
3. The **target object** combines all of its bindings using either `Any` or `All` mode.

You can also bind a **user** or **group** directly in the same places where you bind policies. Those direct bindings are evaluated like simple allow or deny checks and do not require writing a policy.

## Choose a policy type

Use the built-in policy types when they already match what you need. Reach for an expression policy when the built-in types are too limited.

| Policy type                                            | Use it when                                                                               | Notes                                                                                                                         |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| [Event Matcher](./types/event-matcher.mdx)             | You want to react to specific authentik events, usually for notifications or automations. | Matches event action, app, model, client IP, and [AKQL queries](../../sys-mgmt/akql.mdx#use-akql-in-an-event-matcher-policy). |
| [Expression](./types/expression/index.mdx)             | You need custom logic that is not covered by a more specialized policy type.              | Most flexible option. Runs Python and can inspect flow context, prompt data, user data, request metadata, and more.           |
| [GeoIP](./types/geoip.mdx)                             | You want to allow or deny requests based on country, ASN, or travel patterns.             | Can also check recent login distance and impossible-travel scenarios.                                                         |
| [Password](./types/password.mdx)                       | You want to validate password complexity, HIBP exposure, or zxcvbn strength.              | Commonly attached to a prompt stage's **Validation Policies**.                                                                |
| [Password Expiry](./types/password-expiry.mdx)         | You want to expire passwords after a fixed number of days.                                | Can either deny login or mark the password unusable so the user must update it.                                               |
| [Password Uniqueness](./types/password-uniqueness.mdx) | You want to prevent password reuse.                                                       | Enterprise feature.                                                                                                           |
| [Reputation](./types/reputation.mdx)                   | You want to react to failed logins or suspicious sign-in activity.                        | Useful for showing CAPTCHA or another challenge only to low-reputation requests.                                              |

## Deprecated policy types

### Have I Been Pwned policy

The standalone Have I Been Pwned policy is deprecated. Use the [Password Policy](./types/password.mdx) instead, which includes the same HIBP check.

---

## Working with policies

For an overview of policies, refer to our documentation on [Policies](./index.mdx).

authentik provides several [built-in policy types](./types/index.mdx), which can be configured for your specific needs. We also document several useful [expression policy examples](./types/expression/index.mdx#sample-expression-policies).

You can add expressions to built-in policies to further customize them.

To learn more, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.mdx) and [bind a policy to a new application when the application is created](../../add-secure-apps/applications/manage_apps.mdx#create-an-application-and-provider-pair).

## Create a policy

To create a policy:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Click **New Policy**.
4. Select the policy you want to create.
5. Configure the policy-specific settings.
6. Click **Create Policy**.

If you are not sure which policy type to choose, see [Types of policies in authentik](./types/index.mdx).

## Bind a policy to a flow, stage, application, or source

After creating the policy, you can bind it to either a:

- [Flow](../../add-secure-apps/flows-stages/flow/index.mdx)
- [Stage binding](../../add-secure-apps/flows-stages/stages/index.mdx#stage-bindings)
- [Application](../../add-secure-apps/applications/index.mdx)
- [Source](../../users-sources/sources/index.mdx)

For background about policy bindings, stage bindings, and why policies on stages are bound to flow-stage bindings, see [Bindings in authentik](../../add-secure-apps/bindings-overview/index.mdx).

### Bind a policy to a flow

These bindings control which users can access a flow.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**.
3. In the list of flows, click the name of the flow to which you want to bind a policy.
4. Click the **Policy / Group / User Bindings** tab at the top of the page.
5. Click **Create or bind...**. You can then create a new policy and bind it to the flow, or select **Bind an existing policy** under **Bind Existing...**.

### Bind a policy to a stage binding

These bindings control which stages are applied to a flow.

When you bind a policy to a stage binding, this task is done per flow, and does not carry across to other flows that might use this same stage.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**.
3. In the list of flows, click the name of the flow that has the stage to which you want to bind a policy.
4. Click the **Stage Bindings** tab at the top of the page.
5. Click the arrow (**>**) beside the name of the stage to which you want to bind a policy. The details for that stage are displayed.
6. Either create and bind a new policy, or bind an existing policy, group, or user.

If the policy depends on request data that is only known after the user has interacted with the flow, configure the stage binding to **Evaluate when stage is run**. For more information, see [Planning and stage policies](../../add-secure-apps/flows-stages/flow/planner.mdx#planning-and-stage-policies).

### Bind a policy to an application

These bindings control which users or groups can access an application.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications**.
3. In the list of applications, click the name of the application to which you want to bind a policy.
4. Click the **Policy / Group / User Bindings** tab at the top of the page.
5. Click **Create or bind...**. You can then create a new policy and bind it to the application, or select **Bind an existing policy** under **Bind Existing...**.

### Bind a policy to a source

These bindings control which users or groups can access a source.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**.
3. In the list of sources, click the name of the source to which you want to bind a policy.
4. Click the **Policy Bindings** tab at the top of the page.
5. Either create and bind a new policy, or bind an existing policy, group, or user.

For background on policy ordering, engine mode, and binding options, see [Policy bindings and evaluation](./bindings.mdx).

---

## Style guide

This style guide helps keep authentik documentation consistent, clear, and easy to follow. It standardizes phrasing, formatting, tone, and structure.

We appreciate all contributions to our documentation — whether it's fixing a typo, adding new content, or writing an entirely new topic. To help us review and merge your contributions more efficiently, please follow our [writing documentation](./writing-documentation.mdx) guidelines. If you notice any inconsistencies, feel free to open an [Issue](https://github.com/goauthentik/authentik/issues) or submit a [Pull Request](https://github.com/goauthentik/authentik/pulls) to fix them.

- [General style guidelines](#general-style-guidelines)
- [Terminology](#terminology)
- [Writing style](#writing-style)
- [Word choices](#word-choices)
- [Formatting guidelines](#formatting-guidelines)
- [Component-based formatting](#component-based-formatting)
- [Error message formatting and troubleshooting](#error-message-formatting-and-troubleshooting)
- [Accessibility best practices](#accessibility-best-practices)
- [Inclusive language](#inclusive-language)
- [Images and media](#images-and-media)
- [Document structure and metadata](#document-structure-and-metadata)

---

## General style guidelines

### Logical order

- Documentation should be structured to follow the natural order of tasks, making it easier for users to follow. Organize sections in a manner that reflects the actual workflow used to complete tasks.

- When writing procedural documentation (how-to docs), the steps should follow the workflow in the UI, specifying the exact pages to navigate and the precise fields, tabs, etc., to select or complete. Present the UI components in the document in the same order they appear in the UI.

### Headings

Use headings (subtitles) to break up large blocks of text, making it easier for users to navigate the content and find specific sections quickly.

### Look and feel of the docs

In general, the visual aesthetic of the technical documentation is intended to be lean and clean. Both the content (shorter sentences, concise instructions, etc.) and the layout strive to have a clean, uncluttered look, with restrained use of colors and large callouts or announcements. Relatedly, the colors used for our Info and Warning callouts, light blue and light yellow respectively, are reserved for those purposes only.

### Cross-references

Always include cross-references to related content. If a concept is referenced elsewhere in the documentation, link to the relevant section to provide users with additional context or instructions.

### Relative vs. absolute paths

Use relative paths when linking to other documentation files in this repository. Relative paths make links portable across documentation deployments, but they do not update automatically when files move. Use an absolute URL for resources outside this repository.

### File type

The standard file type for documentation is `.mdx`.

### OS-agnostic, clarify where needed

Try to write procedural (How To) docs generically enough that it does not endorse or force a specific operating system. If it is necessary to specify a specific OS be sure to label it clearly. Consider using tabs to show the different OSes.

---

## Terminology

### authentik product name and terms

- The product name **authentik** should always be written with a lowercase "a" and a "k" at the end, even if it begins a sentence.

- The company name is **Authentik Security, Inc.**, but for non-legal documentation, you may shorten it to **Authentik Security**.

- When referring to the authentik Admin interface, capitalize "Admin" like it is in the UI, but do not bold the phrase "Admin interface" unless in a sentence that explicitly says "Click on **Admin interface**". However, if you are referring to a user or role that is an administrator, or has administrative rights, then do not capitalize it and spell out the full word "administrator" or "administrative".

### Industry terms and technology names

- When referring to external tools or industry terms, always use the exact capitalization and naming conventions that the product or company uses. Refer to their website or official documentation for the proper formatting. For example, use "OAuth", "SAML", or "Docker" as per the official conventions.
- Avoid abbreviations unless they are well-known and widely recognized (e.g., SSO, MFA, RBAC).
- If an acronym is used less frequently, spell out its full meaning when first mentioned on the page, followed by the acronym in parentheses. In some cases the acronym can come first, followed by the full term in parentheses.

### Trademarks and legal terms

- Respect third-party trademarks. Use the correct symbols (™, ®) where applicable (e.g., "GitHub®", "Okta™") in the _first_ instance of the name.
- When mentioning third-party products, follow their branding guidelines (e.g., "GitHub", not "Github").
- Where appropriate, include required legal disclaimers when referencing external services or integrations.

---

## Writing style

### Tone

The tone of the authentik documentation should be friendly but professional. It should be approachable, yet not overly casual. When appropriate, address the reader directly using second-person pronouns (e.g., "Next, you need to configure the login settings").

### Language

The documentation uses **American English** spelling conventions (e.g., "...ize" instead of "...ise").

### Voice

Use **active voice** and **present tense** for clear, direct communication.

- **DON'T:** "The Applications page will be loaded."
- **DO:** "The Applications page displays."

### User-friendly phrasing

Avoid phrasing that blames the user. Be objective and polite when providing instructions.

- **DON'T:** "Never modify the default file."
- **DO:** "We recommend that you do not modify the default file, as doing so may result in unexpected issues."

### Punctuation

For Ken's sake, and many others, try to not use too many commas (avoid commaitis). Use a comma when needed to separate clauses, or for "slowing the pace" or clarity. Please **do** use the [Serial comma](https://en.wikipedia.org/wiki/Serial_comma) (also known as the Oxford comma).

In [lists](#lists), add a period at the end of a bulleted item if it is a complete sentence. Try not to mix incomplete and complete sentences in the same list.

### Capitalization

#### Titles and headers

Titles and headers (H1, H2, H3, etc.) should follow **sentence case capitalization**, meaning only the first word is capitalized, except for proper nouns or product names. For more information, see [below](#titles-and-headers).

#### Following a colon

Whether to capitalize after a colon depends on the context. Typically, we do not capitalize the first word after a colon _unless_ it's a proper noun or if it is the start of a complete sentence. If the colon introduces a list, do not capitalize the first word unless it's a proper noun. In headings and titles, capitalize the first word after the colon.

---

## Word choices

### "May" versus "Might" versus "Can"

- Typically, avoid using the word "may" in technical writing, as it implies permission rather than ability to perform an action. Instead, use **"can"** to suggest possibility.
- **"Might"** should be used to indicate that something could happen under certain conditions, but use it sparingly. It implies unpredictability, which can be undesirable in software documentation.
    - **DON'T:** "You may use an Expression policy to enforce MFA adherence."
    - **DO:** "You can use an Expression policy to enforce MFA adherence."
    - **DO:** "Values might differ depending on the source of the property mappings."

### "Login", "Log in", and "Log in to"

- As a noun or descriptive term, use **login** (e.g., "The login panel").
- As a verb, use **"log in"** (e.g., "This stage prompts the user to log in").
- As a verb followed by the preposition **"to"**, use **"log in to"** (e.g., "Log in to the application").

### Use "that" as a conjunction

It's important to use "that" as a conjunction to introduce a dependent clause, or as a "connection" between a noun and a verb ("The provider that you created in Step 3."). Including "that" as a conjunction helps non-native English speakers more easily parse phrases, and improves output for translation tools.

- **DO:** "Ensure that the new user's password is valid."
- **DON'T:** "Ensure the new user's password is valid."

### "which" vs "that"

The easiest way to remember when to use "which" versus "that" is:

- If the second part (clause) of the sentence is required to understand the first part, use "that." If the second clause is only additional info, use "which".

For more information, see [this guide](https://www.grammarly.com/blog/which-vs-that/).

### "since" (time-based) vs "because" (causal)

When writing about a status or anything that is causal ("this happened because of that"), use the word "because". Use the word "since" for time-based topics (this will be rare in technical writing).

### Avoid using "once" (numeric) to mean "after" (time-based).

When writing out steps in a procedural topic, avoid starting with "Once...". Instead, you can say "After you have created the scope mapping...".

---

## Formatting guidelines

### Fonts and font styling

- When referring to internal components in authentik, like the policy engine, or blueprints, do not use any special formatting, and do not capitalize. Link to the relevant documentation when possible.

- When referring to authentik functionality and features, such as flows, stages, sources, or policies, do not capitalize and do not use bold or italic text. When possible link to the corresponding documentation.

- Use **bold** to highlight:
    - UI elements such as field names, labels, buttons, or options (e.g., **Save** button, **Username** field).
        - Reproduce the label exactly as it appears on screen, including its capitalization. Write **Bind Flow** if the form says "Bind Flow", even though sentence case applies to headings. The reader is scanning the interface for that string, so a doc that silently re-cases it sends them looking for something that isn't there.
    - Key actions in instructions (e.g., **Click Next**).

- Use _italic_ for:
    - Emphasis, but sparingly, to avoid overuse. For example, you can use italics for important terms or concepts on first mention in a section. Do not use italics to indicate a variable or placeholder; instead use angle brackets as described under [Variables](#variables).

- Use `code formatting` for:
    - Commands (e.g., `kubectl get nodes`).
    - File paths, file names, and directory names (e.g., `/usr/local/bin/`).
    - Inline code snippets (e.g., `.env`).

### List punctuation {#lists}

Add a period at the end of a bulleted item if it is a complete sentence. Try not to mix incomplete and complete sentences in the same list.

If there is a [colon](#following-a-colon) used in a bulleted list item, follow the capitalization rules.

### Admonitions

Use `note`, `tip`, `info`, `warning`, and `danger` admonitions for supplemental information. Choose the least severe type that accurately communicates the content:

- `note`: Additional context.
- `tip`: Optional advice that makes a task easier.
- `info`: Important supporting information.
- `warning`: A risk, limitation, or action that might cause problems.
- `danger`: An irreversible action or serious security or data-loss risk.

Use the following syntax for these components:

**Note**:

```md
:::note
This is additional context.
:::
```

**Tip**:

```md
:::tip
This is optional advice.
:::
```

**Info**:

```md
::: info add-title-here
This is a tip or general note.
:::
```

**Warnings**:

```md
:::warning
This level is for more serious situations: an action cannot be undone, a process might be canceled, etc.
:::
```

**Critical warnings** (for irreversible actions):

```md
:::danger
This level is for extremely serious situations, such as an action permanently removing data.
:::
```

### URLs

- When mentioning URLs in text or within procedural instructions, omit code formatting. For instance: "In your browser, go to https://example.com."
- For URLs entered as values or defined in fields, enclose variables in angle brackets (`< >`) and use underscores between words. See [Variables](#variables).

### Variables

To clearly indicate terms or values that are placeholders and require user input, enclose any variables inside angle brackets (`< >`) and use underscores between words to clearly indicate that these are placeholders that require user input.

Examples:

- `https://authentik.company/application/o/<slug>/.well-known/openid-configuration`
- "Add the configuration setting: `<first_name>`."

### Titles and headers

- Titles and headers (H1, H2, H3) should follow **sentence case capitalization**, meaning only the first word is capitalized, except for proper nouns or product names.
    - **DO:** "Configure the Google Workspace provider"
    - **DON'T:** "CONFIGURE THE GOOGLE WORKSPACE PROVIDER"
    - **DON'T:** "Configure The Google Workspace Provider"

- Ensure that titles and headers are descriptive and clearly convey the purpose of the section. Avoid vague titles like "Overview." Instead, opt for something more specific, like "About authentik policies."

- Use the **imperative verb form** in procedural topics, not gerunds. For example, use "Configure your instance" instead of "Configuring your instance."

### Examples

When you want to show an example (say, a code snippet), start on a new line, use bold text for the word "Example", and a colon, like this:

**Example**:

    This expression policy uses an expression based on the user's name:
    ```python
    if request.context["pending_user"].username == "marie":
        return True
    return False
    ```

### Code blocks

When you want to show sections of code use **Code blocks** to provide syntax highlighting, a copy button, line numbering and line highlighting:

```text
` ` ` yaml showLineNumbers {5} title="/etc/wazuh-indexer/opensearch-security/roles_mapping.yml"
all_access:
reserved: true
hidden: false
backend_roles:
    - "wazuh-admin"
    - "admin"
hosts: []
users: []
and_backend_roles: []
description: "Maps admin to all_access"
` ` `
```

Which is rendered as:

```yaml showLineNumbers {5} title="/etc/wazuh-indexer/opensearch-security/roles_mapping.yml"
all_access:
reserved: true
hidden: false
backend_roles:
    - "wazuh-admin"
    - "admin"
hosts: []
users: []
and_backend_roles: []
description: "Maps admin to all_access"
```

- ` ```yaml ` defines the language used for syntax highlighting. Other supported languages include `jsx`, `python`, `bash`, and `text`.

Optional configurations:

- `showLineNumbers`: enables line numbering.
- `title=" "`: defines the title displayed at the top (e.g., filenames).
- `{5}`: highlights specific lines. Ranges and lists are allowed (e.g., `{5, 7, 9-11}`).
- `// highlight-next-line`: highlights the next line within a code block.
- `// highlight-start` and `// highlight-end`: highlight multiple lines.

For more details, see the [Docusaurus code block documentation](https://docusaurus.io/docs/markdown-features/code-blocks).

### Tables

Use tables to compare options, list parameters, or summarize information. Ensure tables are concise and avoid nesting complex content. Only use a table when there are 4 or more items. For only 2 or 3 items, use a bullet list.

### List structure

- Use bullet points for unordered lists.
- Use numbered lists for sequential steps.
- Keep list items parallel in structure.

---

## Component-based formatting

### Tabs for multiple configurations

Use **Tabs** to display different configurations (e.g., setting up authentication with OIDC vs. SAML) to help users navigate between options. Default to the easier or more common option. For example:

```jsx

    OIDC configuration details go here.
    SAML configuration details go here.
;
```

---

## Error message formatting and troubleshooting

When documenting errors, follow this structure:

1. **Error Message**: Display the error in a code block.
2. **Possible Causes**: List common reasons for the error.
3. **Solutions**: Provide step-by-step fixes or a workaround if there is one.

**Example**:

- **Error message**:

    ```sh
    Error: Authentication failed. Invalid credentials.
    ```

- **Possible causes**:
    - Incorrect username or password.
    - Account locked due to multiple failed attempts.

- **Solutions**:
    - Verify your credentials.
    - Reset your password using the **Forgot Password** link.
    - Contact your administrator if the account is locked.

---

## Accessibility best practices

- **Alt text for images**: Describe the purpose of the image, not just its appearance. For example, use "Screenshot of the login form" instead of "Image of a form."
- **Heading hierarchy**: Use headings in order (H1 → H2 → H3) to support screen readers.
- **Color usage**: Avoid using color as the sole method of conveying information (e.g., "Click the red button"). Instead, use descriptive labels to ensure accessibility.
- **Descriptive link text**: Provide descriptive link text. Avoid using generic terms like "Click here". Be specific about where the link will take the user.
    - **DON'T:** "Click here."
    - **DO:** "See the [Authentication Settings](/) for more details."

---

## Inclusive language

- Use **gender-neutral pronouns** like "they/them" instead of "he/she" (e.g., "The user should check their settings").
- Avoid **ableist terms** such as "dumb" or "lame"; use "non-functional" or "unavailable" instead.
- **Avoid idioms** that may not translate well (e.g., instead of "hit a home run" use "achieve success").

---

## Images and media

- **Screenshots**:
    - Use screenshots very sparingly, only for very complex UIs. If there are screenshots, update any existing ones if the UI changes.
    - Crop to focus on relevant elements, use red arrows or circles to call out the important element.
    - Add descriptive alt text (e.g., "Screenshot of the Provider configuration page").
- **Diagrams**:
    - Use [Mermaid](https://mermaid.js.org/) for creating diagrams directly in markdown. Mermaid is our preferred tool for documentation diagrams as it allows for version control and easy updates.
    - For more complex diagrams, you can use tools like [Draw.io](https://draw.io). Ensure high contrast and text descriptions.
- **authentik icons**:
    - For authentik icons in integration guides, reference assets from the user's own self-hosted instance to avoid external calls, for example: `https://authentik.company/static/dist/assets/icons/icon.svg`

---

## Document structure and metadata

- **Front matter**: Include a title and optional summary. You can also add badge metadata in the front matter:

    ```md
    ---
    title: Getting Started
    description: Install and configure authentik in 5 minutes.
    authentik_version: "2025.4" # Semantic version when feature was introduced (Optional)
    authentik_preview: true # For preview features (Optional)
    authentik_enterprise: true # For enterprise features (Optional)
    support_level: "authentik" # For integrations: Support level: "authentik" (tested by team) or "community" (community maintained)
    ---
    ```

    Note: Badges should be defined in the front matter, not in the markdown content. The system will automatically display the appropriate badges based on the front matter metadata.

- **Directives**: You can also use directives in your markdown content to add badges inline:
    - `:ak-version[2025.4]` - Shows when a feature was introduced (requires semantic version)
    - `:ak-preview` - Indicates preview features
    - `:ak-enterprise` - Indicates features in our Enterprise offering

    Example usage in a heading:

    ```md
    # New Feature :ak-version[2025.4] :ak-preview
    ```

    Note: When using directives, they should be placed at the end of the heading or paragraph where they apply.

- **SEO**: Use keywords in titles and headings to improve searchability. Include relevant terms that users might search for, but avoid keyword stuffing. Focus on natural, descriptive language that accurately represents the content.

---

## Writing documentation

Writing documentation for authentik is a great way for both new and experienced users to improve and contribute to the project. We appreciate contributions to our documentation, from fixing typos and adding content to writing completely new topics.

The [technical documentation](https://docs.goauthentik.io) and our [integration guides](https://integrations.goauthentik.io/) are built, formatted, and tested using `pnpm`. The commands to build the content locally are defined in the `Makefile` in the root of the repository. Each command is prefixed with `docs-` or `integrations-` and corresponds to a package script within the `website` directory.

## Documentation subdomains

authentik documentation is deployed to different subdomains based on the git branch:

| Subdomain                                          | Git Branch       | Description                      |
| -------------------------------------------------- | ---------------- | -------------------------------- |
| [main.goauthentik.io](https://main.goauthentik.io) | `main`           | Latest changes and features      |
| [next.goauthentik.io](https://next.goauthentik.io) | `next`           | Upcoming release content         |
| [docs.goauthentik.io](https://docs.goauthentik.io) | Current release  | Official stable documentation    |
| version-YYYY-MM.goauthentik.io                     | Specific release | Historical version documentation |

## Guidelines

Adhering to the following guidelines will help us get your PRs merged more easily and quickly, with fewer edits needed.

- Ideally, when you are making contributions to the documentation, you should fork and clone our repo, then [build it locally](#set-up-your-local-build-tools), so that you can test the docs and run the required linting and spell checkers before pushing your PR. While you can do much of the writing and editing within the GitHub UI, you cannot run the required linters from the GitHub UI.

- After submitting a PR, you can view the Netlify Deploy Preview for the PR on GitHub, to check that your content rendered correctly, links work, etc. This is especially useful when using Docusaurus-specific features in your content.

- Please refer to our [Style Guide](./style-guide.mdx) for authentik documentation. Here you will learn important guidelines about not capitalizing authentik, how we format our titles and headers, and much more.

- Remember to use our templates when possible; they are already set up to follow our style guidelines, they make it a lot easier for you (no blank page frights!), and they keep the documentation structure and headings consistent.
  - [docs templates](./templates/index.mdx)
  - [integration guide template](https://integrations.goauthentik.io/applications#add-a-new-application)

## Set up a docs development environment

### Prerequisites

- [Node.js](https://nodejs.org/en) (24 or later)
- [pnpm](https://pnpm.io/installation) (11.20 or later), the package manager used by the `website` workspace
- [Make](https://www.gnu.org/software/make/) (3 or later)

Install Node.js with [nvm](https://github.com/nvm-sh/nvm), one of the version managers recommended on the Node.js download page. It keeps the toolchain scoped to your shell rather than installed system-wide, so switching versions between projects doesn't require reinstalling:

```shell
nvm install 24
nvm use 24
```

Then install pnpm by following the [pnpm installation guide](https://pnpm.io/installation). Any recent pnpm works: on each run it automatically switches to the version pinned in `package.json`.

nvm runs on macOS and Linux; on Windows, use [nvm-windows](https://github.com/coreybutler/nvm-windows), a separate project with its own command set. We're currently seeking community input on building the docs on Windows. If you have experience with this setup, please consider contributing to this documentation.

### Clone and fork the authentik repository

```shell
git clone https://github.com/goauthentik/authentik
```

The documentation, integration guides, API docs, and the code are in the same [GitHub repo](https://github.com/goauthentik/authentik), so if you have cloned and forked the repo, you already have the docs and integration guides.

### Set up your local build tools

Run the following command to install or update the build tools for both the technical docs and integration guides.

```shell
make docs-install
```

This command installs or updates the build dependencies such as Docusaurus, Prettier, and ESLint. You should run this command when you are first setting up your writing environment, and also if you encounter build check fails either when you build locally or when you push your PR to the authentik repository. Running this command will grab any new dependencies that we might have added to our build tool package.

If you have the [full development environment](../setup/full-dev-environment.mdx) installed you can run `make install` to get all of the latest build tools and dependencies, not just those for building documentation.

## Write or modify technical docs

In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our technical documentation ([https://docs.goauthentik.io/](https://docs.goauthentik.io/)):

- For new entries, make sure to add any new pages to the `/docs/sidebar.mjs` file.
  Otherwise, the new page will not appear in the table of contents to the left.

For our technical documentation ([https://docs.goauthentik.io/](https://docs.goauthentik.io/)), the following commands are used:

### Build locally

```shell
make docs
```

This command formats, lints, and builds the technical documentation. Run it before pushing, then inspect the deploy preview after opening the pull request.

### Live editing

```shell
make docs-watch
```

Starts a local development server for the documentation site and opens a preview in your browser. This command will automatically rebuild your local documentation site in real time, as you write or make changes to the MDX files in the `website/docs` directory.

## Write or modify integration guides

In addition to following the [Style Guide](./style-guide.mdx) please review the following guidelines about our integration guides ([https://integrations.goauthentik.io/](https://integrations.goauthentik.io/)).

- For new integration documentation, please use the Integrations template in our [GitHub repo](https://github.com/goauthentik/authentik) at `/website/integrations/template/service.mdx`.

- For placeholder domains, use `authentik.company` and `<app-name>.company`, where `<app-name>` identifies the application. Use hyphens between words inside DNS-label placeholders because underscores are not valid in these host-label examples; use underscores for other multiword placeholders.

- Make sure to create a directory for your service in a fitting category within [`/website/integrations/`](https://github.com/goauthentik/authentik/tree/main/website/integrations).

You no longer need to modify the integrations sidebar file manually. This is now automatically generated from the categories in [`/website/integrations/categories.mjs`](https://github.com/goauthentik/authentik/blob/main/website/integrations/categories.mjs).

When authoring integration guides, the following commands are used:

### Build locally

```shell
make integrations
```

This command formats, lints, and builds the integration documentation. Run it before pushing, then inspect the deploy preview after opening the pull request.

### Live editing

```shell
make integrations-watch
```

Starts a local development server for the integrations site and opens a preview in your browser. This command will automatically rebuild your local integrations site in real time, as you write or make changes to the MDX files in the `website/integrations` directory.

## Developing the glossary

The [authentik glossary](/core/glossary/) provides definitions for both industry-standard terms (like LDAP, OAuth2, SAML) and authentik-specific concepts (like Flows, Stages, Blueprints).

### Add a new glossary term

1. Create a new `.mdx` file in `website/docs/core/glossary/terms/` (e.g., `my-term.mdx`).

2. Add frontmatter with the required metadata:

```mdx
---
title: My Term
sidebar_custom_props:
    termName: My Term
    tags:
        - Category Name
    authentikSpecific: true # Only for authentik-specific terms
    shortDescription: Brief one-line description.
    longDescription: Detailed explanation with context, use cases, and examples.
---
```

### Glossary metadata fields

- **`termName`** (required): The display name of the term
- **`tags`** (required): Array of category tags for organizing terms. Common tags include:
  - Core Concepts
  - Flows
  - OAuth2/OIDC
  - SAML
  - Directory
  - Configuration
  - Protocols
- **`authentikSpecific`** (optional): Set to `true` for authentik-specific terms. This displays an "authentik specific" badge next to the term name to distinguish it from industry-standard terminology. Omit this field for industry-standard terms.
- **`shortDescription`** (required): Concise one-line summary displayed in the main glossary view
- **`longDescription`** (optional): Detailed explanation shown when users expand the term

### Formatting guidelines

- Use backticks for inline code: \`application\`
- Keep `shortDescription` to one sentence
- In `longDescription`, you can use multiple paragraphs separated by blank lines

## Page routing and URLs

Every documentation page you see on our website starts as an MDX file in our repository. When you create or edit these files, our build system automatically transforms them into web pages with predictable URLs.

### Convert file paths to URLs

Let's take a look at the file path of the [Style Guide page](https://docs.goauthentik.io/developer-docs/docs/style-guide/):

```text
/website/docs/developer-docs/docs/style-guide.mdx
```

Compared to the URL path of this page, there are a few differences:

- The `website/docs` prefix is dropped.
- File extensions are removed.
- A trailing slash is added.

This results in the following URL path:

```text
https://docs.goauthentik.io/developer-docs/docs/style-guide/
```

The final published URL is made possible with a combination of [Docusaurus's routing system](https://docusaurus.io/docs/advanced/routing) and [Netlify's redirects](https://docs.netlify.com/routing/redirects/).

### Sidebar files

The sidebar files define the navigation structure of the documentation pages.

- **Documentation**: [`website/docs/sidebar.mjs`](https://github.com/goauthentik/authentik/blob/main/website/docs/sidebar.mjs)
- **Integrations**: [`website/integrations/sidebar.mjs`](https://github.com/goauthentik/authentik/blob/main/website/integrations/sidebar.mjs)
  - Automatically generated from the categories in [`/website/integrations/categories.mjs`](https://github.com/goauthentik/authentik/blob/main/website/integrations/categories.mjs).
- **API Reference**: [`website/api/sidebar.mjs`](https://github.com/goauthentik/authentik/blob/main/website/api/sidebar.mjs)
  - Mostly automatically generated from authentik API schema.

### Redirects

Sometimes we need to move pages or change URLs. Instead of breaking bookmarks and links, we can define a redirect to automatically send readers from old URLs to new ones.

All our redirects are defined within three files:

- **Documentation**: [`website/docs/static/_redirects`](https://github.com/goauthentik/authentik/blob/main/website/docs/static/_redirects)
- **Integrations**: [`website/integrations/static/_redirects`](https://github.com/goauthentik/authentik/blob/main/website/integrations/static/_redirects)
- **API Reference**: [`website/api/static/_redirects`](https://github.com/goauthentik/authentik/blob/main/website/api/static/_redirects)

A `_redirects` file contains a list of rules that define how to handle requests, each of which has the following format:

1. The source URL path (i.e the old URL to match against).
2. The destination URL path (i.e. the new URL to redirect to).
3. The HTTP status code to use when redirecting, followed by an exclamation mark (`!`).

For example, if we moved our applications page:

```text title="website/docs/static/_redirects"
# Source URL Path  | Destination URL Path           | Status Code
/core/applications   /add-secure-apps/applications/   302!
```

Anyone visiting the old URL will automatically land on the new page using a combination of Netlify and Docusaurus.

#### Initial page loads (server-side)

When a reader first visits a documentation page or refreshes their browser:

1. Their browser requests the URL from our server (Netlify).
2. Netlify checks if that exact page exists.
3. If not, it checks our `_redirects` file for a matching rule.
4. The server sends back the correct page, or a 404 if no matching rule exists.

#### Navigate between pages (client-side)

When a reader clicks a link to another documentation page:

1. Docusaurus intercepts the click (no server request needed).
2. The URL in the browser's address bar changes.
3. Docusaurus router fetches the new page content without a full reload.

If Docusaurus's router attempts to render a page that does not exist, the `_redirects` file will be used to determine if a redirect rule should be applied, without a server request or a full reload.

Whether the reader is viewing a page for the first time or navigating between pages, this arrangement allows us to have a single source of truth for all URLs, ensuring that each page remains consistently accessible across authentik versions and throughout our three Docusaurus deployments (Topics, Integrations, and API).

### Update a page's URL

Every URL is a promise

When someone bookmarks a page or shares a link, they expect it to keep working.

**Before changing any URL, ask yourself:**

- [x] Is this move absolutely necessary?
- [x] Could better organization be achieved without moving files?
- [x] Will this help or confuse readers migrating between authentik versions?

Remember, [Cool URIs don't change!](https://www.w3.org/Provider/Style/URI)

Moving a documentation page to a new location requires updating a `sidebar.mjs` and `_redirects` file.

1. Take note of the page's current URL path in the browser's address bar.
2. Move the MDX file to the new location.
3. Add a new redirect rule to the `_redirects` file in the respective [documentation directory](#redirects).
4. Update the `sidebar.mjs` file in the respective [documentation directory](#redirects).

---

## Cascade layers

authentik's document CSS is ordered with [cascade layers](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@layer). Layers make the ordering explicit, so a rule's precedence comes from the layer it is assigned to rather than from where it happens to be imported or how specific its selector is.

## The layer order

One declaration, in `web/src/styles/layers.css`, defines the order for the whole document. It is the first import in every entrypoint:

```css
@layer reset, vendor, components, theme, mode, brand;
```

Lowest precedence first:

| Layer        | Holds                                                                                            |
| ------------ | ------------------------------------------------------------------------------------------------ |
| `reset`      | Top-level normalization. Sparse — most of the reset is folded into PatternFly.                   |
| `vendor`     | Vendored PatternFly and the bundled typefaces. Frozen; do not hand-edit.                         |
| `components` | Document-scope component rules, and the `:root` blocks bridging global tokens to component ones. |
| `theme`      | The default design tokens. CSS custom property definitions only.                                 |
| `mode`       | Light/dark, high-contrast, and reduced-motion overrides of `theme`.                              |
| `brand`      | Per-deployment branding overrides.                                                               |

`layers.css` is the only place the order is declared. Adding a layer anywhere else creates a second, independent ordering rather than extending this one.

## Assigning a rule to a layer

Layers are applied **only in the entrypoint files**, on the import itself:

```css
/* web/src/styles/interface.global.css */
@import "#styles/layers.css";

@import "#styles/global/vendor/patternfly.css" layer(vendor);
@import "@goauthentik/fonts/faces.css" layer(vendor);
@import "#styles/global/theme/variables.css" layer(theme);
@import "#styles/global/reset/globals.css" layer(reset);
@import "#styles/global/mode/mode.css" layer(mode);
@import "#styles/authentik/components/Placeholder/placeholder.css" layer(components);
```

The three entrypoints — `interface.global.css` (Admin and User), `flows.global.css` (Flow), and `static.global.css` (Django templates) — contain only `@import` statements. Individual stylesheets never wrap themselves in `@layer`, which keeps every precedence decision in one reviewable file per bundle.

Import order still matters *within* a single layer. Across layers it does not: a later layer always wins, regardless of import order or selector specificity.

## Two cascade contexts

authentik has two independent cascades, and layers only govern the first.

**The document.** Driven by the three `.global.css` entrypoints, ordered by the layer stack above.

**Each shadow root.** Every component extending `AKElement` (`web/src/elements/Base.ts`) adopts, in order: `shadow/patternfly-base.css`, the component's own styles, `shadow/authentik-base.css`, and then brand custom CSS. These sheets are unlayered.

The bridge between the two is inheritance. CSS custom properties defined at the document level cross the shadow boundary, so a component reads `--ak-color-primary` without importing anything. What crosses is the *computed* value — whichever declaration won at the document level.

This has a consequence worth internalizing:

> Layers order **selectors**, not properties.

Once a custom property crosses into a shadow root, the layer it was declared in no longer applies. Only its computed value carries over, and a declaration on `:host` inside the shadow root overrides what was inherited. Declare custom properties in consistent "dictionary" containers — `:root` at the document level, `:host` in shadow roots — so their specificity is predictable at the boundary.

## Brand customization

Brands customize appearance two ways, and they land in different places:

- **Custom properties from the database** are injected into the reserved `brand` layer, the last in the order, so they override theme and mode without needing `!important`.
- **A custom CSS file** is adopted per shadow root, after the component's own styles, so it can reach into `::part()` surfaces.

Because the custom CSS path is adopted last within its shadow root rather than being layered, existing `!important` declarations in brand CSS keep working. They are usually unnecessary.

## Adding CSS

- A new document-level component rule goes in `web/src/styles/authentik/components/<Name>/`, imported into the relevant entrypoint with `layer(components)`.
- A new design token goes in `web/src/styles/global/theme/`, which is already imported into `layer(theme)`.
- A light/dark or accessibility override goes in `web/src/styles/global/mode/`.
- Anything vendored from PatternFly goes through `web/src/styles/global/vendor/patternfly.css`.

`web/src/styles/README.md` is the in-repo companion to this page, with the full directory layout and a "what is where" index.

## References

- [MDN: cascade layers](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@layer)
- [MDN: using shadow DOM](https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM)

---

## CSS architecture

authentik's UI is a customized PatternFly 4 system wrapped in Lit web components. Treat PatternFly as a compatibility layer, not the public API to build on: the stable surface is the `--ak-*` token set.

## The pieces

- **`@goauthentik/theme`** owns the design tokens. Token modules are written in TypeScript, compiled by [Styleframe](https://styleframe.dev), and emitted as CSS custom properties plus a [DTCG](https://www.designtokens.org/) document.
- **`@goauthentik/fonts`** ships every typeface and its `@font-face` rules, separately from the tokens because they change on a different cadence. `faces.css` holds the RedHat brand text faces; `icons.css` holds the `pficon` and Font Awesome faces the PatternFly icon classes render glyphs from.
- **`web/src/styles/global/theme/token-bridge.css`** maps the semantic tokens onto the PatternFly variables that existing component CSS already reads.
- **`web/src/styles/`** assembles all of it into the three document bundles and the two per-shadow-root sheets. See [Cascade layers](./cascade-layers.mdx).
- **`web/src/elements/Base.ts`** adopts the shared sheets into every component's shadow root; `web/src/common/stylesheets.ts` centralizes `CSSStyleSheet` creation.

## Token tiers

| Tier            | Prefix                | Stability          | Use                                        |
| --------------- | --------------------- | ------------------ | ------------------------------------------ |
| Primitive       | internal or generated | private            | palette stops, raw scales, build input     |
| Semantic        | `--ak-*`              | public             | custom CSS, component styles, docs         |
| Component-local | `--_*` or `--ak-c-*`  | private by default | implementation detail inside one component |

Semantic names express a design decision, not a raw value:

```css
:root {
    --ak-color-primary: oklch(0.518 0.1725 259.3 / 1); /* #0066cc */
    --ak-color-surface: oklch(1 0 0 / 1); /* #ffffff */
    --ak-space-md: 1rem;
    --ak-radius-sm: 3px;
}
```

Do not promote component property names into the public surface:

```css
/* Avoid */
--ak-c-button-primary-background-color-hover-padding-left: 1rem;
```

## The token pipeline

Tokens are authored as typed modules under `packages/theme/src/tokens/`, one per category. Styleframe evaluates them into a variable tree, and the package build emits several shapes of the same data:

```text
packages/theme/src/tokens/*.ts        typed token modules
  -> Styleframe                       variable tree
  -> dist/index.css                   every token, one file
  -> dist/{color,typography,...}.css  per-category slices
  -> dist/dtcg/tokens.json            DTCG interchange for design tooling
```

Colors are authored as hex and transformed to `oklch()` on the way out, each carrying the original hex in a trailing comment so editors still render a swatch.

DTCG is interchange data for tooling — Figma sync, validation, generated documentation. It is not a runtime format. The browser consumes CSS custom properties; keep runtime styling decoupled from the DTCG document.

## The PatternFly bridge

Most component CSS still reads `--pf-*`. `token-bridge.css` maps the semantic layer onto those names, so existing CSS keeps working while new CSS targets the shorter surface:

```css
:root,
:host {
    --pf-global--primary-color--100: var(--ak-color-primary, var(--pf-global--primary-color--100));
    --pf-global--spacer--md: var(--ak-space-md, var(--pf-global--spacer--md));
}
```

Each PatternFly variable falls back to its own prior value, so the bridge only overrides where a token exists. It is imported in two places — `global/theme/variables.css` for the document, and `shadow/patternfly-base.css` for shadow roots — so both cascades resolve the same way.

## Shadow DOM API

Custom properties are the configuration surface:

```css
ak-flow-executor {
    --ak-color-primary: oklch(62% 0.2 260);
}
```

`::part()` is for exposed structure, and only where a brand can reasonably style that substructure without coupling to internal DOM:

```css
ak-flow-executor::part(locale-select) {
    display: none;
}
```

Slots are for composition, not styling.

## Accessibility defaults

New component CSS should support `color-scheme: light dark`, `accent-color`, `prefers-color-scheme`, `prefers-reduced-motion`, `prefers-contrast`, `forced-colors`, and logical properties for right-to-left layouts.

Prefer semantic tokens that media queries adjust over separate per-variant theme files. Document-level light/dark, contrast, and motion overrides belong in `web/src/styles/global/mode/`.

## Guardrails

- Keep the public semantic set at roughly 30 to 60 names until real user needs justify more.
- Do not expose every CSS property as a public token.
- Do not document `--ak-c-*` as stable unless it is intentionally promoted.
- Do not generate tokens from PatternFly variable names.
- Keep part names short and structural: `control`, `label`, `icon`, `content`, `footer`.
- Keep direct custom CSS injection an advanced escape hatch, not the primary theming API.

## Still to do

- Migrate component markup off PatternFly incrementally, starting where styling is already mostly custom.
- Move component CSS next to the component it styles, rather than under `web/src/styles/authentik/components/`.
- Generate token reference documentation from the DTCG export instead of maintaining the table by hand.
- Offer live previews of token-level brand customization in the product.

## External references

- [Design Tokens Community Group](https://www.designtokens.org/)
- [Design Tokens Format Module](https://www.designtokens.org/tr/2025.10/format/)
- [Styleframe](https://styleframe.dev)
- [PatternFly tokens](https://www.patternfly.org/tokens/about-tokens/)
- [MDN: cascade layers](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@layer)

---

## 2023 hackathon archive

![Participants collaborating during a hackathon](./horizontal-brandon-frie-rdHeGGn7rwQ-unsplash.jpg)

The first authentik community hackathon ran online from July 26 through July 30, 2023. Registration and event activities are closed; this page preserves a summary of the event.

## About the event

Community members worked on authentik code, documentation, and other project improvements. Moderators supported participants across US and European hours, and participants coordinated work through GitHub and Discord.

The event included a $5,000 prize pool, authentik merchandise, and community recognition.

## Schedule

- **Wednesday, July 26**: Kickoff, topic selection, team formation, and development-environment setup.
- **Thursday, July 27**: First hack day and participant check-in.
- **Friday, July 28**: Second hack day and participant check-in.
- **Saturday, July 29**: Project wrap-up and initial demonstrations.
- **Sunday, July 30**: Final demonstrations, voting, and awards.

## Event workspace

Participants developed their contributions in the [authentik GitHub repository](https://github.com/goauthentik/authentik) and coordinated in the community Discord server. The event used GitHub issues to propose projects and indicate community interest.

Prize distributions were subject to applicable local, state, national, and international laws.

---

## Debugging authentik

This page describes how to debug different components of an authentik instance, running either in production or in a development setup. To learn more about the structure of authentik, refer to our [architecture documentation](../../core/architecture.mdx).

## authentik Server & Worker (Python)

The majority of the authentik codebase is in Python, running in Gunicorn for the server and Dramatiq for the worker. These instructions show how this code can be debugged or inspected. The local debugging setup requires the setup described in [Full development environment](./full-dev-environment.mdx).

Note that authentik uses [debugpy](https://github.com/microsoft/debugpy), which relies on the "Debug Adapter Protocol" (DAP). These instructions demonstrate debugging using [Visual Studio Code](https://code.visualstudio.com/), however they should be adaptable to other editors that support DAP.

To enable the debugging server, set the environment variable `AUTHENTIK_DEBUGGER` to `true`. This will launch the debugging server (by default on port *9901*).

With this setup in place, you can set Breakpoints in VS Code. To connect to the debugging server, run the command `> Debug: Start Debugging` in VS Code.

![](./debug_vscode.png)

Note that due to the Python debugger for VS Code, when a Python file in authentik is saved and the Django process restarts, you must manually reconnect the Debug session. Automatic re-connection is not supported for the Python debugger (see VS Code Python issues [#19998](https://github.com/microsoft/vscode-python/issues/19998) and [#1182](https://github.com/microsoft/vscode-python/issues/1182)).

#### Debug the server or the worker

The server and each worker process run their own debug server on a distinct port, derived from the base port set by `AUTHENTIK_LISTEN__DEBUG_PY` (`9901` by default):

- The **server** (Gunicorn) listens on the base port (`9901`).
- The **worker** runs as one or more processes, controlled by `AUTHENTIK_WORKER__PROCESSES` (defaults to `1`). Each worker process listens on the base port plus an offset, starting at `9902` for the first process, `9903` for the second, and so on.

In VS Code, use the **Debug: Attach Server Core** launch configuration to attach to the server and **Debug: Attach Worker** to attach to the first worker process. To debug additional worker processes, duplicate the worker configuration and change its port to match (`9903`, `9904`, …).

#### Debugging in containers

When debugging an authentik instance running in containers, there are some additional steps that need to be taken in addition to the steps above.

A local clone of the authentik repository is required to set breakpoints in the code. The locally checked out repository must be on the same version/commit as the authentik version running in the containers. To check out version 2024.12.3, for example, run `git checkout version/2024.12.3`.

The debug port needs to be accessible on the local machine. By default, this is port 9901 for the server; the worker uses `9902` and up (one port per worker process). Additionally, the container being debugged must be started as `root`, because additional dependencies need to be installed on startup.

When running in Docker Compose, a file `compose.override.yml` can be created next to the authentik `compose.yml` file to expose the port, change the user, and enable debug mode.

```yaml
services:
    # To debug the worker container instead, use the `worker` service and map
    # its worker ports (`9902` and up) rather than `9901`.
    server:
        user: root
        healthcheck:
            disable: true
        environment:
            AUTHENTIK_DEBUGGER: "true"
            AUTHENTIK_LOG_LEVEL: "debug"
        ports:
            - 9901:9901
```

After re-creating the containers with `AUTHENTIK_DEBUGGER` set to `true` and the port mapped, the steps are identical to the steps above.

If the authentik instance is running on a remote server, the `.vscode/launch.json` file needs to be adjusted to point to the IP of the remote server. Alternatively, you can forward the debug port via an SSH tunnel, using `-L 9901:127.0.0.1:9901`.

## authentik Server / Outposts (Golang)

Outposts, as well as some auxiliary code of the authentik server, are written in Go. These components can be debugged using standard Golang tooling, such as [Delve](https://github.com/go-delve/delve).

---

## Frontend development environment

If you're focusing solely on frontend development, you can create a minimal development environment using Docker and Node.js. This setup allows you to make and preview changes to the frontend in real-time, without needing to interact with the backend.

### Prerequisites

- [Node.js](https://nodejs.org/en) (24 or later), installed with [nvm](https://github.com/nvm-sh/nvm)
- [pnpm](https://pnpm.io/installation) (11.20 or later), the package manager used by the `web` workspace
- [Docker](https://www.docker.com/) (Latest Community Edition or Docker Desktop)
- [Docker Compose](https://docs.docker.com/compose/) (Compose v2)
- [Make](https://www.gnu.org/software/make/) (3 or later)

Install Node.js with [nvm](https://github.com/nvm-sh/nvm), one of the version managers recommended on the Node.js download page, then install pnpm by following the [pnpm installation guide](https://pnpm.io/installation):

```shell
nvm install 24
nvm use 24
```

Any recent pnpm works: on each run it automatically switches to the version pinned in `package.json`.

### Instructions

1. Clone the Git repo to your development machine and navigate to the authentik directory.

   ```shell
   git clone https://github.com/goauthentik/authentik
   cd authentik
   ```

2. Run the following to create a `.env` file in the `lifecycle/container` directory of the repository to configure the Docker Compose environment.

   ```shell
   echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> ./lifecycle/container/.env
   echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> ./lifecycle/container/.env
   echo "AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server" >> ./lifecycle/container/.env
   echo "AUTHENTIK_TAG=gh-next" >> ./lifecycle/container/.env
   echo "AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-next" >> ./lifecycle/container/.env
   echo "AUTHENTIK_LOG_LEVEL=debug" >> ./lifecycle/container/.env
   echo 'GIT_BUILD_HASH="dev"' >> ./lifecycle/container/.env
   ```

3. Create a Docker Compose override file (`compose.override.yml`) in the root of the repository. This will override the volume configurations for the local configuration file (`local.env.yml`) and mount the directory for the frontend code (`web`) into the docker containers. Docker will automatically mount the web files generated by the build process. The `local.env.yml` mount is optional, but allows you to override the default configuration.

   ```yaml title="compose.override.yml"
   services:
       server:
           volumes:
               - ${PWD}/web:/web
               - ${PWD}/local.env.yml:/local.env.yml
   ```

4. From the repository root, run the frontend build script. This will install the packages needed to run the frontend project and start the project in watch mode.

   ```shell
   make node-install
   make web-watch
   ```

   In this repository, pnpm is configured to not run a dependency's `preinstall`/`install`/`postinstall` lifecycle scripts unless that package is explicitly allow-listed. This neutralizes a dominant supply-chain attack pattern at the cost of skipping a few legitimate native-binary unpacks.

Each workspace keeps its allow-list in its own `pnpm-workspace.yaml`: `onlyBuiltDependencies` lists the packages whose scripts may run, and `allowBuilds` records an explicit `true`/`false` for each one so pnpm doesn't prompt for approval at install time.

If a build fails because a package needs its install script (commonly `esbuild`, `chromedriver`, `tree-sitter`, or `tree-sitter-json`), add it to both lists in the relevant `pnpm-workspace.yaml`, then rebuild just that package:

```shell
pnpm rebuild esbuild
```

Allow-listing a package grants it arbitrary code execution during install, so treat any addition as a change that needs review.

5. In a new terminal, navigate to the cloned repository root and start the backend containers with Docker Compose.

   ```shell
   docker compose -f lifecycle/container/compose.yml -f compose.override.yml up -d
   ```

You can now access authentik on [http://localhost:9000](http://localhost:9000) (or [https://localhost:9443](https://localhost:9443)).

---

## Full development environment

## Prerequisites

Before you begin, ensure you have the following tools installed. You can run the [provided script](#3-installing-platform-specific-dependencies) below in **Installing platform-specific dependencies** to install these required tools.

- [Python](https://www.python.org/) (3.14)
- [uv](https://docs.astral.sh/uv/getting-started/installation/) (Latest stable release)
- [Rust](https://rust-lang.org/learn/get-started/) (We provide a `rust-toolchain.toml` file for the correct version, and we use the nightly toolchain to run formatting with rustfmt.)
- [Go](https://go.dev/) (1.26 or later)
- [Node.js](https://nodejs.org/en) (24 or later), installed with [nvm](https://github.com/nvm-sh/nvm)
- [pnpm](https://pnpm.io/installation) (11.20 or later), the package manager used across every JavaScript workspace in the repository
- [PostgreSQL](https://www.postgresql.org/) (16 or later)
- [Docker](https://www.docker.com/) (Latest Community Edition or Docker Desktop)
- [Docker Compose](https://docs.docker.com/compose/) (Compose v2)
- [Make](https://www.gnu.org/software/make/) (3 or later)
- [CMake](https://cmake.org/) (Latest stable release)

### Understanding the architecture

authentik is primarily a Django application running under gunicorn, proxied by a Go application that serves static files. Most functions and classes have type hints and docstrings. For better code navigation, we recommend installing a Python type-checking extension in your IDE.

## 1. Prepare your local working repository

Verify that you have a local working repository of authentik and that it is initialized and up-to-date with the [authentik repository](https://github.com/goauthentik/authentik).

Unless otherwise specified, all commands described below should be run from the project root of your local authentik repository.

## 2. Set up required services

authentik depends on several external services:

- [PostgreSQL](https://www.postgresql.org/) for database storage
- [Zenko CloudServer (S3)](https://www.zenko.io/cloudserver/) for object storage
- [Sentry Spotlight](https://spotlightjs.com/) for error tracking and visualization

The easiest way to set up these services is using the provided Docker Compose configuration:

```shell
docker compose -f scripts/compose.yml up -d
```

## 3. Installing platform-specific dependencies

Install the required native dependencies on macOS using Homebrew. You can edit the following command if you already have some of these and want to skip installing them again, or run `brew install --dry-run` to preview the changes:

```shell
brew install \
libxmlsec1 \
libpq \
pkg-config \
uv \
postgresql \
golangci-lint \
krb5 \
cmake
```

For Debian/Ubuntu-based distributions (you can edit the following command if you already have some of these and want to skip installing them again):

```shell
pip install uv
sudo apt-get install -y \
libgss-dev \
krb5-config \
libkrb5-dev \
libxml2 \
libxslt1-dev \
libxmlsec1 \
xmlsec1 \
postgresql-server-dev-all \
postgresql \
cmake
```

For other distributions (Red Hat, SUSE, Arch), adjust the package names as needed.

Install `golangci-lint` by following the [official installation instructions](https://golangci-lint.run/welcome/install/#other-ci).

We're currently seeking community input on running the full development environment on Windows. If you have experience with this setup, please consider contributing to this documentation.

[aws-lc-rs](https://github.com/aws/aws-lc-rs) currently has an [issue](https://github.com/aws/aws-lc-rs/issues/569) building its FIPS module with GCC >= 14. If you encounter this issue, you have two options:

- Use an older version of GCC.
- Install [Clang](https://clang.llvm.org) and `export AWS_LC_FIPS_SYS_CC=clang`.

### Installing Node.js and pnpm

Install Node.js with [nvm](https://github.com/nvm-sh/nvm), one of the version managers recommended on the Node.js download page. It keeps the toolchain scoped to your shell rather than installed system-wide, so switching versions between projects doesn't require reinstalling:

```shell
nvm install 24
nvm use 24
```

Then install pnpm by following the [pnpm installation guide](https://pnpm.io/installation). Any recent pnpm works: on each run it automatically switches to the version pinned in `package.json`.

nvm runs on macOS and Linux; on Windows, use [nvm-windows](https://github.com/coreybutler/nvm-windows), a separate project with its own command set.

## 4. Set up the backend

All `make` commands must be executed from the root directory of your local authentik Git repository.

### Install dependencies

Install all required JavaScript and Python dependencies and create an isolated Python environment:

```shell
make install
```

In this repository, pnpm is configured to not run a dependency's `preinstall`/`install`/`postinstall` lifecycle scripts unless that package is explicitly allow-listed. This neutralizes a dominant supply-chain attack pattern at the cost of skipping a few legitimate native-binary unpacks.

Each workspace keeps its allow-list in its own `pnpm-workspace.yaml`: `onlyBuiltDependencies` lists the packages whose scripts may run, and `allowBuilds` records an explicit `true`/`false` for each one so pnpm doesn't prompt for approval at install time.

If a build fails because a package needs its install script (commonly `esbuild`, `chromedriver`, `tree-sitter`, or `tree-sitter-json`), add it to both lists in the relevant `pnpm-workspace.yaml`, then rebuild just that package:

```shell
pnpm rebuild esbuild
```

Allow-listing a package grants it arbitrary code execution during install, so treat any addition as a change that needs review.

### Generate development configuration

Create a local configuration file that uses the local databases for development:

```shell
make gen-dev-config
```

### Initialize the database

Run all migrations with the following command:

```shell
make migrate
```

If you ever want to start over, use `make dev-reset`, which drops and restores the authentik PostgreSQL database to the state it was in after you ran `make migrate`.

## 5. Running authentik

Now that the backend has been set up and built, you can start authentik. Run the following command from the root of your installation directory:

```shell
make run
```

The very first time authentik runs, it might need some time to clear the initial task queue. Adjust [`AUTHENTIK_WORKER__THREADS`](../../../install-config/configuration/#authentik_worker__threads) as required.

### Hot-reloading

When `AUTHENTIK_DEBUG` is set to `true` (the default for the development environment), the authentik server automatically reloads whenever changes are made to the code.

Install [watchexec](https://github.com/watchexec/watchexec), and run:

```shell
make run-watch
```

## 6. Build the frontend

Even if you're not planning to develop the UI, you need to build the frontend because no compiled bundle is included by default. Run the following command to build the authentik UI:

```shell
make web-build
```

For real-time feedback you can view the UI as you make changes. Run this command and then in your browser go to [http://localhost:9000/](http://localhost:9000/).

```shell
make web-watch
```

## 7. Initial setup

After the frontend build completes, set a password for the default admin user (**akadmin**):

1. Navigate to [http://localhost:9000](http://localhost:9000) in your browser.
2. Follow the prompts to set up your admin account.

From now on, you can access authentik at [http://localhost:9000](http://localhost:9000) using the credentials you defined in Step 2.

## Troubleshooting

### Recovery key

If you can no longer log in or the authentication flow repeats (perhaps due to an incorrectly configured stage or a failed flow import), you can create a recovery key by running this command in your terminal:

`uv run ak create_recovery_key 10 akadmin`

Copy the generated recovery key and paste it into the URL, after the domain. For example:

`http://localhost:9000/recovery/use-token/ChFk2nJKJKJKY9OdIc8yv6RCgpGYp5rdndBhR6qHoHoJoWDdlvLuvU/`

The recovery token is valid for a short time, but anyone can use it to log in as the admin user. Using the recovery token will also disable custom CSS in case you've accidentally locked yourself out of the admin interface with a broken theme.

## End-to-end (E2E) setup

Start the E2E test services with the following command:

```shell
docker compose -f tests/e2e/compose.yml up -d
```

You can then view the Selenium Chrome browser via [http://localhost:7900/](http://localhost:7900/) using the password: `secret`.

Alternatively, you can connect directly via VNC on port `5900` using the password: `secret`.

When using Docker Desktop, host networking needs to be enabled via **Docker Settings** > **Resources** > **Network** > **Enable host networking**.

## Contributing code

### Before submitting a pull request

Ensure your code meets our quality standards by running:

1. **Code linting**:

   ```shell
   make lint-fix
   make lint
   ```

2. **Generate updated API documentation**:

   ```shell
   make gen
   ```

3. **Format frontend code**:

   ```shell
   make web
   ```

4. **Run tests**:

   ```shell
   make test
   ```

You can run all these checks at once with:

```shell
make all
```

### Submit your changes

After your code passes all checks, submit a pull request on [GitHub](https://github.com/goauthentik/authentik/pulls). Be sure to:

- Provide a clear description of your changes
- Reference any related issues
- Update any related documentation
- Follow our code and documentation [style guidelines](../../contributing/#style-guides)
- Include tests for your changes where appropriate

Thank you for contributing to authentik!

---

## Development environment

Pick the setup that fits your workflow: full stack, frontend-only, or just the docs and grab some debugging tips along the way.

---

## Agent CLI commands

The following commands are available when interacting with the authentik Agent via the command line.

Most of the CLI commands have a `-v`/`--verbose` flag for verbose output.
Use the `-h`/`--help` flag to access help information.

## authentik-cli commands

### api

Directly interact with the authentik API, authenticated as the active profile's user.

```bash
ak api <command>
```

The subcommands are generated from the authentik API schema. Run `ak api --help` to list the ones available in your version.

### auth

Commands for authenticating with different CLI applications.

```bash
ak auth <command>
```

- `aws` - Authenticate to AWS with the authentik profile.
- `kubectl` - Authenticate to a Kubernetes Cluster with the authentik profile.
- `raw` - Authenticate to arbitrary API calls.

### completion

Generate the autocompletion script for the specified shell.

```bash
ak completion <command>
```

- `bash` - Generate the autocompletion script for bash.
- `fish` - Generate the autocompletion script for fish.
- `powershell` - Generate the autocompletion script for PowerShell.
- `zsh` - Generate the autocompletion script for zsh.

### config

Configure authentik CLI

```bash
ak config <command>
```

- `list-profiles` - List profiles that are enabled on the device. Each profile is associated with a separate authentik deployment.
- `setup` - Configure authentik CLI.

### help

Output help information about any command.

```bash
ak help <command>
```

Where `<command>` is any authentik CLI command you want help with, for example: `ak help whoami`

### switch-profile

Switch to a different active profile. Can be shortened to `ak s`.

```bash
ak switch-profile <profile>
```

Where `<profile>` is the name of a profile reported by `ak config list-profiles`.

### version

Shows the version of all installed authentik components.

```bash
ak version
```

### whoami

Check user account details for a given profile.

```bash
ak whoami
```

## authentik-sysd commands

### agent

Used to run the authentik system agent

```bash
ak-sysd agent
```

`-d` for debug
`--disable-component` to disable a component, can be used multiple times.

**Components**:

- `agent_starter`: Responsible for starting the authentik user agent
- `auth`: Authentication components for interactive and token-based authentication
- `ctrl`: Provides a control socket for the CLI to join domains, etc
- `device`: Handles device compliance checkins and validations
- `directory`: Provides directory services on linux system
- `ping`: Provides a ping service for healthchecking
- `session`: Handles sessions created with local device authentication/SSH

### completion

Generate the autocompletion script for the specified shell.

```bash
ak-sysd completion <command>
```

- `bash` - Generate the autocompletion script for bash.
- `fish` - Generate the autocompletion script for fish.
- `powershell` - Generate the autocompletion script for powershell.
- `zsh` - Generate the autocompletion script for zsh.

### domains

```bash
ak-sysd domains <command>
```

- `join` - Join an authentik domain, for example `ak-sysd domains join <name_for_authentik_domain> -a <authentik_URL>`

### help

```bash
ak-sysd help <command>
```

Where `<command>` is any authentik CLI command you want help with, for example: `ak-sysd help domains`

### troubleshoot

```bash
ak-sysd troubleshoot <command>
```

- `check` - Check status of authentik agent components. Useful on Linux as there are various components being used.
- `inspect` - Outputs the state database that the agent has.
- `facts` - Outputs device facts. These are the facts that are sent to authentik for device reporting.

---

## Configuration

Before deploying the authentik Agent, configure your authentik deployment. This involves:

- Create and apply an OAuth [Device code flow](../../add-secure-apps/providers/oauth2/device_code.mdx)
- Creating an OAuth application and provider
- Creating a [Connector](../device-compliance/connectors/index.mdx)

## Create and apply an OAuth device code flow

The OAuth device code flow enables secure authentication for input-limited clients like CLI tools and is required for the authentik Agent to function.

If you have already deployed the authentik OAuth device code flow, skip to the [next section](#create-an-application-and-provider-in-authentik-for-cli).

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click **New Flow**.
3. Set the following required configurations:
   - **Name**: provide a name (e.g. `default-device-code-flow`)
   - **Title**: provide a title (e.g. `Device code flow`)
   - **Slug**: provide a slug (e.g `default-device-code-flow`)
   - **Designation**: `Stage Configuration`
   - **Authentication**: `Require authentication`
4. Click **Create**.
5. Navigate to **System** > **Brands** and click the **Edit** icon on the default brand.
6. Set **Device code flow** to the newly created device code flow and click **Update**.

## Create an application and provider in authentik for CLI

The authentik Agent requires an OAuth application/provider pair to handle authentication.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard. Alternatively, you can first create a provider separately, then create the application and connect it to the provider.
   - **Application**: set the **Name** and **Slug** to `authentik-cli`, and provide an optional group for the type of application, the policy engine mode, and optional UI settings.
   - **Choose a Provider Type**: select **OAuth2/OpenID Connect** as the provider type.
   - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
     - Set the **Client Type** to `Public`.
     - Set the **Client ID** to `authentik-cli`.
     - Select any available signing key.
     - Under **Advanced protocol settings**:
       - In addition to the three default **Selected Scopes**, add the `authentik default OAuth Mapping: OpenID 'offline_access'` and `authentik default OAuth Mapping: authentik API access` scopes.
   - **Configure Bindings** *(optional)*: you can create a [binding](../../add-secure-apps/bindings-overview/index.mdx) (policy, group, or user) to manage access to the application.

3. Click **Submit** to save the new application and provider.

## Create the authentik Agent connector

The authentik Agent [Connector](../device-compliance/connectors/authentik-agent.mdx) allows device information to be reported to authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Agent Connector** as the agent type and click **Next**.
4. Configure the following required settings:
   - **Connector name**: provide a descriptive name (e.g. `authentik Agent`)
   - **Refresh interval**: select how often the agent updates its configuration.
   - **Enabled**: toggle to enable the connector.
   - Under **Authentication settings**:
     - **Federated OIDC Providers**: add the `authentik-cli` provider that you created in the previous section.
5. Click **Finish**.

---

## Development

The authentik Agent and associated components are developed in the [authentik Platform GitHub repository](https://github.com/goauthentik/platform). For source code and information on contributing to the project, refer to the documentation included in the GitHub repository.

---

## Download the authentik Agent

The [authentik Agent](./index.mdx) is a service that you install on Linux, macOS, and Windows devices to enable device compliance, local device login, SSH authentication, and CLI application authentication. The downloads on this page always provide the latest release.

## Download for macOS or Windows

Downloading the installer is only the first step. To create an enrollment token, install the package, and join the device to an authentik domain, follow the [macOS](./agent-deployment/macos.mdx) or [Windows](./agent-deployment/windows.mdx) deployment guide. For more than a handful of devices, use [MDM or automated deployment](./agent-deployment/automated.mdx) instead.

## Install on Linux

On Linux, install the authentik Agent from the authentik package repository rather than downloading a file.

1. Open a Terminal session and install the required GPG key:

```sh
curl -fsSL https://pkg.goauthentik.io/keys/gpg-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/authentik-keyring.gpg
```

2. Add the repository:

```sh
echo "deb [signed-by=/usr/share/keyrings/authentik-keyring.gpg] https://pkg.goauthentik.io stable main" | sudo tee /etc/apt/sources.list.d/authentik.list
```

3. Update your repositories and install the authentik Agent packages:

```sh
sudo apt update
sudo apt install authentik-cli authentik-agent authentik-sysd
```

4. *(Optional)* To enable SSH server authentication and local device login, install two additional packages:

```sh
sudo apt install libnss-authentik libpam-authentik
```

1. Open a Terminal session and run the following command to add the authentik repo and associated GPG key:

```bash
# This overwrites any existing configuration in /etc/yum.repos.d/authentik.repo
cat <<EOF | sudo tee /etc/yum.repos.d/authentik.repo
[authentik]
name=authentik
baseurl=https://pkg.goauthentik.io
enabled=1
gpgcheck=1
gpgkey=https://pkg.goauthentik.io/keys/gpg-key.asc
EOF
```

2. Install the authentik Agent packages:

```bash
sudo yum install -y authentik-cli authentik-agent authentik-sysd
```

3. *(Optional)* To enable SSH server authentication and local device login, install two additional packages:

```sh
sudo yum install -y libnss-authentik libpam-authentik
```

To join the device to an authentik domain and configure NSS and PAM, continue with the [Linux deployment guide](./agent-deployment/linux.mdx).

## Verify the installation

Check the version of all installed authentik components by running the following command:

```bash
ak version
```

You should see a response that starts with `authentik CLI v<version_number>`.

## Next steps

- [Configure your authentik deployment](./configuration.mdx) to support the authentik Agent. This is required before a device can enroll.
- Deploy the Agent on [Linux](./agent-deployment/linux.mdx), [macOS](./agent-deployment/macos.mdx), or [Windows](./agent-deployment/windows.mdx).
- Deploy at scale with [MDM and automation tools](./agent-deployment/automated.mdx).
- Review the [release notes](./release-notes/index.mdx) for the latest changes.

---

## authentik Agent

## What is the authentik Agent?

The authentik Agent is a service that can be installed on Linux, macOS, and Windows devices. It provides the following capabilities:

- [Device compliance](../device-compliance/index.mdx) by reporting information about endpoint devices to authentik
- [Local device login](./device-authentication/local-device-login/index.mdx) with authentik credentials
- [Connecting via SSH to endpoint devices](./device-authentication/ssh-authentication.mdx) with authentik credentials
- [Authenticating to CLI applications](./device-authentication/cli-app-authentication/index.mdx) such as kubectl and AWS with authentik credentials

## authentik Agent components

The authentik Agent consists of several components:

| Platform                  | Component                           | Description                                                                                                                                                                                                                               | Dependencies      |
| ------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
| **Linux, macOS, Windows** | `authentik-cli`                     | Provides CLI commands for interacting with `authentik-agent`.                                                                                                                                                                             | `authentik-agent` |
| **Linux, macOS, Windows** | `authentik-agent`                   | Authentication within a users' context, for CLI tools.                                                                                                                                                                                    | `authentik-sysd`  |
| **Linux, macOS, Windows** | `authentik-sysd`                    | Responsible for handling device-level authentication and compliance checks.                                                                                                                                                               | None              |
| **Linux only**            | `libpam-authentik`                  | PAM Module for token-based and interactive authentication via authentik. Used for [SSH authentication](./device-authentication/ssh-authentication.mdx) and [local device login](./device-authentication/local-device-login/index.mdx).    | `authentik-sysd`  |
| **Linux only**            | `libnss-authentik`                  | NSS Module that makes Linux aware of authentik users. All authentik users are visible to Linux but cannot log in unless configured through device access groups. Provides a consistent `uid` and `gid` for users on all endpoint devices. | `authentik-sysd`  |
| **Windows only**          | `Windows Credential Provider` (WCP) | Enables logging in to Windows devices using authentik credentials.                                                                                                                                                                        | `authentik-sysd`  |

## Technical information

All authentik Agent components communicate via gRPC and Unix domain sockets/Windows named pipes.

**Linux**: `/var/run/authentik/sys.sock` and `/var/run/authentik/sys-ctrl.sock`
**macOS**: `/var/run/authentik-sysd.sock` and `/var/run/authentik-sysd-ctrl.sock`
**Windows**: `\\.\pipe\authentik\sysd` and `\\.\pipe\authentik\sysd-ctrl`

- `sys.sock`/`*sysd.sock` for general communication
- `*-ctrl.sock` for domain join

## Important considerations

Sentry reporting is currently enabled by default and cannot be disabled. This will be configurable in a future release.

## Report issues

Please report issues and bugs via the [authentik Platform GitHub repository](https://github.com/goauthentik/platform).

## More information

For more information, refer to each of the topics below:

---

## authentik browser extension

The authentik Endpoint SSO browser extension is required for device compliance functionality, and is currently available via the Chrome Web Store, the Firefox Add-ons site, and the Edge Add-ons site.

The browser extension connects to the [authentik Agent](../authentik-agent/index.mdx). It supplies [device facts](./device-reporting.mdx#device-facts) that [stages](../../add-secure-apps/flows-stages/stages/index.mdx) and [policies](../../customize/policies/index.mdx) can use during execution of authentik [flows](../../add-secure-apps/flows-stages/flow/index.mdx). This enables device compliance functionality such as limiting access to applications based on operating system. See [device compliance policy](./device-compliance-policy.mdx) for more details.

## Deploy the authentik browser extension

1. Open your Chromium-based browser.
2. Go to the [authentik Endpoint SSO browser extension page](https://chromewebstore.google.com/detail/authentik-endpoint-sso/dklfpnaeklldfpmhkbfjbmbnmkfafdma) in the Chrome Web Store.
3. Click **Add to Chrome**.
4. Review the permissions and click **Add extension**.

1) Open your Firefox-based browser.
2) Go to the [authentik Endpoint SSO browser extension page](https://addons.mozilla.org/en-US/firefox/addon/authentik-platform-sso/) on the Firefox Add-ons site.
3) Click **Add to Firefox**.
4) Review the permissions and click **Add** (or **Install**).

1. Open Microsoft Edge.
2. Go to the [authentik Endpoint SSO browser extension page](https://microsoftedge.microsoft.com/addons/detail/authentik-endpoint-sso/mcmjmlcifgadhpeggocghbiainhedbgn) in the Microsoft Edge Web Store.
3. Click **Add to Edge**.
4. Review the permissions and click **Add** (or **Install**).

## Configuration verification

Verify that the extension shows as installed in your extensions list.

---

## Configuration

## Prerequisites

Device compliance functionality requires the following:

- [Configure authentik to support the authentik Agent](../authentik-agent/configuration.mdx).
- [Deploy the authentik Agent on the device](../authentik-agent/agent-deployment/index.mdx).
- [Deploy the authentik browser extension on the endpoint device](./browser-extension.mdx).

## Configuration verification

Verify that the endpoint device is reporting its facts on the [Devices](../manage-devices.mdx) page.

## Use device compliance

Now that the endpoint device is configured, you can create [device compliance policies](./device-compliance-policy.mdx) to control access to applications and more.

---

## Device compliance policy

Device compliance policies are used to limit access to authentik and applications based on [Device Compliance](./index.mdx) information.

Device compliance policies are currently in development and inaccessible. However, similar functionality can be achieved with existing stages and policies.

## Prerequisites

You must have [configured compliance](./configuration.mdx) in authentik and on the endpoint device ([Linux](../../authentik-agent/agent-deployment/linux/#join-the-device-to-an-authentik-domain), [Windows](../../authentik-agent/agent-deployment/windows/#join-the-device-to-an-authentik-domain), [macOS](../../authentik-agent/agent-deployment/macos/#join-the-device-to-an-authentik-domain)).

## Access device facts within a flow

To access device facts within a flow, the flow must include an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). The Endpoint stage fetches device facts via a configured [Connector](./connectors/index.mdx) and adds them to the [Flow context](../../add-secure-apps/flows-stages/flow/context/index.mdx).

The following example shows how to use these facts within an expression policy.

```python
flow_plan = request.context.get("flow_plan") # set a flow_plan object
device = flow_plan.context.get("device") # set a device object
name = device.name # the name of the device
facts = device.cached_facts.data
ak_logger.debug("device facts", facts=facts)
```

## Examples

The following are examples of how device compliance can currently be implemented:

### Only allow authentication via endpoint devices

If your goal is to only allow authentication via endpoint devices, this is achievable by adding an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx) to your authentication flow.

#### Create an Endpoint stage

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages > Flows**.
3. Select the authentication flow that you want to modify.
4. Open the **Stage Bindings** tab and click **New Stage**.
5. Select Endpoint stage as the stage type, click **Next**, and configure the following settings:
   - **Name**: provide a name for the stage
   - **Connector**: select a connector for the stage to fetch device facts from (e.g. `authentik agent`)
   - **Mode**: set to `Device required`
6. Click **Next**.
7. Select the order for the stage. Ensure that this places the Endpoint stage in the flow wherever you want device access to be checked.
8. Click **Finish**.

### Only allow authentication via a specific type of endpoint device

If your goal is to only allow authentication via a specific type of endpoint device, this is achievable by adding an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx) and a [Deny stage](../../add-secure-apps/flows-stages/stages/deny/index.mdx) to your authentication flow.

The following example allows authentication only through Apple devices.

#### Create an Endpoint stage

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages > Flows**.
3. Select the authentication flow that you want to modify.
4. Open the **Stage Bindings** tab and click **New Stage**.
5. Select Endpoint stage as the stage type, click **Next**, and configure the following settings:
   - **Name**: provide a name for the stage
   - **Connector**: select a connector for the stage to fetch device facts from (e.g. `authentik agent`)
   - **Mode**: set to `Device required`
6. Click **Next**.
7. Select the **Order** for the stage. Ensure that this places the Endpoint stage in the flow wherever you want device access to be checked.
8. Click **Finish**.

#### Create a Deny stage

9. On the **Stage Bindings** tab, click **New Stage**.

10. Select **Deny Stage** as the stage type and configure the following settings:
    - **Name**: provide a name for the stage
    - **Deny message**: provide a message explaining why access was denied

11. Click **Next**.

12. Select the **Order** for the stage. Ensure that this number is higher than the Endpoint stage created in the previous section.

13. Click **Finish**.

14. Expand the Deny stage that you just created and click **Create and bind Policy**.

15. Select **Expression policy** as the policy type, click **Next**, and configure the following settings:
    - **Name**: provide a descriptive name for the policy
    - **Expression**:
      ```python
      flow_plan = request.context.get("flow_plan")
      device = flow_plan.context.get("device")
      if device.manufacturer.lower() != "apple":
          return True
      return False
      ```
      Because this is a deny stage, the policy must evaluate true when a requirement is not met.

16. Click **Next** and then click **Finish**.

---

## Device reporting

Endpoint devices registered with authentik through a [connector](./connectors/index.mdx), such as the [authentik Agent](./connectors/authentik-agent.mdx) connector, regularly [check in](#device-check-in) with authentik and report their [device facts](#device-facts).

These facts are shown on the [Devices](../manage-devices.mdx) page and are also accessible to policies and can be used to make policy decisions. See [Device Compliance Policy](./device-compliance-policy.mdx) for more details.

## Device check-in

When a device registered with authentik reports its [device facts](#device-facts), this is called a device check-in. These check-ins occur on a regular configurable schedule and can also be set to occur whenever a device is associated with an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx).

## Device facts

Device facts are informational snippets about a device, such as its operating system, serial number, installed applications, running processes, and more. These facts are supplied to authentik flows via the [authentik browser extension](browser-extension.mdx) to be used in making policy decisions. For example, you can create a policy that only allows endpoint devices that are running a recent OS version to access an application.

The facts are supplied either by `ak-sysd` or other connectors, and the browser extension is only used to associate the device the user is using with the device record in the authentik database.

### Advanced device facts&#x20;

This feature is still in development and will be announced soon.

## Example facts

See [example facts from a Linux device](./facts-linux.json).

## Endpoint devices in event logs

Authentication events involving endpoint devices are included in the [event logs](../../sys-mgmt/events/logging-events.mdx). For example:

![Example of device authentication event](device-event-example.png)

### Search for an endpoint device in the event logs&#x20;

To search for event logs matching a specific endpoint device:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Events** > **Logs**.
3. In the search bar, enter: `context.device.name = "<device_name>"`

For more information on searching the events logs, see [Logging events](../../sys-mgmt/events/logging-events.mdx).

---

## Fleet conditional access for Apple devices

authentik can be configured to restrict access to specific services so that only Fleet-registered Apple devices are allowed.

authentik automatically retrieves the Conditional Access Root CA certificate from Fleet via the Fleet connector. The Endpoint stage then verifies the device’s Fleet-issued certificate against this Root CA. If validation succeeds, the device is bound to the user’s current authentik session.

## Prerequisites

- You must have [configured compliance](./configuration.mdx) in authentik
- The [Fleet connector](./connectors/fleetdm.mdx) must be configured in authentik
- Conditional access Root CA Certificate must be pulled from Fleet via the Fleet connector. This is an automatic process
- A Fleet Enterprise license is required

## Configure Fleet and devices

Apply a Fleet Conditional Access configuration profile to every device that requires conditional access. This works only on iOS and iPadOS devices enrolled through Apple Automated Device Enrollment (ADE). The same limitation does not apply to macOS devices.

1. Log in to your Fleet dashboard as an administrator.
2. Navigate to **Settings** > **Integrations** > **Conditional Access**.
3. Next to **Okta**, click **Connect**. Despite being named **Okta**, the same profile is used for all integrations.
4. Click the copy button to the right of **User scope profile**.
5. Save the text as a `.mobileconfig` file. Apply it as a Fleet configuration profile on any Apple device that you wish to apply conditional access to.
   Refer to the [Fleet Custom OS settings documentation](https://fleetdm.com/guides/custom-os-settings) for more information on applying configuration profiles.

## Configure authentik

This configuration applies to a specific flow, such as an authentication flow.

### Bind Endpoint stage to flow

The flow must have an [Endpoint stage](../../add-secure-apps/flows-stages/stages/endpoint/index.mdx) bound to it.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages > Flows**.
3. Select the flow that you want to modify.
4. Open the **Stage Bindings** tab and click **Create and bind stage**.
5. Select **Endpoint Stage** as the stage type, click **Next**, and configure the following settings:
   - **Name**: provide a name for the stage
   - **Connector**: select the Fleet connector
   - **Mode**: set to `Device required`
6. Click **Next**.
7. Select the order for the stage. Ensure that this places the Endpoint stage in the flow wherever you want device access to be checked.
8. Click **Finish**.

---

## Device Compliance

Device compliance lets authentik verify that a user's device meets security and configuration criteria, such as operating system version, disk encryption, antivirus status etc, before allowing access to resources.

Device compliance is currently in very early preview. Device compliance policies are currently inaccessible and therefore have to be emulated with existing policies.

For more information, pick a topic below:

---

## Configuration

This page details all the authentik configuration options that you can set via environment variables.

## About authentik configurations

The double-underscores are intentional, as all these settings are translated to YAML internally, and a double-underscore indicates the next level (a subsetting).

All of these variables can be set to values, but you can also use a URI-like format to load values from other places:

- `env://<name>` Loads the value from the environment variable `<name>`. Fallback can be optionally set like `env://<name>?<default>`
- `file://<name>` Loads the value from the file `<name>`. Fallback can be optionally set like `file://<name>?<default>`

## Set your environment variables

  
    If you are using Docker Compose, edit your <code>.env</code> file to append any keys that you want to add, and then run the following command to apply them:

    ```
    docker compose up -d
    ```

  
  
    If you are running in Kubernetes, edit your <code>values.yaml</code> file to append any keys that you want to add, and then run the following commands to apply:

    ```
    helm repo update
    helm upgrade --install authentik authentik/authentik -f values.yaml
    ```

  

## Verify your configuration settings

To check if your config has been applied correctly, you can run the following command to output the full config:

  

    ```
    docker compose run --rm worker ak dump_config
    ```

  
  

    ```
    kubectl exec -it deployment/authentik-worker -c worker -- ak dump_config
    ```

  

## PostgreSQL settings

authentik requires PostgreSQL for application data, configuration, sessions, and background task coordination. authentik supports PostgreSQL 14 - 18.

Use the settings in this section to configure:

- the primary PostgreSQL connection
- TLS/SSL settings for PostgreSQL
- connection behavior and pooler compatibility
- optional read replicas

For more information, see the PostgreSQL upgrade guides for [Docker Compose](../../troubleshooting/postgres/upgrade_docker.mdx) and [Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.mdx). For backup guidance, see [Backup and restore](../../sys-mgmt/ops/backup-restore.mdx).

### Connection settings

These settings define the primary database connection used for writes and reads, unless you've set up read replicas.

- `AUTHENTIK_POSTGRESQL__HOST`

    Hostname or IP address of the PostgreSQL server.

- `AUTHENTIK_POSTGRESQL__PORT`

    Port on which PostgreSQL is listening.

    Default: `5432`

- `AUTHENTIK_POSTGRESQL__USER`

    PostgreSQL username used by authentik to authenticate.

- `AUTHENTIK_POSTGRESQL__PASSWORD`

    PostgreSQL password used by authentik to authenticate.

    If unset, authentik falls back to `POSTGRES_PASSWORD`. This fallback exists for the default Docker Compose setup and should not be relied on in more complex deployments.

- `AUTHENTIK_POSTGRESQL__NAME`

    Name of the PostgreSQL database to use.

The `AUTHENTIK_POSTGRESQL__HOST`, `AUTHENTIK_POSTGRESQL__PORT`, `AUTHENTIK_POSTGRESQL__USER`, and `AUTHENTIK_POSTGRESQL__PASSWORD` settings support hot-reloading and can be changed without restarting authentik. However, adding or removing read replicas requires a restart.

### TLS/SSL settings

Use these settings when your PostgreSQL server requires TLS/SSL or mutual TLS.

- `AUTHENTIK_POSTGRESQL__SSLMODE`

    Controls how TLS/SSL is used and verified for PostgreSQL connections.

    Default: `verify-ca`
    - `disable`: No SSL is used.
    - `allow`: Use SSL if available, but don't perform verification.
    - `prefer`: Attempt an SSL connection first, fall back to non-SSL if it fails.
    - `require`: Require an SSL connection, but without certificate verification.
    - `verify-ca`: Require SSL and verify that the server certificate is signed by a trusted CA.
    - `verify-full`: Require SSL, verify the CA, and verify that the server hostname matches the certificate.

- `AUTHENTIK_POSTGRESQL__SSLROOTCERT`

    Path to the CA certificate file used to verify the PostgreSQL server certificate.

    Required for `verify-ca` and `verify-full` modes.

- `AUTHENTIK_POSTGRESQL__SSLCERT`

    Path to the client certificate file.

    Required only if PostgreSQL is configured for mutual TLS and requires client certificates.

- `AUTHENTIK_POSTGRESQL__SSLKEY`

    Path to the private key corresponding to `AUTHENTIK_POSTGRESQL__SSLCERT`.

For more detail, see [Django's PostgreSQL documentation](https://docs.djangoproject.com/en/stable/ref/databases/#postgresql-connection-settings) and the [PostgreSQL `libpq` SSL documentation](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-PROTECTION).

### Connection management

These settings control connection persistence and behavior, which is particularly important when using a connection pooler like PgBouncer or Pgpool.

- `AUTHENTIK_POSTGRESQL__CONN_MAX_AGE`

    Maximum age of a database connection in seconds.
    - `0` (default): Connections are closed after each request.
    - greater than `0`: Enables persistent connections, with the value defining the maximum lifetime.
    - `None`: Unlimited persistence. Use with caution, especially with connection poolers.

    In session pool mode, if the pooler drops its backend connection while the client connection remains open, the connection may not be released as expected. See [Django's documentation on persistent connections](https://docs.djangoproject.com/en/stable/ref/databases/#persistent-connections).

- `AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS`

    Enables health checks on persistent connections before reuse.

    Default: `false`

    This helps avoid errors caused by stale connections that were closed by PostgreSQL, a proxy, or a connection pooler. See [Django's documentation](https://docs.djangoproject.com/en/stable/ref/settings/#conn-health-checks).

- `AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS`

    Disables server-side cursors.

    Default: `false`

    Set this to `true` when using transaction-based pooling, or when you encounter cursor-related errors behind a pooler. Server-side cursors maintain state across queries and are not compatible with transaction pooling. See [Django's documentation](https://docs.djangoproject.com/en/stable/ref/databases/#transaction-pooling-and-server-side-cursors).

### Advanced Settings

- `AUTHENTIK_POSTGRESQL__DEFAULT_SCHEMA`

    The name of the database schema for authentik to use. Defaults to `public`.

    This can only be set before authentik starts for the first time. If you use a custom schema:
    - the schema must already exist
    - the PostgreSQL user must have permission to use it
    - the user's `search_path` must include that schema

- `AUTHENTIK_POSTGRESQL__CONN_OPTIONS`

    Deprecated as of version 2026.5 and will be removed in a future version. If you rely on a specific parameter, open an issue so we can discuss an alternative.

    Additional `libpq` connection parameters for the primary database connection.

    A list of supported parameter keywords can be found in the [PostgreSQL documentation](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS).
    - Parameters passed with this setting will override those passed with other settings.
    - These parameters are not applied to read replicas.
    - The value must be a base64-encoded JSON dictionary.

### Read replicas

You can configure additional read replica databases to distribute database load and improve performance. When read replicas are configured, authentik automatically routes query operations between the primary database (for writes) and read replica databases (for queries).

By default, the primary database won't be used for queries when read replicas are available. If you want the primary database to also handle queries, add it as a read replica.

Each replica uses the same setting structure as the primary connection, but under `READ_REPLICAS`.

For the first replica, use index `0`:

- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__HOST`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__NAME`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__USER`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PORT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__PASSWORD`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLMODE`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLROOTCERT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLCERT`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__SSLKEY`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__CONN_MAX_AGE`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__CONN_HEALTH_CHECKS`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__DISABLE_SERVER_SIDE_CURSORS`
- `AUTHENTIK_POSTGRESQL__READ_REPLICAS__0__CONN_OPTIONS` (deprecated, see above)

Use index `1`, `2`, and so on for additional replicas.

- `AUTHENTIK_POSTGRESQL__REPLICA_CONN_OPTIONS`

    Deprecated as of version 2026.5 and will be removed in a future version. If you rely on a specific parameter, open an issue so we can discuss an alternative.

    Additional `libpq` connection parameters for all read replica connections.

    A list of supported keywords can be found in the [PostgreSQL documentation](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS).
    - Parameters passed with this setting will override those passed with other settings.
    - The value must be a base64-encoded JSON dictionary.

### Use a PostgreSQL connection pooler {#using-a-postgresql-connection-pooler}

If authentik connects through a pooler such as PgBouncer or Pgpool, review these settings carefully:

- `AUTHENTIK_POSTGRESQL__CONN_MAX_AGE`

    Session-based pooling can behave poorly with unlimited persistent connections (`null`). If the pooler drops its backend connection while the client connection remains open, the connection may not be released as expected.

    To avoid this, either:
    - use transaction pooling, or
    - set `CONN_MAX_AGE` lower than the timeout that causes backend connections to be dropped, including `0` to disable persistent connections

- `AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS`

    When using transaction pooling, set this to `true`. Server-side cursors keep state across queries and will break when subsequent queries are sent over different backend connections.

#### Session-scoped operations and transaction-mode poolers

Some authentik subsystems need to keep state alive on a single PostgreSQL backend connection across multiple statements:

- The Django Channels Postgres layer issues `LISTEN channels_messages` on a long-lived connection.
- The dramatiq worker issues `LISTEN authentik.tasks.<queue>.enqueue` and uses session-scoped `pg_advisory_lock(<message-lock-id>)` / `pg_advisory_unlock(<message-lock-id>)` to coordinate message consumption.
- The startup migration script holds `pg_advisory_lock(1000)` across the entire migrate + system-check pass.

A transaction-pooling pooler (PgBouncer in `pool_mode = transaction`, Cloud SQL's managed connection pooling, etc.) returns the backend to the pool at every `COMMIT`, which breaks all of the above. The pooler may also rewrite which physical backend handles the next statement, so the registered `LISTEN` channel disappears and any session-scoped advisory locks become unreachable.

To run the bulk of ORM traffic through a transaction-pooling pooler while keeping the LISTEN/NOTIFY and advisory-lock paths working, configure a second endpoint that points either directly at PostgreSQL or at a session-mode pooler:

- `AUTHENTIK_POSTGRESQL__DIRECT__HOST`
- `AUTHENTIK_POSTGRESQL__DIRECT__PORT`
- `AUTHENTIK_POSTGRESQL__DIRECT__NAME`
- `AUTHENTIK_POSTGRESQL__DIRECT__USER`
- `AUTHENTIK_POSTGRESQL__DIRECT__PASSWORD`
- `AUTHENTIK_POSTGRESQL__DIRECT__SSLMODE`
- `AUTHENTIK_POSTGRESQL__DIRECT__SSLROOTCERT`
- `AUTHENTIK_POSTGRESQL__DIRECT__SSLCERT`
- `AUTHENTIK_POSTGRESQL__DIRECT__SSLKEY`
- `AUTHENTIK_POSTGRESQL__DIRECT__CONN_OPTIONS` (deprecated, see above)

Any setting left unset falls back to the corresponding top-level `AUTHENTIK_POSTGRESQL__*` value, so the common case of "same database, different endpoint" only requires `AUTHENTIK_POSTGRESQL__DIRECT__HOST` (and optionally `AUTHENTIK_POSTGRESQL__DIRECT__PORT`).

When any of these are set, authentik:

- Adds a Django database alias named `direct` that points at this endpoint. The alias is automatically excluded from the read-replica pool and from migrations — the underlying database is migrated through the `default` endpoint.
- Routes the Channels Postgres layer's connection pool and its LISTEN connection through the `direct` alias.
- Routes the dramatiq worker's `_listen_connection` and `_locks_connection` through the `direct` alias. The main task-table ORM queries (enqueue, status updates) continue to use the `default` alias.
- Opens the startup migration advisory-lock connection against the direct endpoint.

If `AUTHENTIK_POSTGRESQL__DIRECT__*` is not set, all of these connections share the same endpoint as the rest of ORM traffic, and putting a transaction-pool pooler in front of `AUTHENTIK_POSTGRESQL__HOST` will silently break LISTEN/NOTIFY and the dramatiq advisory locks.

### Recommended starting points

These are good starting points for common deployments:

- Direct PostgreSQL connection:
    - leave `AUTHENTIK_POSTGRESQL__CONN_MAX_AGE` as `0`
    - leave `AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS` as `false`
- PgBouncer or Pgpool in transaction mode:
    - set `AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS=true`
    - keep `AUTHENTIK_POSTGRESQL__CONN_MAX_AGE=0` unless you have a reason to change it
    - configure `AUTHENTIK_POSTGRESQL__DIRECT__HOST` (and `AUTHENTIK_POSTGRESQL__DIRECT__PORT` if needed) to point either directly at PostgreSQL or at a session-mode pooler endpoint, so the channel layer, worker LISTEN connection, and migration advisory lock keep working
- Cloud SQL with managed connection pooling:
    - the managed pooler is PgBouncer in transaction mode, so all of the above applies
    - point `AUTHENTIK_POSTGRESQL__HOST` at the pooled endpoint
    - point `AUTHENTIK_POSTGRESQL__DIRECT__HOST` at Cloud SQL's direct endpoint (the one that bypasses the pooler)
- TLS-secured PostgreSQL:
    - keep `AUTHENTIK_POSTGRESQL__SSLMODE=verify-ca` or use `verify-full` if hostname verification is available

### Deprecated Settings

- `AUTHENTIK_POSTGRESQL__USE_PGBOUNCER`

    Deprecated. Use the settings described in [Using a PostgreSQL Connection Pooler](#using-a-postgresql-connection-pooler) instead.

- `AUTHENTIK_POSTGRESQL__USE_PGPOOL`

    Deprecated. Use the settings described in [Using a PostgreSQL Connection Pooler](#using-a-postgresql-connection-pooler) instead.

## Cache settings

##### `AUTHENTIK_CACHE__TIMEOUT`

Timeout for cached data until it expires in seconds.

Defaults to `300`.

##### `AUTHENTIK_CACHE__TIMEOUT_FLOWS`

Timeout for cached flow plans until they expire in seconds.

Defaults to `300`.

##### `AUTHENTIK_CACHE__TIMEOUT_POLICIES`

Timeout for cached policies until they expire in seconds.

Defaults to `300`.

## Worker settings

##### `AUTHENTIK_WORKER__PROCESSES`

Configure how many worker processes should be started for Dramatiq to use. In environments where scaling with multiple replicas of the authentik worker is not possible, this number can be increased to handle higher loads.

Defaults to 1. In environments where scaling with multiple replicas of the authentik worker is not possible, this number can be increased to handle higher loads.

##### `AUTHENTIK_WORKER__THREADS`

Configure how many Dramatiq threads are started per worker. In environments where scaling with multiple replicas of the authentik worker is not possible, this number can be increased to handle higher loads.

Defaults to 2. A value below 2 threads is not recommended, unless you have multiple worker replicas.

##### `AUTHENTIK_WORKER__CONSUMER_LISTEN_TIMEOUT`

Configure how long a worker waits for a PostgreSQL `LISTEN` notification.

Defaults to `seconds=30`.

##### `AUTHENTIK_WORKER__TASK_MAX_RETRIES`

Configure how many times a failing task will be retried before abandoning.

Defaults to 5.

##### `AUTHENTIK_WORKER__TASK_DEFAULT_TIME_LIMIT`

Configure the default duration a task can run for before it is aborted. Some tasks will override this setting based on other settings, such as LDAP source synchronization tasks.

Defaults to `minutes=10`.

##### `AUTHENTIK_WORKER__TASK_PURGE_INTERVAL`

Configure the interval at which old tasks are cleaned up.

Defaults to `days=1`.

##### `AUTHENTIK_WORKER__TASK_EXPIRATION`

Configure how long tasks are kept in the database before they are deleted.

Defaults to `days=30`.

##### `AUTHENTIK_WORKER__SCHEDULER_INTERVAL`

Configure how often the task scheduler runs.

Defaults to `seconds=60`.

## Listen Settings

##### `AUTHENTIK_LISTEN__HTTP`

List of comma-separated `address:port` values for HTTP.

Applies to the Server, the Worker, and Proxy outposts.

Set to an empty value to disable the HTTP listener.

Defaults to `[::]:9000`.

##### `AUTHENTIK_LISTEN__HTTPS`

List of comma-separated `address:port` values for HTTPS.

Applies to the Server and Proxy outposts.

Set to an empty value to disable the HTTPS listener.

Defaults to `[::]:9443`.

##### `AUTHENTIK_LISTEN__LDAP`

List of comma-separated `address:port` values for LDAP.

Applies to LDAP outposts.

Defaults to `[::]:3389`.

##### `AUTHENTIK_LISTEN__LDAPS`

List of comma-separated `address:port` values for LDAPS.

Applies to LDAP outposts.

Defaults to `[::]:6636`.

##### `AUTHENTIK_LISTEN__RADIUS`

List of comma-separated `address:port` values for RADIUS.

Applies to RADIUS outposts.

Defaults to `[::]:1812`.

##### `AUTHENTIK_LISTEN__METRICS`

List of comma-separated `address:port` values for Prometheus metrics.

Applies to all.

Set to an empty value to disable the metrics listener.

Defaults to `[::]:9300`.

##### `AUTHENTIK_LISTEN__DEBUG`

Listening address:port for Go debugging metrics.

Applies to the LDAP, RADIUS, and RAC outposts, which are the remaining Go components.

Defaults to `0.0.0.0:9900`.

##### `AUTHENTIK_LISTEN__DEBUG_PY`

Base listening address:port for the Python debugging server, see [Debugging](../../developer-docs/setup/debugging.mdx).

Applies to the Server and the Worker. The Server listens on this exact port; each Worker process listens on a successive port (`9902`, `9903`, …).

Defaults to `0.0.0.0:9901`.

##### `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`

List of comma-separated CIDRs that proxy headers should be accepted from.

Applies to the Server.

Requests directly coming from one an address within a CIDR specified here are able to set proxy headers, such as `X-Forwarded-For`. Requests coming from other addresses will not be able to set these headers.

Defaults to `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `fe80::/10`, `::1/128`.

## Storage settings

These settings affect where files are stored. By default, they are stored on disk in the `/data` directory of the authentik container. S3 storage is also supported.

#### `AUTHENTIK_STORAGE__BACKEND`

This parameter defines where to store files. Valid values are `file` and `s3`. For `file` storage, files are stored in a `/data` directory in the container. For `s3`, see below.

Defaults to `file`.

### File storage backend settings

See [File storage requirements](../../customize/files.mdx#storage-requirements) before enabling local uploads.

#### `AUTHENTIK_STORAGE__FILE__PATH`

Where to store files on disk.

Defaults to `/data`.

#### `AUTHENTIK_STORAGE__FILE__URL_EXPIRY`

How long generated URLs for file access are valid for.

Defaults to `minutes=15`.

### S3 storage backend settings

For more information on S3 storage, see [S3-compatible storage](../../sys-mgmt/ops/storage-s3/index.mdx).

#### `AUTHENTIK_STORAGE__S3__REGION`

S3 region where the bucket has been created. May be omitted depending on which S3 provider you use.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__ENDPOINT`

Endpoint to use to talk to the S3 storage provider. Overrides the previous region and use_ssl settings.

Must be a valid URL in the form of `https://s3.provider`.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__USE_SSL`

Whether to use HTTPS when talking to the S3 storage providers.

Defaults to `true`.

#### `AUTHENTIK_STORAGE__S3__ADDRESSING_STYLE`

Configure the addressing style used to address a bucket.

Valid values are `auto` and `path`.

Defaults to `auto`.

#### `AUTHENTIK_STORAGE__S3__SIGNATURE_VERSION`

Configure the signing method used for S3 requests.

Defaults to `s3v4`.

Set to `s3` for legacy S3-compatible providers that do not support signature v4.

#### `AUTHENTIK_STORAGE__S3__SESSION_PROFILE`

Profile to use when using AWS SDK authentication.

Supports hot-reloading.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__ACCESS_KEY`

Access key to authenticate to S3. May be omitted if using AWS SDK authentication.

Supports hot-reloading.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__SECRET_KEY`

Secret key to authenticate to S3. May be omitted if using AWS SDK authentication.

Supports hot-reloading.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__SECURITY_TOKEN`

Security token to authenticate to S3. May be omitted.

Supports hot-reloading.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__BUCKET_NAME`

Name of the bucket to use to store files.

#### `AUTHENTIK_STORAGE__S3__CUSTOM_DOMAIN`

Domain to use to create URLs for users. Mainly useful for non-AWS providers.

May include a port. Must include the bucket.

Example: `s3.company:8080/authentik-data`.

Defaults to not set.

#### `AUTHENTIK_STORAGE__S3__SECURE_URLS`

Whether URLs created use HTTPS or HTTP.

Defaults to `true`.

#### `AUTHENTIK_STORAGE__S3__URL_EXPIRY`

How long generated URLs for file access are valid for.

Defaults to `minutes=15`.

### Media storage settings

These settings affect where media files are stored. Those files include applications and sources icons.

#### `AUTHENTIK_STORAGE__MEDIA__BACKEND`

Overrides [`AUTHENTIK_STORAGE__BACKEND`](#authentik_storage__backend)

#### `AUTHENTIK_STORAGE__MEDIA__FILE__[...]`

Overrides [`AUTHENTIK_STORAGE__FILE__[...]`](#file-storage-backend-settings) settings.

#### `AUTHENTIK_STORAGE__MEDIA__S3__[...]`

Overrides [`AUTHENTIK_STORAGE__S3__[...]`](#s3-storage-backend-settings) settings.

These settings affect where media files are stored. Those files include applications and sources icons. By default, they use the same storage settings as the main storage configuration. S3 storage is also supported.

### Reports storage settings

These settings affect where CSV reports are stored.

#### `AUTHENTIK_STORAGE__REPORTS__BACKEND`

Overrides [`AUTHENTIK_STORAGE__BACKEND`](#authentik_storage__backend)

#### `AUTHENTIK_STORAGE__REPORTS__FILE__[...]`

Overrides [`AUTHENTIK_STORAGE__FILE__[...]`](#file-storage-backend-settings) settings.

#### `AUTHENTIK_STORAGE__REPORTS__S3__[...]`

Overrides [`AUTHENTIK_STORAGE__S3__[...]`](#s3-storage-backend-settings) settings.

## authentik settings

### `AUTHENTIK_SECRET_KEY`

Secret key used for cookie signing. Changing this will invalidate active sessions.

Prior to 2023.6.0 the secret key was also used for unique user IDs. When running a pre-2023.6.0 version of authentik the key should _not_ be changed after the first install.

### `AUTHENTIK_LOG_LEVEL`

Log level for the server and worker containers. Possible values: `debug`, `info`, `warning`, `error`.

Starting with 2021.12.3, you can also set the log level to `trace`. This has no effect on the core authentik server, but shows additional messages for the embedded outpost.

Setting the log level to `trace` will include sensitive details in logs, so it shouldn't be used in most cases.

Logs generated with `trace` should be treated with care as they can give others access to your instance, and can potentially include things like session cookies to authentik **and other pages**.

Defaults to `info`.

### `AUTHENTIK_COOKIE_DOMAIN`

Which domain the session cookie should be set to. By default, the cookie is set to the domain authentik is accessed under.

### `AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__GEOIP`

Path to the GeoIP City database. Defaults to `/geoip/GeoLite2-City.mmdb`. If the file is not found, authentik will skip GeoIP support.

### `AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__ASN`

Path to the GeoIP ASN database. Defaults to `/geoip/GeoLite2-ASN.mmdb`. If the file is not found, authentik will skip GeoIP support.

### `AUTHENTIK_DISABLE_UPDATE_CHECK`

Disable the inbuilt update-checker. Defaults to `false`.

### `AUTHENTIK_ERROR_REPORTING`

- `AUTHENTIK_ERROR_REPORTING__ENABLED`

    Enable error reporting. Defaults to `false`.

    Error reports are sent to https://sentry.io and are used for debugging and general feedback. Anonymous performance data is also sent.

- `AUTHENTIK_ERROR_REPORTING__SENTRY_DSN`

    Sets the DSN for the Sentry API endpoint.

    When error reporting is enabled, the default Sentry DSN will allow the authentik developers to receive error reports and anonymous performance data, which is used for general feedback about authentik, and in some cases, may be used for debugging purposes.

    Users can create their own hosted Sentry account (or self-host Sentry) and opt to collect this data themselves.

- `AUTHENTIK_ERROR_REPORTING__ENVIRONMENT`

    The environment tag associated with all data sent to Sentry. Defaults to `customer`.

    When error reporting has been enabled to aid in debugging issues, this should be set to a unique value, such as an email address.

- `AUTHENTIK_ERROR_REPORTING__SEND_PII`

    Whether or not to send personal data, like usernames. Defaults to `false`.

- `AUTHENTIK_ERROR_REPORTING__EXTRA_ARGS`

    Base64-encoded sentry_init arguments. See [Sentry's documentation](https://docs.sentry.io/platforms/python/configuration/options/) for available options.

### `AUTHENTIK_EMAIL`

The `AUTHENTIK_EMAIL` settings are used to configure SMTP email delivery from authentik.

These global email settings are used for administrator notifications, release and configuration alerts, [notification rules](../../sys-mgmt/events/notifications.mdx), and any [Email stage](../../add-secure-apps/flows-stages/stages/email/) configured to use global settings.

For complete setup examples, testing instructions, and TLS guidance, see the [Email configuration guide](../email.mdx).

- `AUTHENTIK_EMAIL__HOST`

    Default: `localhost`

    SMTP server hostname or IP address.

- `AUTHENTIK_EMAIL__PORT`

    Default: `25`

    SMTP server port. Common values are `25`, `587` for STARTTLS, and `465` for implicit TLS.

- `AUTHENTIK_EMAIL__USERNAME`

    Default: `` (Don't add quotation marks)

    SMTP username. If empty, authentik will not attempt SMTP authentication.

- `AUTHENTIK_EMAIL__PASSWORD`

    Default: `` (Don't add quotation marks)

    SMTP password. If empty, authentik will not attempt SMTP authentication.

- `AUTHENTIK_EMAIL__USE_TLS`

    Default: `false`

    Enable STARTTLS, also called explicit TLS. This is usually used with port `587`.

    Mutually exclusive with `AUTHENTIK_EMAIL__USE_SSL`.

- `AUTHENTIK_EMAIL__USE_SSL`

    Default: `false`

    Enable implicit TLS. This is usually used with port `465`.

    Mutually exclusive with `AUTHENTIK_EMAIL__USE_TLS`.

- `AUTHENTIK_EMAIL__TIMEOUT`

    Default: `10`

    SMTP connection timeout in seconds.

- `AUTHENTIK_EMAIL__FROM`

    Default: `authentik@localhost`

    Email address that authentik will send emails from. This should be a valid address for your domain.

    To include a display name, use the format `Name <account@domain>`.

### `AUTHENTIK_OUTPOSTS`

- `AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE`

    Placeholders:
    - `%(type)s`: Outpost type; proxy, ldap, etc
    - `%(version)s`: Current version; 2021.4.1
    - `%(build_hash)s`: Build hash if you're running a beta version

    Placeholder for outpost docker images. Default: `ghcr.io/goauthentik/%(type)s:%(version)s`.

- `AUTHENTIK_OUTPOSTS__DISCOVER`

    Configure the automatic discovery of integrations. Defaults to `true`.

    By default, the following is discovered:
    - Kubernetes in-cluster config
    - Kubeconfig
    - Existence of a docker socket

### `AUTHENTIK_LDAP__TASK_TIMEOUT_HOURS`

Timeout in hours for LDAP synchronization tasks.

Defaults to `2`.

### `AUTHENTIK_LDAP__PAGE_SIZE`

Page size for LDAP synchronization. Controls the number of objects created in a single task.

Defaults to `50`.

### `AUTHENTIK_LDAP__TLS__CIPHERS`

Allows configuration of TLS Ciphers for LDAP connections used by LDAP sources. Setting applies to all sources.

Defaults to `null`.

### `AUTHENTIK_REPUTATION__EXPIRY`

Configure how long reputation scores should be saved for in seconds.

Defaults to `86400`.

### `AUTHENTIK_SESSION_STORAGE`

This setting is removed as of version 2025.4. Sessions are now exclusively stored in the database. See our [2025.4 release notes](../../releases/2025.4#sessions-are-now-stored-in-the-database) for more information.

If you are running a version earlier than 2025.4, you can configure if the sessions are stored in the cache or the database. Defaults to `cache`. Allowed values are `cache` and `db`. Note that changing this value will invalidate all previous sessions.

### `AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE`:ak-version[2025.4]

Configure how long unauthenticated sessions last for. Does not impact how long authenticated sessions are valid for. See the [user login stage](../../add-secure-apps/flows-stages/stages/user_login/index.mdx) for session validity.

Defaults to `days=1`.

### `AUTHENTIK_SESSIONS__USER_SWITCHING_AGE`:ak-version[2026.8]

Configure how long the browser cookie that groups sessions for [user account switching](../../users-sources/user/user-switching.mdx) lasts. This setting does not change the validity of the grouped sessions.

Defaults to `days=365`.

### `AUTHENTIK_WEB__WORKERS`

Configure how many gunicorn worker processes should be started (see https://docs.gunicorn.org/en/stable/design.html).

Defaults to 2. A value below 2 workers is not recommended. In environments where scaling with multiple replicas of the authentik server is not possible, this number can be increased to handle higher loads.

### `AUTHENTIK_WEB__THREADS`

Configure how many gunicorn threads a worker processes should have (see https://docs.gunicorn.org/en/stable/design.html).

Defaults to 4.

### `AUTHENTIK_WEB__MAX_REQUESTS`

The maximum number of requests a worker will process before restarting. If this is set to zero then the automatic worker restarts are disabled (see https://gunicorn.org/reference/settings/#max_requests).

Defaults to 1000.

### `AUTHENTIK_WEB__MAX_REQUESTS_JITTER`

The maximum jitter to add to the `AUTHENTIK_WEB__MAX_REQUESTS` setting (see https://gunicorn.org/reference/settings/#max_requests_jitter).

Defaults to 50.

### `AUTHENTIK_WEB__PATH`

Configure the path under which authentik is served. For example to access authentik under `https://my.domain/authentik/`, set this to `/authentik/`. Value _must_ contain both a leading and trailing slash.

Defaults to `/`.

### `AUTHENTIK_WEB__BASE_URL`:ak-version[2026.8]

The base URL under which this authentik instance is reachable, for example `https://authentik.company`.

This option is a bootstrap value. On first start, authentik copies it into the **Base URL** [system setting](../../sys-mgmt/settings.mdx) when that setting has not been configured yet. It never overwrites a Base URL that was already set through the Admin interface or API, and when it is empty authentik falls back to the host configured on the embedded outpost. Once the system setting holds a value, this option is no longer consulted, so it does not need to remain in your environment configuration.

Any trailing slash is removed, so `https://authentik.company` and `https://authentik.company/` are equivalent.

Set this to the scheme and host only, without a path. All of authentik is served under [`AUTHENTIK_WEB__PATH`](#authentik_web__path) (`/` by default), and that prefix is already part of every link authentik generates. So even when you serve authentik under a subpath, for example `AUTHENTIK_WEB__PATH=/authentik/`, the base URL stays `https://authentik.company`, and generated links resolve under `https://authentik.company/authentik/`.

Defaults to an empty string.

This setting is currently unused until it can be marked as required, starting from authentik version 2026.11.

### `AUTHENTIK_WEB__TIMEOUT_HTTP`

Configure the timeouts for the web HTTP/HTTPS Server. Accepts duration in the format of "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

- `AUTHENTIK_WEB__TIMEOUT_HTTP_READ_HEADER`

Defaults to `5s`

- `AUTHENTIK_WEB__TIMEOUT_HTTP_READ`

Defaults to `30s`

- `AUTHENTIK_WEB__TIMEOUT_HTTP_WRITE`

Defaults to `60s`

- `AUTHENTIK_WEB__TIMEOUT_HTTP_IDLE`

Defaults to `120s`

## Advanced settings

##### `AUTHENTIK_SKIP_MIGRATIONS`

Whether to skip running migrations on starting authentik. This is destined to advanced setups and not recommended in normal use.

Defaults to `false`.

## System settings

Additional [system settings](../../sys-mgmt/settings.mdx) are configurable using the Admin interface, under **System** > **Settings** or using the API.

## Custom python settings

To modify additional settings further than the options above allow, you can create a custom Python file and mount it to `/data/user_settings.py`. This file will be loaded on startup by both the server and the worker. The [`authentik/root/settings.py` file](https://github.com/goauthentik/authentik/blob/main/authentik/root/settings.py) defines all default settings.

Using these custom settings is not supported and can prevent your authentik instance from starting. Use with caution.

---

## First steps

After you have installed and started authentik, you are now ready to add your first application and provider, add some users, and get started with using authentik as your Identity provider.

```mermaid
architecture-beta

    group first

    service install(mdi:application-cog-outline)[Install authentik] in first
    service acl(mdi:account-key-outline)[Access authentik] in first
    service apps(mdi:plus-box-multiple-outline)[Add an app and provider] in first
    service users(mdi:account-multiple-plus)[Create a new user] in first
    service further(mdi:cog-clockwise)[Further customization] in first

    install:R --> L:acl
    acl:R --> L:apps
    apps:R --> L:users
    users:R --> L:further

```

## Where are we now, and what's next?

The following tutorial assumes that you have already:

1. Installed authentik on either [Docker Compose](../../install-config/install/docker-compose.mdx#install-and-start-authentik), [Kubernetes](../../install-config/install/kubernetes.mdx#install-authentik-helm-chart), or [AWS CloudFormation](../../install-config/install/aws.mdx) and confirmed that the server, worker, and the PostgreSQL database are started and running.

2. Opened authentik in your browser to the `initial-setup` flow and added credentials for a default Admin account. ([Docker](../../install-config/install/docker-compose.mdx#access-authentik), [Kubernetes](../../install-config/install/kubernetes.mdx#access-authentik)), or [AWS CloudFormation](../../install-config/install/aws.mdx#access-authentik-from-aws-cloudformation).

You will get a `Not Found` error if the initial setup URL doesn't include the forward slash `/` at the very end of the URL. Also verify that the authentik server, worker, and PostgreSQL database are running and healthy. Review additional tips in our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps).

Other optional pre-installation configurations that you might have already completed include:

- [Configured your global email settings](../email/#configure-global-email-settings).
- [Configured your PostgreSQL settings](../configuration/configuration.mdx#postgresql-settings) (read-replica, connections, etc.).
- Configured a [reverse proxy](../reverse-proxy.mdx).
- Configured your [media storage settings](../../install-config/configuration/configuration.mdx#media-storage-settings) or optionally [S3 file storage](../../sys-mgmt/ops/storage-s3/index.mdx).
- Added additional [custom configurations environment variables](../configuration/#set-your-environment-variables).
- [Verified](../configuration/#verify-your-configuration-settings) your configuration settings.

## Install your first application and provider

Now that you have your authentik instance installed and configured with the required settings, you can add your first [application](../../../core/glossary/?application) and [provider](../../../core/glossary/?provider). After that, we'll walk through how to add your first user.

In a production environment, best practice is to first [create a group](../../users-sources/groups/manage_groups.mdx#create-a-group), then [create the user(s)](../../users-sources/user/user_basic_operations.mdx#create-a-user), and then add the application. Then you can configure the application to have a [binding](../../add-secure-apps/bindings-overview/work-with-bindings.mdx) to a specific group or user. The binding controls access to the application and whether it is displayed on a user's Application Dashboard page.

authentik supports integration with any application; refer to our [Integrations documentation](https://integrations.goauthentik.io) to view integrations guides for over 180 of the most common ones.

**In this guide we'll be setting up Grafana as an example application.**

<details>
    <summary>Why Grafana?</summary>

We'll use Grafana as an example application in this guide as it is very common and straightforward to set up.

For more configuration options and full details about integrating with Grafana, refer to our [full integration guide](/integrations/monitoring/grafana/). The following steps require that you have [a Grafana instance running in Docker](https://grafana.com/docs/grafana/latest/setup-grafana/configure-docker/), and that you can access the authentik Admin interface.

</details>

### 1. Log in to authentik as an administrator and open the authentik Admin interface.

**A.** In the Admin interface, navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair.

Every application that you add to authentik requires a provider, which is used to configure the specific protocol between the application and authentik, for example OAuth2/OIDC, SAML, LDAP, or others.

**B.** Provide the details for the application (Grafana) and provider (OAuth2/OIDC).

- **Configure the Application**:
    - **Name**: provide a descriptive name (such as Grafana).
        - **Group**: select an optional group for the application; groups are used to visually separate applications. For example, you can choose to group applications that you use for coding from those you use for internal communication.
    - **Policy engine mode**: select **Any** for this tutorial. The mode determines how authentik combines binding results.
        - <strong className="tip">TIP</strong>: in authentik,
          [policies](../../customize/policies/bindings.mdx) are used in authentik to fine-tune
          access to applications, flows, stages, and many other authentik components. You do not
          need to use a policy for every application. The **Any** policy engine mode grants access
          when at least one binding passes, or when no bindings are configured. The **All** mode
          requires every binding on the application to pass.
    - **UI Settings**: optional UI settings that are displayed about the application, including the launch URL, and three settings to display extra information about the application on the **Application Dashboard** page: an optional icon, the publisher of the application, and a brief description.
- **Choose a Provider Type**: select **OAuth2/OpenID Connect** as the provider type.
- **Configure the Provider**:
    - **Name**: Provide a name (or accept the auto-provided name).
    - **Authorization flow**: Select the default `implicit` authorization flow to use for this provider.
        - <strong className="tip">TIP</strong>: The authorization
          [flow](../../add-secure-apps/flows-stages/flow/index.mdx) is where the various steps, or
          [_stages_](../../add-secure-apps/flows-stages/stages/index.mdx) of authorization are
          defined and executed. The defined set of stages construct the workflows of authentication,
          authorization, etc.
    - **Protocol settings**: provide the following required configurations:
        - Note the **Client ID**, **Client Secret**, and **Slug** values because they will be required later when you configure Grafana to use authentik.
        - Add a **Redirect URI** of type `Strict` `Authorization` as `https://grafana.company/login/generic_oauth`.
            - <strong className="tip">TIP</strong>: The Redirect URI is where a user is directed to,
              as soon as authentik's authorization flow is successfully completed.
    - **Grant Types** (required): Select at least one [grant type](../../add-secure-apps/providers/oauth2/#oauth-20-flows-and-grant-types) that the provider can use.
    - **Logout URI**: set to `https://grafana.company/logout`.
    - **Logout Method**: set to `Front-channel`.
        - <strong className="tip">TIP</strong>: With OAuth2, front-channel logout is considered the
          default because most applications (including Grafana) do not support back-channel logout.
    - **Signing Key**: select any available signing key.
        - <strong className="tip">TIP</strong>: authentik generates a key that you can use, called
          the `authentik Self-signed Certificate`, if you do not have a specific signing key for an
          application.
- **Configure Bindings** _(optional)_: for this tutorial, skip this step because you do not yet have a user. Later, after you create your first user, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.mdx) to manage access to the application and its display on a user's **Application Dashboard** page.
    - <strong className="tip">TIP</strong>: By creating a binding between an application and a
      specific user, you are ensuring that the application is accessible only to that user and any
      other users or groups for whom you created a binding. Learn more about how bindings are used
      in authentik in our [Bindings overview](../../add-secure-apps/bindings-overview/index.mdx).
      For any fields not mentioned above, you can leave the default value.

**C.** Click **Create Application** to save the new application and provider.

### 2. Configure Grafana to use authentik as its IdP

For some applications, you log in to the application and configure settings there; with Grafana you simply edit your Grafana Docker Compose file. Here you add basic configuration settings as well as the **Client ID**, **Client Secret**, and the **Slug** values that you obtained when you configured the application and provider in authentik in Step 1 above.

**A.** In the Grafana Docker Compose file, set the following environment variables:

These values are for a [Grafana instance running in Docker](https://grafana.com/docs/grafana/latest/setup-grafana/configure-docker/); for standalone or Helm Chart instances refer to our [Grafana integration guide](https://integrations.goauthentik.io/monitoring/grafana/).

Note that `authentik.company` is a placeholder that we use in our example settings; replace this with the domain that authentik is running on in your environment.

```
environment:
    GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
    GF_AUTH_GENERIC_OAUTH_NAME: "authentik"
    GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ""
    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ""
    GF_AUTH_GENERIC_OAUTH_SCOPES: "openid profile email"
    GF_AUTH_GENERIC_OAUTH_AUTH_URL: "https://authentik.company/application/o/authorize/"
    GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "https://authentik.company/application/o/token/"
    GF_AUTH_GENERIC_OAUTH_API_URL: "https://authentik.company/application/o/userinfo/"
    GF_AUTH_SIGNOUT_REDIRECT_URL: "https://authentik.company/application/o/<application_slug>/end-session/"
    # Optionally enable auto-login (bypasses Grafana login screen)
    GF_AUTH_OAUTH_AUTO_LOGIN: "true"
    # Optionally map user groups to Grafana roles
    GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: "contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'"
    # Required if Grafana is running behind a reverse proxy
    GF_SERVER_ROOT_URL: "https://grafana.company"
```

**B.** Save your Grafana Docker Compose file, and then launch the stack and access Grafana via your browser at the configured URL.

**C.** To confirm that authentik is properly configured with the new application, log out of Grafana and then log back in using the **Sign in with authentik** button. You should be redirected to authentik to provide credentials.

## Add your first user

Now that you can access the authentik Admin interface, and you have added an application and provider, let's add a new user.

### 1. Log in to authentik as an administrator and open the authentik Admin interface.

    **A.** Navigate to **Directory > Users**, click **New User**, and then select **Internal User**.

    **B.** Fill in all **_required_** fields:

    - **Username**: This value must be unique across all users.
    - **Display Name** (_optional_): The display name of the user.
    - **Email** (_optional_): The email address of the user. Email addresses are used in [email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx), as an alternative method to log in, by services to request an email address, and if configured, to receive [notifications](../../sys-mgmt/events/notifications.mdx).
    - **Active** (_optional_): Define if the newly created user account is active. Selected by default.
    - **Path**: The path where the user will be created. By default the new user is created in the `users` folder, but you can change that later by editing the user.
        - <strong className="tip">TIP</strong>: Paths are directories that are used to organize your
          users (for example HR vs Sales, etc.). Paths do not impact access; they are purely
          organizational. Note that the top-level **users** folder displays all users in that folder
          and all sub-folders.
    - **Attributes** (_optional_): [Custom attributes](../../users-sources/user/user_ref.mdx) for the user, in YAML or JSON format. These attributes can be used to enforce additional prompts on authentication stages or define conditions to enforce specific policies if the current implementation does not fit your use case. The value is an empty dictionary by default.

C. Click **Create**.

For more information refer to our [documentation on managing users](../../users-sources/user/user_basic_operations.mdx#create-a-user).

### 2. Verify that the new user was created

- Look for the new user in the list on the **Directory** > **Users** page.

## What's next?

Now that you have added your first application, and a new user, here are some typical next steps:

- Assign your new user to appropriate [groups](../../users-sources/user/user_basic_operations.mdx#add-a-user-to-a-group) and [roles](../../users-sources/user/user_basic_operations.mdx#add-a-user-to-a-role).
- [Restrict access](../../add-secure-apps/applications/manage_apps.mdx#use-bindings-to-control-access) to an application. See more below about [using bindings to restrict access](#using-bindings-to-allow-or-restrict-access-to-applications).
- Learn more about [Role Based Access Control (RBAC) in authentik](../../users-sources/access-control/index.mdx).
- Configure federated or external [sources](../../users-sources/sources/index.mdx) (an existing source of user credentials and other user data).
- Set up MFA
- Define [property mappings](../../add-secure-apps/providers/property-mappings/index.mdx).
- Create a [custom flow](../../add-secure-apps/flows-stages/flow/index.mdx#).
- [Get started with authentik Enterprise](../../enterprise/get-started.mdx)
- [Create a policy](../../customize/policies/index.mdx) to control access, force MFA use, etc.

## Things to know and troubleshooting tips

Review the following information to learn more about the basics of setting up authentik and for troubleshooting tips.

### Modify the Docker Compose file

Especially when you are just starting out with authentik, we recommend that you use the default `docker-compose.yml` file that comes with the download, instead of trying to write the file from scratch. After you have successfully installed, configured, and accessed authentik, you can edit the file to do more advanced configurations, as documented in the [Configuration section](../../install-config/configuration/configuration.mdx).

### Reverse proxy

Typically authentik is set up with a reverse proxy in front of it. If you already have a reverse proxy that you are using to handle your incoming network traffic, you can simply use that same reverse proxy for authentik, by adding a few configuration values. For more details see the [Reverse proxy guide](../reverse-proxy.mdx).

### The `latest` tag is deprecated

The `:latest` tag has been deprecated and will never be updated from the 2025.2 release.
Instead, use a specific version tag for authentik instances' container images, such as `:2025.12`.

### Use bindings to allow or restrict access to applications {#using-bindings-to-allow-or-restrict-access-to-applications}

If you do not define any [bindings](../../add-secure-apps/bindings-overview/index.mdx), all users have access to the application. To control access, you can [create a binding](../../add-secure-apps/bindings-overview/work-with-bindings.mdx). For more information, see [policy-driven authorization](../../add-secure-apps/applications/manage_apps.mdx#policy-driven-authorization) and [hiding an application](../../add-secure-apps/applications/manage_apps.mdx#hide-applications).

### Upgrades

When you are ready to upgrade to the latest version, be sure to read our [Upgrade documentation](../upgrade.mdx) and refer to the [Release Notes](../../releases/) for the specific version.

---

## AWS installation

You can install authentik to run on AWS with a CloudFormation template.

### Prerequisites

- An AWS account.
- An [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate. Take note of the ARN of the certificate.

### Installation

Log in to your AWS account and create a CloudFormation stack [with our template](https://console.aws.amazon.com/cloudformation/home#/stacks/create/review?stackName=authentik\&templateURL=https://authentik-cloudformation-templates.s3.amazonaws.com/authentik.ecs.latest.yaml).

Under the **Certificate ARN** input, enter the previously created certificate ARN. You can also configure other settings if needed. You can follow the prompts to create the stack.

This stack will create the following resources:

- AWS SSM secrets for the PostgreSQL user and the authentik secret key
- A VPC for all other resources
- A RDS PostgreSQL Multi-AZ cluster
- An ECS cluster with two tasks:
  - One for the authentik server
  - One for the authentik worker
- An ALB (Application Load Balancer) pointing to the authentik server ECS task with the configured certificate
- An EFS filesystem mounted on both ECS tasks for file storage

The stack will output the endpoint of the ALB to which you can point your DNS records.

## Access authentik from AWS CloudFormation

To start the initial setup, navigate to `http://<domain_you_configured>`.

You are then prompted to set a password for the `akadmin` user (the default user).

If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps).

### Further customization

If you require further customization, we recommend you install authentik via [Docker Compose](./docker-compose.mdx) or [Kubernetes](./kubernetes.mdx).

---

## Docker Compose installation

This installation method is for test setups and small-scale production setups.

## Requirements

- A host with at least 2 CPU cores and 2 GB of RAM
- Podman or Docker Compose (Compose v2, see [instructions for upgrade](https://docs.docker.com/compose/migrate/))

## Video

View our video about installing authentik on Docker.

## Download the Compose file

To download the latest `compose.yml` open your terminal, navigate to the directory of your choice, and then run the following command:

```shell
wget https://docs.goauthentik.io/compose.yml
```

```shell
curl -O https://docs.goauthentik.io/compose.yml
```

## Generate PostgreSQL password and secret key

If this is a fresh authentik installation, generate a PostgreSQL password and an authentik secret key. Use a secure password generator of your choice such as `pwgen`, or use `openssl` as shown below.

Run the following commands to generate a PostgreSQL password and secret key and write them to your `.env` file:

```shell
echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
```

Because of a PostgreSQL limitation, passwords longer than 99 characters are not supported. See the [PostgreSQL mailing list discussion](https://www.postgresql.org/message-id/09512C4F-8CB9-4021-B455-EF4C4F0D55A0@amazon.com).

To enable error reporting, run the following command:

```shell
echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env
```

For an explanation about what each service in the Docker Compose file does, see [Architecture](../../core/architecture.mdx).

## Configure custom ports

By default, authentik listens internally on port 9000 for HTTP and 9443 for HTTPS. To use different exposed ports such as 80 and 443, you can set the following variables in `.env`:

```shell
COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443
```

See [Configuration](../configuration/configuration.mdx) to change the internal ports. Be sure to run `docker compose up -d` to rebuild with the new port numbers.

## Docker socket

By default, the authentik Docker Compose file mounts the Docker socket to the authentik worker container:

```yaml
- /var/run/docker.sock:/var/run/docker.sock
```

This is used for [automatic deployment and management of authentik Outposts](../../add-secure-apps/outposts/integrations/docker.mdx).

Mounting the Docker socket to a container comes with some inherent security risks. To reduce these risks, you can use a [Docker Socket Proxy](../../add-secure-apps/outposts/integrations/docker.mdx#docker-socket-proxy) as an additional layer of protection.

Alternatively, you can remove this mount and instead [manually deploy and manage outposts](../../add-secure-apps/outposts/manual-deploy-docker-compose.mdx).

## Email configuration (optional but recommended)

It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx) to send verification/recovery emails.

For more information, refer to our [Email configuration](../email.mdx) documentation.

## Install and start authentik

All internal operations use UTC. Times displayed in the UI are automatically localized for the user. Do not update or mount `/etc/timezone` or `/etc/localtime` in the authentik containers; it will cause problems with OAuth and SAML authentication, as seen this [GitHub issue](https://github.com/goauthentik/authentik/issues/3005).

After you have downloaded the `docker-compose.yml` file, generated a password and a secret key, and optionally configured your global email, run these commands to retrieve and install the current version of authentik:

```shell
docker compose pull
docker compose up -d
```

The `compose.yml` file statically references the latest version available at the time of downloading the compose file. Each time you upgrade to a newer version of authentik, you download a new `compose.yml` file, which points to the latest available version. For more information, refer to the **Upgrading** section in the [Release Notes](../../../releases/).

## Access authentik

To start the initial setup, navigate to `http://<your server's IP or hostname>:9000`.

You are then prompted to set a password for the `akadmin` user (the default user).

If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps).

## First steps in authentik

You are now ready to add your first application and its provider. Then you'll want to add a new user.

To view a typical workflow for adding applications and users, with helpful context and explanations for each step, refer to the [First Steps](./index.mdx) tutorial.

---

## Kubernetes installation

You can install authentik to run on Kubernetes using a Helm chart.

You can also [view a video walk-through](https://www.youtube.com/watch?v=O1qUbrk4Yc8) of the installation process on Kubernetes (with bonus details about email configuration and other important options).

## Requirements

- Kubernetes
- Helm

## Video

View our video about installing authentik on Kubernetes.

## Generate passwords

Start by generating passwords for the database and cache. You can use either of the following commands:

```shell
pwgen -s 50 1
openssl rand 60 | base64 -w 0
```

## Set values

Create a `values.yaml` file with a minimum of these settings:

```yaml
authentik:
    secret_key: "PleaseGenerateASecureKey"
    # This sends anonymous usage-data, stack traces on errors and
    # performance data to sentry.io, and is fully opt-in
    error_reporting:
        enabled: true
    postgresql:
        password: "ThisIsNotASecurePassword"

server:
    ingress:
        # Specify kubernetes ingress controller class name
        ingressClassName: nginx | traefik | kong
        enabled: true
        hosts:
            - authentik.domain.tld

postgresql:
    enabled: true
    auth:
        password: "ThisIsNotASecurePassword"
```

If your cluster or controller supports the Gateway API, replace the `server.ingress` section above with this Gateway API configuration:

```yaml
server:
    route:
        main:
            enabled: true
            hostnames:
                - authentik.domain.tld
            parentRefs:
                - name: shared-gateway
                  namespace: default
```

The Helm chart creates an `HTTPRoute`, but it does not create `Gateway` or `GatewayClass` resources. Create the `Gateway` separately, then set `server.route.main.parentRefs` to that `Gateway` resource's name and namespace. In the example above, `name: shared-gateway` and `namespace: default` must match the manually created `Gateway`.

If your cluster or controller does not support the Gateway API, use the `server.ingress` configuration shown above.

See all configurable values on [ArtifactHub](https://artifacthub.io/packages/helm/goauthentik/authentik).

The chart does not mount storage for uploaded files by default. Configure `global.volumes` and `global.volumeMounts`, or use S3, as described in [File storage requirements](../../customize/files.mdx#storage-requirements).

## PostgreSQL production setup

The PostgreSQL database installed by default with the Helm chart is intended for demonstration and test environments.

For production deployments, use a separately managed PostgreSQL installation instead of relying on the chart's bundled database.

Common options include:

- [CloudNativePG](https://github.com/cloudnative-pg/cloudnative-pg)
- [Zalando Postgres Operator](https://github.com/zalando/postgres-operator)

After you provision PostgreSQL externally, configure authentik to use it with the settings in the [PostgreSQL configuration reference](../configuration/configuration.mdx#postgresql-settings).

## Email configuration (optional but recommended)

It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by [Email stages](../../add-secure-apps/flows-stages/stages/email/index.mdx) to send verification/recovery emails.

For more information, refer to our [Email configuration](../email.mdx) documentation.

## Install authentik Helm Chart

Now, execute the following commands to install authentik:

```shell
helm repo add authentik https://charts.goauthentik.io
helm repo update
helm upgrade --install authentik authentik/authentik -f values.yaml
```

During the installation process, the database migrations will be applied automatically on startup.

To adjust the number of server or worker replicas automatically, see [Autoscaling on Kubernetes](../../sys-mgmt/ops/autoscaling/index.mdx).

## Access authentik

To start the initial setup, navigate to `http://<your server's IP or hostname>:9000`.

You are then prompted to set a password for the `akadmin` user (the default user).

If you run into issues, refer to our [troubleshooting docs](../../troubleshooting/login.mdx#cant-access-initial-setup-flow-during-installation-steps).

## First steps in authentik

You are now ready to add your first application and its provider. Then you'll want to add a new user.

To view a typical workflow for adding applications and users, with helpful context and explanations for each step, refer to the [First Steps](./index.mdx) tutorial.

---

## Release 2021.1

## Headline Changes

- New versioning schema (year.month.release)

- Add global email settings

  In previous versions, you had to configure email connection details per [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.mdx). Now, you can (and should) configure global settings.

  This is documented under the [Docker Compose](../../install-config/install/docker-compose.mdx) and [Kubernetes](../../install-config/install/kubernetes.mdx) sections.

- New notification system

  More info can be found under [Notifications](../../sys-mgmt/events/notifications.mdx) and [Transports](../../sys-mgmt/events/transports.mdx).

  During the update, some default rules will be created. These rules notify you about policy exceptions, configuration errors and updates.

  These notifications will be sent using a default transport, which uses the global email transport.

## Fixes

- events: create event when system task fails
- helm: fix old reference to static secret\_key
- helm: fix s3 secret key and email password not being base64 encoded
- policies: fix logic error for sync mode
- stages/email: fix email task not falling back to use\_global\_settings

### Fixed in 2021.1.2

- sources/\*: Add source to flow context, so source is logged during login
- outposts: Fix outpost not correctly updating on outpost modification
- outposts: Improve drift detection on kubernetes
- providers/saml: Fix metadata not being signed when signature is enabled
- policies: Improve error handling, ensure original stacktrace is preserved

### Fixed in 2021.1.3

- admin: handle FlowNonApplicableException during flow plan
- flows: fix FlowNonApplicableException not being Sentry Ignored
- lifecycle: fix typo causing single process in docker-compose

### Fixed in 2021.1.4

- admin: fix providers not showing SAML Import on empty state
- core: only cache Applications API when no filtering is done
- events: fix email template for notifications
- lib: fix ak\_is\_group\_member checking wrong groups
- providers/saml: add support for WindowsDomainQualifiedName, add docs for NameID
- providers/saml: import SAML Provider with all autogenerated mappings
- providers/saml: make NameID configurable using a Property Mapping
- providers/saml: update default OIDs for default property mappings
- web: fix site-shell being cut off when not full height

## Upgrading

This release does not introduce any new requirements.

### Docker Compose

Download the docker-compose file for 2021.1 from [here](https://goauthentik.io/version/2021.1/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.

### Kubernetes

Run `helm repo update` and then upgrade your release with `helm upgrade authentik authentik/authentik --devel -f values.yaml`.

---

## Release 2021.10

## Headline Changes

- Flow Inspector

  To better understand how a flow works, and why things might not be working as intended, you can now launch Flows with an inspector enabled. This is simply triggered by adding a `?inspector` to the URL. Currently, only superuser have the permission to access the Inspector.

  The inspector shows the current stage, previous stages, next planned stages, and the current flow context.

- SMS Authenticator

  You can now use SMS-based TOTP authenticators. This new Stage supports both Twilio, and a generic API endpoint, if using another provider. This stage does not have to be used for authentication, it can simply be used during enrollment to verify your users phone numbers.

- Sign in with Apple

  It is now possible to add an Apple OAuth Source, to allow your users to authenticate with their Apple ID.

A huge shoutout to all the people that contributed, helped test and also translated authentik. This is the first release that has a full French translation!

## Minor changes

- \*: Squash Migrations (#1593)
- admin: clear update notification when notification's version matches current version
- cmd: prevent outposts from panicking when failing to get their config
- core: add default for user's settings attribute
- core: add settings serializer to user/me and update\_self endpoints, saved in a key in attributes
- core: improve detection for s3 settings to trigger backup
- core: include group uuids in self serializer
- core: make user's name field fully optional
- flows: inspector (#1469)
- internal: add internal healthchecking to prevent websocket errors
- internal/proxyv2: improve error handling when configuring app
- lifecycle: bump celery healthcheck to 5s timeout
- lifecycle: only lock database when system migrations need to be applied, and during django migrations, and don't double unlock
- lifecycle: only set prometheus\_multiproc\_dir in ak wrapper to prevent full disk on worker
- managed: don't run managed reconciler in foreground on startup
- outpost/proxy: fix missing negation for internal host ssl verification
- outposts: add additional error checking for docker controller
- outposts: Adding more flexibility to outposts in Kubernetes. (#1617)
- outposts: allow disabling of docker controller port mapping
- outposts: check ports of deployment in kubernetes outpost controller
- outposts: don't always build permissions on outpost.user access, only in signals and tasks
- outposts: fallback to known-good outpost image if configured image cannot be pulled
- outposts: fix error when comparing ports in docker controller when port mapping is disabled
- outposts: handle k8s 422 response code by recreating objects
- outposts: rename docker\_image\_base to container\_image\_base, since its not docker specific
- outposts/ldap: Support hard coded `uidNumber` and `gidNumber`. (#1582)
- outposts/proxy: add new headers with unified naming
- outposts/proxy: fix duplicate protocol in domain auth mode
- outposts/proxy: show full error message when user is authenticated
- policies: add additional filters to create flow charts on frontend
- policies/password: add extra sub\_text field in tests
- providers/ldap: use RDN when using posixGroup's memberUid attribute (#1514)
- providers/proxy: always check ingress secret in kubernetes controller
- providers/proxy: update ingress controller to work with k8s 1.22
- recovery: handle error when user doesn't exist
- root: add docker-native healthcheck for web and celery
- root: add translation for backend strings
- root: coverage with toml support
- root: fix error with sentry proxy
- root: migrate docker images to netlify proxy (#1603)
- root: remove redundant internal network from compose
- root: remove structlog.processors.format\_exc\_info for new structlog version
- root: Use fully qualified names for docker bases base images. (#1490)
- sources/ldap: add support for Active Directory `userAccountControl` attribute
- sources/ldap: don't sync ldap source when no property mappings are set
- sources/ldap: fix logic error in Active Directory account disabled status
- sources/oauth: add Sign in with Apple (#1635)
- stages/authenticator\_sms: add generic provider (#1595)
- stages/authenticator\_sms: Add SMS Authenticator Stage (#1577)
- stages/authenticator\_validate: create a default authenticator validate stage with sensible defaults
- stages/email: add activate\_user\_on\_success flag, add for all example flows
- stages/prompt: add sub\_text field to add HTML below prompt fields
- stages/prompt: fix sub\_text not allowing blank
- stages/prompt: fix wrong field type of field\_key
- stages/user\_login: add check for user.is\_active and tests
- stages/user\_write: allow recursive writing to user.attributes
- web: add locale detection
- web: ensure fallback locale is loaded
- web: fix rendering of token copy button in dark mode
- web: fix strings not being translated at all when matching browser locale not found
- web: make table pagination size user-configurable
- web: new default flow background
- web: Translate /web/src/locales/en.po in fr\_FR (#1506)
- web/admin: add fallback font for doughnut charts
- web/admin: default to warning state for backup task
- web/admin: don't require username nor name for activate/deactivate toggles
- web/admin: fix description for flow import
- web/admin: fix LDAP Source form not exposing syncParentGroup
- web/admin: fix search group label
- web/admin: fix SMS Authenticator stage not loading state correctly
- web/admin: improve visibility of oauth rsa key
- web/admin: only show outpost deployment info when not embedded
- web/admin: truncate prompt label when too long
- web/elements: fix initialLoad not being done when viewportCheck was disabled
- web/elements: fix model form always loading when viewport check is disabled
- web/elements: use dedicated button for search clear instead of webkit exclusive one
- web/flows: adjust message for email stage
- web/user: don't show managed tokens in user interface
- web/user: initial optimization for smaller screens
- web/user: load interface settings from user settings

## Fixed in 2021.10.1-rc2

- core: add user flag to prevent users from changing their usernames
- core: log user for http requests
- flows: clear cache when deleting bindings
- outpost/ldap: fix logging for mismatched provider
- root: add cookie domain setting
- sources/oauth: add choices to oauth provider\_type
- web: disable Sentry.showReportDialog
- web/flows: showing of authentik logo in flow executor
- web/flows: fix authenticator device selection not updating
- web/flows: show cancel link when choosing authenticator challenge

## Fixed in 2021.10.1-rc3

- api: fix error when connection to websocket via secret\_key
- core: add toggle to completely disable backup mechanism
- core: add USER\_ATTRIBUTE\_CHANGE\_EMAIL
- events: fix error when notification transport doesn't exist anymore
- outposts: fix docker controller not using object\_naming\_template
- providers/oauth2: fallback to uid if UPN was selected but isn't available
- providers/oauth2: fix events being created from /application/o/authorize/
- sources/ldap: prevent key `users` from being set as this is an M2M relation
- sources/ldap: skip values which are of type bytes

## Fixed in 2021.10.1

- core: add API for all user-source connections
- core: add API to list all authenticator devices
- core: add created field to source connection
- flows: optimize stage user\_settings API
- outposts: separate websocket re-connection logic to decrease requests on reconnect
- root: pin node images to v16
- root: update golang ldap server package
- web/user: fix wrong device being selected in user's mfa update form
- web/user: rework MFA Device UI to support multiple devices
- web/user: update form to update mfa devices

## Fixed in 2021.10.2

- api: replace django sentry proxy with go proxy to prevent login issues
- providers/proxy: allow configuring of additional scope mappings for proxy
- providers/saml: fix error on missing AssertionConsumerServiceURL, fall back to default ACS
- root: fix Detection of S3 settings for backups
- root: fix postgres install on bullseye
- root: update base images for outposts
- root: update to buster
- stages/identification: add show\_source\_labels option, to show labels for sources
- stages/invitation: don't throw 404 error in stage
- stages/invitation: remove invitation from plan context after deletion
- stages/prompt: fix type in Prompt not having enum set
- web/flows: fix invalid validation for static tokens
- web/flows: fix sub\_text not rendering for static fields
- web/user: fix configureUrl not being passed to `<ak-user-settings-password>`

## Fixed in 2021.10.3

- admin: improve check to remove version notifications
- cmd/server: improve cleanup on shutdown
- core: add command to output full config
- core: fix auth\_method for tokens
- core: include parent group name
- core: make group membership lookup respect parent groups (upwards)
- events: ignore creation/deletion of AuthenticatedSession objects
- internal: start embedded outpost directly after backend is healthy instead of waiting
- lifecycle: revert to non-h11 worker
- outpost/ldap: don't cleanup user info as it is overwritten on bind
- providers/\*: include list of outposts
- providers/ldap: add/squash migrations
- providers/ldap: memory Query (#1681)
- recovery: add create\_admin\_group management command
- root: fix defaults for EMAIL\_USE\_TLS
- root: improve compose detection, add anonymous stats
- root: keep last 30 backups
- sources/ldap: remove deprecated default
- sources/oauth: set prompt=none for Discord provider
- sources/plex: allow users to connect their plex account without login flow
- sources/plex: use exception\_to\_string in tasks
- stages/authenticator\_\*: add default name for authenticators
- stages/identification: only allow limited challenges for login sources
- stages/identification: use random sleep
- stages/prompt: add text\_read\_only field
- stages/prompt: default prompts to the current value of the context
- stages/prompt: only set placeholder when in context
- stages/prompt: set field placeholder based on plan context
- stages/prompt: use initial instead of default
- web: fix linting errors by adding a wrapper for next param
- web/admin: only show flows with an invitation stage configured instead of all enrollment flows
- web/admin: show warning on invitation list when no stage exists or is bound
- web/admin: show warning on provider when not used with outpost
- web/flows: fix authenticator\_validate not allowing alphanumeric codes due to empty pattern
- web/flows: improve display of static tokens
- web/user: fix ak-user-settings-password getting wrong configureUrl
- web/user: fix device type for static tokens
- web/user: fix empty page when no sources to connect exist
- web/user: fix redirect after starting configuration flow from user interface

## Fixed in 2021.10.4

- core: force lowercase emails for gravatar usage
- outposts: fix MFA Challenges not working with outpost
- outposts/ldap: fix logic error in cached ldap searcher
- outposts/proxy: fix static files not being served in proxy mode
- providers/proxy: return list of configured scope names so outpost requests custom scopes
- root: use python slim-bullseye as base
- sources/ldap: fix user/group sync overwriting attributes instead of merging them
- sources/ldap: set connect/receive timeout (default to 15s)
- stages/\*: disable trim\_whitespace on important fields
- stages/authenticator\_duo: fix devices created with name
- stages/authenticator\_validate: enable all device classes by default
- web: write interfaces to different folders and remove custom chunk names
- web/admin: fix display issues with flow execute buttons
- web/admin: show warnings above tab bar
- web/admin: use more natural default ordering for objects

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.10 from [here](https://goauthentik.io/version/2021.10/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2021.10.1
```

---

## Release 2021.12

## Headline changes

This release does not have any headline features, and mostly fixes bugs.

## Breaking changes

- stages/prompt: Before 2021.12, any policy was required to pass for the result to be considered valid. This has been changed, and now all policies are required to be valid.

## Minor changes

- core: make defaults for \_change\_email and \_change\_username configurable
- core: remove dump\_config, handle directly in config loader without booting django, don't check database
- events: add gdpr\_compliance option
- internal: fix integrated docs not working
- internal: use runserver when debug for code reload
- lib: add cli option for lib.config
- lib: add improved log to sentry events being sent
- lib: fix custom URL schemes being overwritten
- lib: load json strings in config env variables
- lib: log error for file:// in config
- lifecycle: allow custom worker count in k8s
- lifecycle: improve backup restore by dropping database before
- lifecycle: improve redis connection debug py printing full URL
- outpost: configure error reporting based off of main instance config
- outposts: don't panic when listening for metrics fails
- outposts: reload on signal USR1, fix display of reload offset
- outposts/ldap: copy boundUsers map when running refresh instead of using blank map
- outposts/ldap: fix panic when attempting to update without locked users mutex
- outposts/proxy: continue compiling additional regexes even when one fails
- outposts/proxy: show better error when hostname isn't configured
- outposts/proxy: use disableIndex for static files
- policies/expression: fix ak\_user\_has\_authenticator evaluation when not specifying optional device\_type (#1849)
- providers/saml: fix SessionNotOnOrAfter not being included
- root: add lifespan shim to prevent errors
- root: fix settings for managed not loaded
- root: make sentry sample rate configurable
- stages/authenticator\_validate: catch error when attempting to configure user without flow
- stages/email: fix missing component in response when retrying email send
- stages/email: minify email css template
- stages/email: prevent error with duplicate token
- web: improve dark theme for vertical tabs
- web: only show applications with http link
- web/admin: allow flow edit on flow view page
- web/admin: fix actions column on ip reputation page
- web/admin: fix Forms with file uploads not handling errors correctly
- web/admin: make object view pages more consistent
- web/admin: make user clickable for bound policies list
- web/admin: redesign provider pages to provide more info
- web/admin: show changelog on user info page
- web/admin: unify rendering and sorting of user lists
- web/elements: add new API to store attributes in URL, use for table and tabs
- web/elements: allow app.model names for ak-object-changelog
- web/elements: allow multiple tabs with different state
- web/flows: fix spinner during webauthn not centered
- web/flows: update default background
- web/user: fix filtering for applications based on launchURL
- web/user: fix height issues on user interface

## Fixed in 2021.12.1-rc2

- \*: don't use go embed to make using custom files easier
- crypto: add certificate discovery to automatically import certificates from lets encrypt
- crypto: fix default API not having an ordering
- outposts: always trigger outpost reconcile on startup
- outposts/ldap: Rework/improve LDAP search logic. (#1687)
- outposts/proxy: make logging fields more consistent
- outposts/proxy: re-add rs256 support
- providers/proxy: fix defaults for traefik integration
- providers/proxy: use wildcard for traefik headers copy
- providers/saml: fix error when using post bindings and user freshly logged in
- providers/saml: fix IndexError in signature check
- sources/ldap: add optional tls verification certificate
- sources/ldap: allow multiple server URIs for loadbalancing and failover
- sources/ldap: don't cache LDAP Connection, use random server
- sources/ldap: handle typeerror during creation of objects when using wrong keyword params
- sources/plex: fix plex token being included in event log
- stages/prompt: fix error when both default and required are set
- web/admin: add spinner to table refresh button to show progress
- web/admin: don't show disabled http basic as red
- web/admin: fix wrong description for reputation policy
- web/flows: fix linting errors
- web/flows: Revise duo authenticator login prompt text (#1872)

## Fixed in 2021.12.1-rc3

- core: add FlowToken which saves the pickled flow plan, replace standard token in email stage to allow finishing flows in different sessions
- core: fix missing permission check for group creating when creating service account
- outposts/ldap: Fix search case sensitivity. (#1897)
- policies/expression: add ak\_call\_policy
- providers/saml: add ?force\_binding to limit bindings for metadata endpoint
- root: add request\_id to celery tasks, prefixed with "task-"
- sources/\*: Allow creation of source connections via API
- stages/prompt: use policyenginemode all
- tests/e2e: add post binding test
- web: fix duplicate classes, make generic icon clickable
- web: fix text color for bad request on light mode
- web/admin: show outpost warning on application page too
- web/elements: close dropdown when refresh event is dispatched
- web/user: allow custom font-awesome icons for applications

## Fixed in 2021.12.1-rc4

- core: fix error when using invalid key-values in attributes query
- flows: fix error in inspector view
- flows: fix error when trying to print FlowToken objects
- lib: correctly report "faked" IPs to sentry
- outposts: add additional checks for websocket connection
- outposts: cleanup logs for failed binds
- outposts: don't try to create docker client for embedded outpost
- outposts: fix docker controller not stopping containers
- outposts: fix unlabeled transaction
- outposts: handle RuntimeError during websocket connect
- outposts: rewrite re-connect logic without recws
- outposts: set display name for outpost service account
- outposts/ldap: fix searches with mixed casing
- outposts/proxy: use filesystem storage for non-embedded outposts
- policies: don't always clear application cache on post\_save
- stages/authenticator\_webauthn: remove pydantic import
- web: fix borders of sidebars in dark mode

## Fixed in 2021.12.1-rc5

- crypto: add additional validation before importing a certificate
- events: add flow\_execution event type
- events: fix schema for top\_per\_user
- flows: fix wrong exception being caught in flow inspector
- outposts: reset backoff after successful connect
- outposts/proxy: fix securecookie: the value is too long again, since it can happen even with filesystem storage
- providers/oauth2: add additional logging to show with token path is taken
- providers/oauth2: use generate\_key instead of uuid4
- sources/ldap: fix incorrect task names being referenced, use source native slug
- sources/oauth: add initial okta type
- sources/oauth: allow oauth types to override their login button challenge
- sources/oauth: implement apple native sign-in using the apple JS SDK
- sources/oauth: strip parts of custom apple client\_id
- stages/authenticator\_webauthn: make user\_verification configurable
- stages/identification: fix miscalculated sleep
- stages/invitation: use GroupMemberSerializer serializer to prevent all of the user's groups and their users from being returned
- web: add link to open API Browser for API Drawer
- web/admin: add dashboard with user creation/login statistics
- web/admin: fix invalid display for LDAP Source sync status
- web/admin: fix rendering for applications on view page
- web/admin: fix rendering of applications with custom icon
- web/admin: improve wording for froward\_auth, don't show setup when using proxy mode
- web/admin: show warning when deleting currently logged in user
- web/admin: update overview page
- web/flows: fix error when attempting to enroll new webauthn device

## Fixed in 2021.12.1

- core: fix error when attempting to provider from cached application
- events: improve app lookup for event creation
- internal: cleanup duplicate and redundant code, properly set sentry SDK scope settings
- lifecycle: add -Ofair to celery
- web/admin: add sidebar to applications
- web/admin: fix notification unread colors not matching on user and admin interface
- web/admin: fix stage related flows not being shown in a list
- web/elements: add Markdown component to improve rendering
- web/elements: add support for sidebar on table page
- web/elements: close notification drawer when clearing all notifications

## Fixed in 2021.12.2

- core: don't rotate non-api tokens
- crypto: fix private keys not being imported correctly
- outposts: release binary outposts (#1954)
- outposts/proxy: match skipPathRegex against full URL on domain auth
- policies/password: add minimum digits
- providers/oauth2: don't rely on expiry task for access codes and refresh tokens
- sources/oauth: allow writing to user in SourceConnection
- web: ignore instantSearchSDKJSBridgeClearHighlight error on edge on iOS
- web/admin: fix background color for application sidebar
- web/elements: fix border between search buttons

## Fixed in 2021.12.3

- \*: revert to using GHCR directly
- core: fix error when getting launch URL for application with non-existent Provider
- internal: fix sentry sample rate not applying to proxy
- internal: rework global logging settings, embedded outpost no longer overwrites core
- outpost: re-run globalSetup when updating config, allowing for live log level changes
- outposts: handle/ignore http Abort handler
- outposts/ldap: fix log formatter and level not being set correctly
- outposts/proxy: add initial redirect-loop prevention
- outposts/proxy: fix allowlist for forward\_auth and traefik
- outposts/proxy: fix ping URI not being routed
- outposts/proxy: fix session not expiring correctly due to miscalculation
- root: allow trace log level to work for core/embedded
- root: don't set secure cross opener policy
- root: drop redis cache sentry errors
- root: fix inconsistent URL quoting of redis URLs
- web/admin: add outpost type to list
- web/admin: auto set the embedded outpost's authentik\_host on first view
- web/admin: don't auto-select certificate for LDAP source verification
- web/admin: fix border for outpost health status

## Fixed in 2021.12.4

- crypto: improve handling for non-rsa private keys
- events: create test notification with event with data
- internal: add custom proxy certificates support to embedded outpost
- policies: fix application cache not being cleared correctly
- providers/oauth2: remove jwt\_alg field and set algorithm based on selected keypair, select HS256 when no keypair is selected
- stages/authenticator\_validate: add passwordless login
- stages/authenticator\_validate: fix prompt not triggering when using in non-authentication context
- stages/authenticator\_validate: refuse passwordless flow if flow is not for authentication
- tenants: add web certificate field, make authentik's core certificate configurable based on keypair
- web/admin: fix explore integration not opening in new tab
- web/elements: fix link from notification drawer not working in user interface
- web/user: fix user details not rendering when loading to a different user settings tab and then switching

## Fixed in 2021.12.5

- \*: use py3.10 syntax for unions, remove old Type\[] import when possible
- core: add API endpoint to directly set user's password
- core: add error handling in source flow manager when flow isn't applicable
- core: fix UserSelfSerializer's save() overwriting other user attributes
- core: prevent LDAP password being set for internal hash upgrades
- crypto: return private key's type (required for some oauth2 providers)
- flows: add test helpers to simplify and improve checking of stages, remove force\_str
- flows: don't create EventAction.FLOW\_EXECUTION
- flows: update default flow titles
- flows: use WithUserInfoChallenge for AccessDeniedChallenge
- lib: strip values for timedelta from string
- outposts: add remote docker integration via SSH
- outposts: fix outpost's sentry not sending release
- outposts: include outposts build hash in state
- outposts/proxy: add support for multiple states, when multiple requests are redirect at once
- outposts/proxy: fix error checking for type assertion
- policies/reputation: rework reputation to use a single entry, include geo\_ip data
- sources/oauth: add additional scopes field to get additional data from provider
- sources/oauth: fix github provider not including correct base scopes
- stages/identification: add field for passwordless flow
- tenants: forbid creation of multiple default tenants
- web: add tr to locale
- web: remove page header color, match user navbar to admin sidebar
- web/admin: add Admin in titlebar for admin interface
- web/admin: fix alignment in outpost list when expanding rows
- web/admin: fix display when groups/users don't fit on a single row
- web/admin: include key type in list
- web/admin: mark additional scopes as non-required
- web/admin: show flow title in list
- web/elements: fix alignment of chipgroup on modal add
- web/elements: fix spacing between chips in chip-group
- web/elements: re-enable codemirror line numbers (fixed on firefox)
- web/flows: add workaround for autofocus not working in password stage
- web/flows: fix duplicate loading spinners when using webauthn
- web/flows: fix helper form not being removed from identification stage (improve password manager compatibility)
- web/flows: include user in access denied stage
- web/flows: only add helper username input if using native shadow dom to prevent browser confusion
- web/user: add language selection
- web/user: rework user source connection UI

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.12 from [here](https://goauthentik.io/version/2021.12/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2021.12.1
```

---

## Release 2021.2

## Headline Changes

- Managed objects

  Objects like property mappings can now be marked as managed, which means that they will be created, updated and deleted by authentik.

  Currently, this is used to update default property mappings, and mark tokens and users generated by outposts.

- Improved support for different LDAP Servers

  The LDAP source has improved support for non-Active Directory LDAP setups. This includes the following changes:

  - Switch to sync membership from groups to users rather than user to group
  - Fix users, which were removed from a group in LDAP not being removed from said group
  - Add support for LDAP servers which have core fields declared as lists
  - Add property-mappings for groups, to map attributes like `name` or `is_superuser`

- Add test view to debug property-mappings.

## Fixes

- admin: add test view for property mappings
- core: Fix application cache not being cleared correctly (and not being ignored for searches)
- events: add send\_once flag to send webhooks only once
- events: allow searching by event id
- events: don't log successful system tasks
- events: improve information sent in notification emails
- providers/oauth2: pass application to configuration error event
- providers/saml: fix imported provider not saving properties correctly
- root: use filtering\_bound\_logger for speed improvements
- stages/consent: fix wrong widget for expire
- web: migrate Provider List to SPA

## Fixed in 2021.2.1-rc2

- admin: add Certificate-Keypair generation
- admin: fix property-mapping views redirecting to invalid URL
- admin: improve layout for policy testing
- admin: remove old provider list view
- outpost: cap reconnect backoff at 60 seconds, reset backoff on successful connection
- policies: add debug flag to PolicyRequest to prevent alerts from testing policies
- providers/saml: force-set friendly\_name to empty string for managed mappings
- root: add dedicated live and readiness healthcheck views
- web: fix link to provider list on overview page
- web: fix outpost item in sidebar being active on service connection views

## Fixed in 2021.2.1-stable

- admin: fix link in source list
- web: rebuild Outposts list in SPA
- outposts: Fix reconnect not working reliably
- providers/oauth2: add authorized scopes to AUTHORIZE\_APPLICATION event
- providers/oauth2: add unofficial groups attribute to default profile claim
- web: fix sidebar being active when stage prompts is selected

## Fixed in 2021.2.2-stable

- crypto: move certificate and key data to separate api calls to create events
- events: rename context.token to context.secret
- events: rename token\_view to secret\_view
- lib: fix stacktrace for general expressions
- outposts: fix ProxyProvider update not triggering outpost update
- policies: skip cache on debug request
- providers/proxy: fix certificates without key being selectable
- root: log runtime in milliseconds
- sources/\*: switch API to use slug in URL
- sources/ldap: add API for sync status
- sources/oauth: add callback URL to api
- web: fix ModalButton working in global scope, causing issues on 2nd use

## Fixed in 2021.2.3-stable

- core: fix tokens using wrong lookup
- web: fix missing source create button

## Fixed in 2021.2.4-stable

- admin: fix missing success\_urls causing errors on create/update forms
- core: fix typo in user settings causing sources to not show

## Fixed in 2021.2.5-stable

- admin: fix policy list not having a refresh button
- events: pass Event's user to Notification policy engine when present
- helm: add initial wait for healthcheck
- outpost: improve logging output, ensure fields match api server
- root: fix request\_id not being logged for actual asgi requests
- sources/oauth: fix buttons not being ak-root-link
- web: fix library not being full height, again
- web: fix outpost edit/delete buttons
- web: fix SiteShell breaking links when handlers are updated twice

## Fixed in 2021.2.6-stable

- admin: fix missing success\_url for Cache clean views
- events: fix error when event can't be loaded in rule task
- flows: handle error when app cannot be found during flow import
- policies: sort groups in GroupMembershipPolicy policy and binding
- providers/oauth2: fix error when no login event could be found
- sources/ldap: fix API error when source has not synced yet
- sources/ldap: fix password setter on users which are not LDAP
- web: add sentry CaptureConsole
- web: fix colourstyles not being included in common\_styles

## Upgrading

This release does not introduce any new requirements.

Due to the switch to managed objects, some default property mappings are changing. This affects only the SAML Provider.

The change affects the "SAML Name" property, which has been changed from an oid to a Schema URI to aid readability.

The integrations affected are:

- [Ansible Tower/AWX](/integrations/services/awx-tower/)
- [GitLab](/integrations/services/gitlab/)
- [NextCloud](/integrations/services/nextcloud/)
- [Rancher](/integrations/services/rancher/)
- [Sentry](/integrations/services/sentry/)

### docker-compose

Download the docker-compose file for 2021.2 from [here](https://goauthentik.io/version/2021.2/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.

### Kubernetes

Run `helm repo update` and then upgrade your release with `helm upgrade authentik authentik/authentik --devel -f values.yaml`.

---

## Release 2021.3

## Headline Changes

- WebAuthn support

  This release introduces support for [WebAuthn](https://webauthn.io/), an open standard for the use of hardware authentication keys like YubiKeys on the web.

  You can configure a WebAuthn device using the "WebAuthn Authenticator Setup Stage" stage. Afterwards, it can be used as an n-th factor, just like TOTP authenticators.

- Simplify role-based access

  Instead of having to create a Group Membership policy for every group you want to use, you can now select a Group and even a User directly in a binding.

  When a group is selected, the binding behaves the same as if a Group Membership policy exists.

  When a user is selected, the binding checks the user of the request, and denies the request when the user doesn't match.

  Group Membership policies are automatically migrated to use this simplified access.

- Invisible reCAPTCHA

  The checkbox-based reCAPTCHA has been replaced with [reCAPTCHA v2 Invisible](https://developers.google.com/recaptcha/docs/invisible).

  This is a breaking change, as a set of reCAPTCHA keys are only valid for a single type. For this, go to [https://www.google.com/recaptcha/admin](https://www.google.com/recaptcha/admin) and create a new set of keys with the "reCAPTCHA v2" type and "Invisible reCAPTCHA badge" mode.

- Migration of Flow Executor to SPA/API

  The flow executor has been migrated to a full SPA/API architecture. This was required for WebAuthn, but also allows for greater customizability.

  It also allows other services to use the flow executor via an API, which will be used by the outpost further down the road.

- Deny stage

  A new stage which simply denies access. This can be used to conditionally deny access to users during a flow. Authorization flows for example required an authenticated user, but there was no previous way to block access for un-authenticated users.

  If you conditionally include this stage in a flow, make sure to disable "Evaluate on plan", as that will always include the stage in the flow, regardless of the inputs.

## Fixed in 2021.3.2

- sources/ldap: fix sync for Users without pwdLastSet
- web: fix date display issue
- web: fix submit in Modal reloading page in firefox

## Fixed in 2021.3.3

- providers/oauth2: allow protected\_resource\_view when method is OPTIONS
- stages/authenticator\_static: fix error when disable static tokens
- stages/authenticator\_webauthn: add missing migration
- web: fix Colors for user settings in dark mode
- web: fix Flow executor not showing spinner when redirecting
- web: fix Source icons not being displayed on firefox
- web: fix styling for static token list

## Fixed in 2021.3.4

- admin: include git build hash in gh-\* tags and show build hash in admin overview
- events: don't fail on boot when geoip can't be opened
- helm: add initial geoip
- outposts: improve logs for outpost connection
- policies: fix error when clearing policy cache when no policies are cached
- root: add comment for error reporting to compose
- root: add geoip config to docker-compose
- sources/oauth: fix error on user enrollment when no enrollment flow is defined
- web: add close button to messages
- web: backport fix: add missing background filter
- web: fix outpost health display
- web: fix path for fallback flow view
- web: fix system task index
- web: improve compatibility with password managers
- web: improve layout of expanded event info
- web: improve styling for application list
- web: prevent duplicate messages
- web: show related edit button for bound stages and policies
- web: use chunking for vendor and api
- web: use loadingState for autosubmitStage
- web: use sections in sidebar, adjust coloring

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.3 from [here](https://goauthentik.io/version/2021.3/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.

### Kubernetes

Run `helm repo update` and then upgrade your release with `helm upgrade authentik authentik/authentik --devel -f values.yaml`.

---

## Release 2021.4

## Headline Changes

- Configurable Policy engine mode

  In the past, all objects, which could have policies attached to them, required *all* policies to pass to consider an action successful.
  You can now configure if *all* policies need to pass, or if *any* policy needs to pass.

  This can now be configured for the following objects:

  - Applications (access restrictions)
  - Sources
  - Flows
  - Flow-stage bindings

  For backwards compatibility, this is set to *all*, but new objects will default to *any*.

- Expiring Events

  Previously, events would stay in the database forever, and had to eventually be cleaned up manually. This version add expiry to events with a default
  timeout of 1 Year. This also applies to existing events, and their expiry will be set during the migration.

- New UI

  While the UI mostly looks the same, under the hood a lot has changed. The Web UI is now a Single-page application based on rollup and lit-html. This has several consequences and new features, for example:

  - You can now see a user's OAuth Access/Refresh tokens and the consents they've given
  - You can now see a per-object changelog based on the model\_create/update/delete events being created.
  - A new API Browser is available under `https://authentink.company/api/v2beta/`
  - Several new charts, new pages and quality-of-life improvements
  - Credentials of objects are no longer shown while editing them

- Deprecated Group membership has been removed.

## Minor changes

- You can now specify the amount of processes started in docker-compose using the `WORKERS` environment variable.

## Fixed in 2021.4.2

- core: fix propertymapping API returning invalid value for components ([https://github.com/goauthentik/authentik/issues/746](https://github.com/goauthentik/authentik/issues/746))
- core: improve messaging when creating a recovery link for a user when no recovery flow exists
- flows: annotate flows executor 404 error
- flows: include configure\_flow in stages API
- helm: make storage class, size and mode configurable
- helm: turn off monitoring by default ([https://github.com/goauthentik/authentik/issues/741](https://github.com/goauthentik/authentik/issues/741))
- outposts: fix errors when creating multiple outposts
- root: add restart: unless-stopped to compose
- root: base Websocket message storage on Base not fallback
- root: fix healthcheck part in docker-compose
- root: fix setting of EMAIL\_USE\_TLS and EMAIL\_USE\_SSL
- sources/ldap: improve error handling during sync
- sources/oauth: fix error when creating an oauth source which has fixed URLs
- sources/oauth: fix resolution of sources' provider type
- web: fix background-color on router outlet on light mode
- web/admin: fix error when user doesn't have permissions to read source
- web/admin: fix errors in user profile when non-superuser

## Fixed in 2021.4.3

- \*: add model\_name to TypeCreate API to distinguish between models sharing a component
- api: fix CSRF error when using POST/PATCH/PUT in API Browser
- api: make 401 messages clearer
- api: mount outposts under outposts/instances to match flows
- core: add parameter to output property mapping test result formatted
- core: add superuser\_full\_list to applications list, shows all applications when superuser
- core: fix Tokens being created with incorrect intent by default
- outposts: don't run outpost\_controller when no service connection is set
- providers/oauth2: Set CORS Headers for token endpoint, check Origin header against redirect URLs
- root: auto-migrate on startup, lock database using pg\_advisory\_lock
- sources/oauth: add login with plex support
- sources/oauth: fix redirect loop for source with non-configurable URLs
- sources/oauth: save null instead of empty string for sources without configurable URLs
- web/admin: add ability to add users to a group whilst creating a group
- web/admin: fix default for codemirror
- web/admin: fix group member table order
- web/admin: fix non-matching provider type being selected when creating an OAuth Source
- web/admin: fix provider type resetting when changing provider type
- web/admin: fix undefined being shown when viewing application
- web/admin: improve default selection for property-mappings

## Fixed in 2021.4.4

- \*: make tasks run every 60 minutes not :00 every hour
- outposts: check for X-Forwarded-Host to switch context
- outposts: improve update performance
- outposts: move local connection check to task, run every 60 minutes
- providers/oauth2: add proper support for non-http schemes as redirect URIs
- providers/oauth2: fix TokenView not having CORS headers set even with proper Origin
- sources/oauth: fix error whilst fetching user profile when source uses fixed URLs
- sources/oauth: handle error in AzureAD when ID Can't be extracted
- stages/user\_login: add default backend
- web: fix title not being loaded from config
- web: only report http errors for 500 and above
- web: send response info when response is thrown
- web/admin: add description for fields in proxy provider form
- web/admin: adjust phrasing of cards on overview page
- web/admin: fix display for user supseruser status
- web/admin: fix error when me() returns 403
- web/admin: fix error when updating identification stage
- web/admin: fix invalid group member count
- web/admin: fix link to providers on overview page
- web/admin: fix mismatched required tags
- web/admin: improve phrasing for Policy bindings
- web/admin: only allow policies to be bound to sources as users/groups cannot be checked
- web/admin: only pre-select items when creating a new object
- web/flows: fix Sentry not being loaded correctly

## Fixed in 2021.4.5

- core: fix text on error pages being hard to read
- outposts: only kill docker container if its running
- root: add middleware to properly report websocket connection to sentry
- root: don't use .error of structlog to not send to sentry
- stages/email: catch ValueError when global email settings are invalid
- stages/invitation: accept token from prompt\_data
- stages/invitation: fix token not being loaded correctly from query string
- web: fix text-color for form help text
- web: ignore network errors for sentry
- web/admin: don't show docker certs as required
- web/flows: fix redirect loop when sentry is enabled on flow views
- web/flows: include ShadyDOM, always enable ShadyDOM for flow interface, improve compatibility with password
- web/flows/identification: fix phrasing account recovery

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.4 from [here](https://goauthentik.io/version/2021.4/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Run `helm repo update` and then upgrade your release with `helm upgrade authentik authentik/authentik -f values.yaml`.

---

## Release 2021.5

## Headline Changes

- LDAP Provider

This feature is still in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues)

You can now configure an LDAP Provider for applications that don't support any newer protocols or require LDAP.

All users and groups in authentik's database are searchable. Currently, there is a limited support for filters (you can only search for objectClass), but this will be expanded in further releases.

Binding against the LDAP Server uses a flow in the background. This allows you to use the same policies and flows as you do for web-based logins. The only limitation is that currently only identification and password stages are supported, due to how LDAP works.

- Compatibility with forwardAuth/auth\_request

  The authentik proxy is now compatible with forwardAuth (traefik) / auth\_request (nginx). All that is required is the latest version of the outpost,
  and the correct config from [here](../../add-secure-apps/providers/proxy/forward_auth.mdx).

- Docker images for ARM

  Docker images are now built for amd64 and arm64.

- Reduced setup complexity

  The authentik server now requires less containers. The static container (as well as the traefik when using docker-compose) are no longer required. As the first stage of a migration to Golang instead of Python, authentik now runs behind an in-container reverse proxy, which hosts the static files.

- New Plex authentication source

  The plex source (previously a provider for the OAuth Source) has been rewritten to a dedicated Source.

  You can now limit access to authentik based on which servers a Plex user is member of.

- Configurable source behavior

  You can now configure how a source behaves after the user has authenticated themselves to the source. Previously, authentik always checked the unique identifier from the source, enrolled the user when the identifier didn't exist and authenticated the user otherwise.

  Now you can configure how the matching should be done:

  - Identifier: Keeps the old behavior, can lead to duplicate user accounts
  - Email (link): If a user with the same Email address exists, they are linked. Can have security implications when a source doesn't validate email addresses.
  - Email (deny): Deny the flow if the Email address is already used.
  - Username (link): If a user with the same username address exists, they are linked. Can have security implications when a username is used with another source.
  - Username (deny): Deny the flow if the username address is already used.

## Minor changes

- Improved compatibility of the flow interface with password managers.
- Improved compatibility when using SAML Sources with a redirect binding.
- Improved configurability of outpost docker image name for managed Outposts.
- Add customization of access code validity for OAuth2 Providers.
- Add ability to configure no login fields on identification stage to only allow logins with Sources.
- Add single-use flag for invitations to delete token after use.
- Fix sidebar not collapsible on mobile.

## Fixed in 2021.5.2

- core: fix application's slug field not being set to unique
- flows: fix error when using cancel flow
- lib: Fix config loading of secrets from files (#887)
- lib: fix parsing of remote IP header when behind multiple reverse proxies
- lifecycle: check if group of docker socket exists
- lifecycle: fix error when worker is not running as root
- outposts: fix error when controller loads from cache but cache has expired
- outposts: fix missing default for OutpostState.for\_channel
- outposts: fix reload notification not working due to wrong ID being cached
- outposts/ldap: fix AUTHENTIK\_INSECURE not being respected for API client during bind
- outposts/proxy: fix error redeeming code when using non-standard ports
- outposts/proxy: fix insecure TLS Skip
- providers/ldap: use username instead of name for user dn (#883)
- providers/proxy: connect ingress to https instead of http
- root: only load debug secret key when debug is enabled
- web: fix chunks overwriting each other
- web/admin: add notice for LDAP Provider's group selection
- web/admin: fix PropertyMappings not loading correctly
- website/docs: add example ldapsearch command

## Fixed in 2021.5.3

- outposts: fix update signal not being sent to correct instances
- providers/oauth2: fix double login required when prompt=login
- providers/proxy: fix redirect\_uris not always being set on save
- sources/plex: force setting of plex token
- web: fix t.reset is not a function
- web: remove nginx config, add caching headers to static files
- web/admin: fix flow form not loading data

## Fixed in 2021.5.4

- providers/oauth2: add missing kid header to JWT Tokens
- stages/authenticator\_\*: fix Permission Error when disabling Authenticator as non-superuser
- web: fix missing flow and policy cache clearing UI
- web: set x-forwarded-proto based on upstream TLS Status

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.5 from [here](https://goauthentik.io/version/2021.5/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

The public port of the compose stack has been changed from 443 to 9000 and 9443 to prevent port contention.

### Kubernetes

The helm chart has been rewritten by [@dirtycajunrice](https://github.com/dirtycajunrice) and now lives on `https://charts.goauthentik.io`.

Please upgrade to the new chart using values from [ArtifactHub](https://artifacthub.io/packages/helm/goauthentik/authentik).

The old repository will still exist for backwards-compatibility.

---

## Release 2021.6

## Headline Changes

- Duo two-factor support

  You can now add the new `authenticator_duo` stage to configure Duo authenticators. Duo has also been added as device class to the `authenticator_validation` stage.

  Currently, only Duo push notifications are supported. Because no additional input is required, Duo also works with the LDAP Outpost.

- Multi-tenancy

  This version adds soft multi-tenancy. This means you can configure different branding settings and different default flows per domain.

  This also changes how a default flow is determined. Previously, for defaults flow, authentik would pick the first flow that

  - matches the required designation
  - comes first sorted by slug
  - is allowed by policies

  Now, authentik first checks if the current tenant has a default flow configured for the selected designation. If not, it behaves the same as before, meaning that if you want to select a default flow based on policy, you can just leave the tenant default empty.

- Domain-level authorization with proxy providers

  Instead of simply being able to toggle between forward auth and proxy mode, you can now enable forward auth for an entire domain. This has the downside that you can't do per-application authorization, but also simplifies configuration as you don't have to create each application in authentik.

- API Schema now uses OpenAPI v3

  The API endpoints are mostly the same, however all the clients are now built from an OpenAPI v3 schema. You can retrieve the schema from `authentik.company.tld/api/v2beta/schema/`

- On Kubernetes installs without a /media PVC, you can now set URLs instead of uploading files.

- Expanded prometheus metrics for PolicyEngine and FlowPlanner

## Minor changes

- You can now specify which sources should be shown on an Identification stage.
- Add UI for the reputation of IPs and usernames for reputation policies.
- Fix proxy outpost not being able to redeem tokens when using with an un-trusted SSL Certificate
- Add UI to check access of any application for any user

## Fixed in 2021.6.1-rc5

- flows: fix configuration URL being set when no flow is configured
- stages/authenticator\_totp: set TOTP issuer based on slug'd tenant title
- stages/authenticator\_webauthn: use tenant title as RP\_NAME
- stages/identification: add UPN
- stages/password: add constants for password backends
- web: fix flow download link

## Fixed in 2021.6.1-rc6

- ci: build and push stable tag when rc not in release name
- core: delete real session when AuthenticatedSession is deleted
- core: fix impersonation not working with inactive users
- core: fix upload api not checking clear properly
- core: revert check\_access API to get to prevent CSRF errors
- events: add tenant to event
- events: catch unhandled exceptions from request as event, add button to open github issue
- flows: fix error clearing flow background when no files have been uploaded
- outpost: fix syntax error when creating an outpost with connection
- outposts: fix integrity error with tokens
- outposts/ldap: improve responses for unsuccessful binds
- policies/reputation: fix race condition in tests
- provider/proxy: mark forward\_auth flag as deprecated
- providers/saml: improve error handling for signature errors
- root: fix build\_hash being set incorrectly for tagged versions
- sources/saml: check sessions before deleting user
- stages/authenticator\_duo: don't create default duo stage
- stages/authenticator\_validate: add tests for authenticator validation
- stages/identification: fix challenges not being annotated correctly and API client not loading data correctly
- web: add capabilities to sentry event
- web: migrate banner to sidebar
- web/admin: fix user enable/disable modal not matching other modals
- web/admin: select service connection by default when only one exists
- web/flows: fix expiry not shown on consent stage when loading
- web/flows: fix IdentificationStage's label not matching fields
- web/flows: improve display of allowed fields for identification stage
- website/docs: add docs for outpost configuration

## Fixed in 2021.6.1

- core: fix error getting stages when enrollment flow isn't set
- core: fix error when creating AuthenticatedSession without key
- flows: fix error when stage has incorrect type
- providers/saml: add support for NameID type unspecified
- providers/saml: fix error when getting transient user identifier
- providers/saml: fix NameIDPolicy not being parsed correctly
- recovery: fix error when creating multiple keys for the same user
- stages/authenticator\_duo: fix error when enrolling an existing user
- stages/authenticator\_duo: make Duo-admin viewset writeable
- website/docs: remove migrate command

## Fixed in 2021.6.2

- core: add support for custom urls for avatars
- core: deepmerge user.group\_attributes, use group\_attributes for user settings
- core: fix PropertyMapping's globals not matching Expression policy
- core: remove default flow background from default css, set static in base\_full and dynamically in if/flow
- crypto: catch error when loading private key
- flows: make flow plan cache timeout configurable
- outposts: fix port and inner\_port being mixed on docker controller
- outposts/proxy: fix additionalHeaders not being set properly
- policies: don't use policy cache when checking application access
- policies: make policy result cache timeout configurable
- root: allow loading local /static files without debug flag
- root: make general cache timeouts configurable
- root: remove old traefik labels
- root: save temporary database dump in /tmp
- root: set outposts.docker\_image\_base to gh-master for tests
- stages/authenticator\_validate: fix error when using not\_configured\_action=configure
- tenants: fix tenant not being queried correctly when using accessing over a child domain
- web/admin: fix tenant's default flag not being saved
- web/admin: handle elements in slot=form not being forms
- web/admin: sort inputs on authenticator validation stage form

## Fixed in 2021.6.3

- api: use partition instead of split for token
- core: fix flow background not correctly loading on initial draw
- events: add ability to create events via API
- events: ignore notification non-existent in transport
- events: only create SYSTEM\_EXCEPTION event when error would've been sent to sentry
- expressions: fix regex\_match result being inverted
- flows: add FlowStageBinding to flow plan instead of just stage
- flows: add invalid\_response\_action to configure how the FlowExecutor should handle invalid responses
- flows: handle possible errors with FlowPlans received from cache
- outposts: check docker container ports match
- outposts/ldap: fixed IsActive and IsSuperuser returning swapped incorrect values (#1078)
- providers/oauth2: fix exp of JWT when not using seconds
- sources/ldap: improve error handling when checking for password complexity on non-ad setups
- stages/authenticator\_duo: fix component not being set in API
- stages/prompt: ensure hidden and static fields keep the value they had set
- stages/user\_write: add flag to create new users as inactive
- tenants: include all default flows in current\_tenant
- web/admin: fix deletion of authenticator not reloading the state correctly
- web/admin: fix only recovery flows being selectable for unenrollment flow in tenant form
- web/admin: fix text color on pf-c-card

## Fixed in 2021.6.4

- core: only show `Reset password` link when recovery flow is configured
- crypto: show both sha1 and sha256 fingerprints
- flows: handle old cached flow plans better
- g: fix static and media caching not working properly
- outposts: fix container not being started after creation
- outposts: fix docker controller not checking env correctly
- outposts: fix docker controller not checking ports correctly
- outposts: fix empty message when docker outpost controller has changed nothing
- outposts: fix permissions not being set correctly upon outpost creation
- outposts/ldap: add support for boolean fields in ldap
- outposts/proxy: always redirect to session-end interface on sign\_out
- providers/oauth2: add revoked field, create suspicious event when previous token is used
- providers/oauth2: deepmerge claims
- providers/oauth2: fix CORS headers not being set for unsuccessful requests
- providers/oauth2: use self.expires for exp field instead of calculating it again
- sources/oauth: create configuration error event when profile can't be parsed as json
- stages/user\_write: add wrapper for post to user\_write
- web/admin: fix ModelForm not re-loading after being reset
- web/admin: show oauth2 token revoked status

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.6 from [here](https://goauthentik.io/version/2021.6/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Upgrade to the latest chart version to get the new images.

---

## Release 2021.7

## Headline Changes

- SSL Support for LDAP Providers

  You can now configure certificates for your LDAP Providers, meaning that all communication will be done encrypted.

  Currently, only SSL on port 636 is supported, not StartTLS.

- Add bundled docs

  You can now browse the authentik docs for your version by browsing to `/help`. This means you don't have to rely on an
  internet connection to check the docs, and you also have the correct docs for your currently running version.

## Minor changes

- api: Tunnel Sentry requests through authentik to prevent them being blocked by ad-blockers
- core: fix error when setting icon/background to url longer than 100 chars
- events: fix error when slack notification request failed without a response
- flows: allow variable substitution in flow titles
- outposts/ldap: Fix LDAP outpost missing a `member` field on groups with all member DNs
- outposts/ldap: Fix LDAP outpost not parsing arrays from user and group attributes correctly
- providers/oauth2: allow blank redirect\_uris to allow any redirect\_uri
- providers/saml: fix parsing of POST bindings
- root: add PROXY protocol support for http, https, ldap and ldaps servers
- root: Allow configuration of Redis port
- root: set samesite to None for SAML POST flows
- root: subclass SessionMiddleware to set Secure and SameSite flag depending on context
- web: fix error when showing error message of request

## Fixed in 2021.7.1-rc2

- core: add email filter for user
- core: add group filter by member username and pk
- core: broaden error catching for propertymappings
- lib: fix outpost fake-ip not working, add tests
- outpost: fix 100% CPU Usage when not connected to websocket
- outposts: ensure outpost SAs always have permissions to fake IP
- outposts: fix git hash not being set in outposts
- outposts: save certificate fingerprint and check before re-fetching to cleanup logs
- outposts/ldap: add tracing for LDAP bind and search
- outposts/ldap: improve parsing of LDAP filters
- outposts/ldap: optimize backend Search API requests
- outposts/proxy: add X-Auth-Groups header to pass groups
- providers/oauth2: handler PropertyMapping exceptions and create event
- providers/saml: improve error handling for property mappings
- sources/ldap: improve error handling for property mappings
- web: fix icon flashing in header, fix notification header icon in dark mode
- web: separate websocket connection from messages
- web/admin: fix missing dark theme for notifications
- web/admin: fix negative count for policies when more cached than total policies
- web/admin: improve UI for notification toggle
- website/docs: clear up outpost uuids
- website/docs: remove duplicate proxy docs

## Fixed in 2021.7.1

- core: add tests for flow\_manager
- core: fix CheckApplication's for\_user flag not being checked correctly
- core: fix pagination not working correctly with applications API
- providers/oauth2: fix blank redirect\_uri not working with TokenView
- root: add code of conduct and PR template
- root: add contributing file
- tenants: make event retention configurable on tenant level
- tenants: set tenant uuid in sentry
- web/admin: add notice for event\_retention
- web/admin: add status card for https and timedrift
- web/admin: default to authentication flow for LDAP provider
- web/admin: fix ApplicationView's CheckAccess not sending UserID correctly
- website/docs: add go requirement
- website/docs: update terminology for dark mode

## Fixed in 2021.7.2

- ci: fix sentry sourcemap path
- e2e: fix broken selenium by locking images
- events: ensure fallback result is set for on\_failure
- events: remove default result for MonitoredTasks, only save when result was set
- flows: don't check redirect URL when set from flow plan (set from authentik or policy)
- flows: fix unhandled error in stage execution not being logged as SYSTEM\_EXCEPTION event
- outpost: bump timer for periodic config reloads
- outposts: catch invalid ServiceConnection error in outpost controller
- providers/oauth2: fix error when requesting jwks keys with no rs256 set
- providers/proxy: fix hosts for ingress not being compared correctly
- providers/saml: fix Error when getting metadata for invalid ID
- providers/saml: fix metadata being inaccessible without authentication
- sources/ldap: improve ms-ad password complexity checking
- sources/plex: add background task to monitor validity of plex token
- stages/email: fix error when re-requesting email after token has expired
- stages/invitation: delete invite only after full enrollment flow is completed
- web/admin: add re-authenticate button for plex
- web/admin: add UI to copy invitation link
- web/admin: fix empty column when no invitation expiry was set
- web/admin: fix LDAP Provider bind flow list being empty
- web/admin: fully remove response cloning due to errors

## Fixed in 2021.7.3

- core: fix users not being able to update their profile
- lifecycle: decrease default worker count on compose
- providers/saml: fix error when WantAssertionsSigned is missing
- providers/saml: fix error when PropertyMapping return value isn't string
- web/admin: fix user's email field being required
- web/admin: fix source form's userMatchingMode being swapped

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.7 from [here](https://goauthentik.io/version/2021.7/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Upgrade to the latest chart version to get the new images.

---

## Release 2021.8

## Headline Changes

- Embedded Outpost

  To simplify the setup, an embedded outpost has been added. This outpost runs as part of the main authentik server, and requires no additional setup.

  You can simply assign providers to the embedded outpost, and either use the integrations to configure reverse proxies, or point your traffic to the main authentik server.
  Traffic is routed based on host-header, meaning every host that has been configured as a provider and is assigned to the embedded proxy will be sent to the outpost, and every sub-path under `/outpost.goauthentik.io` is sent to the outpost too. The rest is sent to authentik itself.

- App passwords

  You can now create Tokens with the intent `app_password`, and use them when authenticating with a flow. This requires the `User database + app passwords` backend in your password stage (this is done automatically on upgrade).

  You will also see in the logs which backend was used as the `auth_method` and `auth_method_args` arguments on the Event.

## Minor changes

- admin: add API to show embedded outpost status, add notice when its not configured properly
- api: ensure all resources can be filtered
- api: make all PropertyMappings filterable by multiple managed attributes
- core: add API to directly send recovery link to user
- core: add UserSelfSerializer and separate method for users to update themselves with limited fields
- core: allow changing of groups a user is in from user api
- flows: fix unhandled error in stage execution not being logged as SYSTEM\_EXCEPTION event
- lifecycle: decrease default worker count on compose
- outpost/ldap: Performance improvements, support for (member=) lookup
- providers/proxy: don't create ingress when no hosts are defined
- sources/plex: add API to get user connections
- web: add API Drawer
- web/admin: add UI to copy invitation link
- web/admin: allow modification of users groups from user view
- web/admin: re-name service connection to integration

## Fixed in 2021.8.1-rc2

- ci: add pipeline to build and push js api package
- ci: upgrade web api client when schema changes
- core: add new token intent and auth backend (#1284)
- core: add token tests for invalid intent and token auth
- core: fix token intent not defaulting correctly
- core: handle error when ?for\_user is not numerical
- lib: move id and key generators to lib (#1286)
- lifecycle: rename to ak
- outpost: handle non-existent permission
- outpost: add recursion limit for docker controller
- outpost: add repair\_permissions command
- root: add alias for akflow files
- root: add ASGI Error handler
- root: add License to NPM package
- root: fix error\_handler for websocket
- root: fix mis-matched postgres version for CI
- root: remove remainders from gen
- root: remove usage of make-gen
- root: test schema auto-update
- root: update schema
- stages/password: auto-enable app password backend
- stages/user\_write: fix wrong fallback authentication backend
- web: add custom readme to api client
- web: add ESM to generated Client
- web: build. api in different folder
- web: improve api client versioning
- web: Merge pull request #1258 from goauthentik/publish-api-to-npm
- web: migrate to @goauthentik/api
- web: Update Web API Client version (#1283)
- web/admin: allow users to create app password tokens
- web/admin: display token's intents
- web/admin: fix missing app passwords backend
- web/admin: improve delete modal for stage bindings and policy bindings
- web/admin: select all password stage backends by default
- website: add docs for making schema changes
- website: make default login-2fa flow ignore 2fa with app passwords
- website/docs: add docs for `auth_method` and `auth_method_args` fields

## Fixed in 2021.8.1

- \*: cleanup api schema warnings
- core: fix error for asgi error handler with websockets
- core: fix error when user updates themselves
- core: fix user object for token not be set-able
- root: Fix table of contents for CONTRIBUTING.md (#1302)
- root: Require PG\_PASS to be set (#1303)
- web/admin: allow admins to create tokens

## Fixed in 2021.8.2

- root: fix login loop created by old settings stored in cache

## Fixed in 2021.8.3

- outpost: fix FlowExecutor not sending password for identification stage
- outpost: fix generated traefik labels containing invalid hosts
- outpost: make docker network configurable when using docker integration
- web/flow: fix redirects to application being sent multiple times, causing issues with OAuth providers
- web/flow: fix rendering of checkboxes in prompt stages

## Fixed in 2021.8.4

- api: add /api/v3 path
- api: add basic rate limiting for sentry proxy endpoint
- core: fix user\_obj being empty on token API
- events: improve logging for task exceptions
- outpost/embedded: only send requests for non-akprox paths when we're doing proxy mode
- outpost/ldap: delay user information removal upon closing of connection
- policies/password: fix PasswordStage not being usable with prompt stages
- providers/proxy: fix traefik middleware being generated with wrong ports for embedded outposts
- providers/proxy: improve error handling for non-tls ingresses
- stages/authenticator\_validate: show single button for multiple webauthn authenticators
- stages/invitation: fix invitation not inheriting ExpiringModel
- web/admin: fallback for invitation list on first load
- web/admin: fix flow executor not opening in new tab
- web/admin: fix list of webauthn devices not updating after rename
- web/flows: fix FlowExecutor not updating when challenge changes from outside

## Fixed in 2021.8.5

- api: add additional filters for ldap and proxy providers
- api: cache schema, fix server urls
- core: minor query optimization
- events: add mark\_all\_seen
- events: remove authentik\_events gauge
- internal: disable directory listing on static files
- internal: fix font loading errors on safari
- internal: fix web requests not having a logger set
- outpost: fix spans being sent without parent context
- outposts: add expected outpost replica count to metrics
- outposts/ldap: improve logging of client IPs
- policies/password: fix symbols not being checked correctly
- root: fix is\_secure with safari on debug environments
- root: include authentik version in backup naming
- stages/identification: fix empty user\_fields query returning first user
- web/admin: fix user selection in token form
- web/admin: show applications instead of providers in outpost form
- web/flows: fix display error when using IdentificationStage without input fields

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.8 from [here](https://goauthentik.io/version/2021.8/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2021.8.5
```

---

## Release 2021.9

## Headline Changes

- Split user interface

  This release splits the administration interface from the end-user interface. This makes things clearer for end-users, as all their options are laid out more clearly.

  Additionally, the new end-user interface will be more customisable than the admin interface, allowing Administrators to configure what their users can see.

  The admin interface remains the same, and familiar buttons will redirect you between interfaces.

- New proxy

  The proxy outpost has been rewritten from scratch. This replaces the old proxy, which was based on oauth2\_proxy. The new proxy allows us a much greater degree of flexibility, is much lighter and reports errors better.

  When using a managed outpost, authentik will automatically upgrade to the new proxy outpost. The embedded outpost also uses the new proxy.

  authentik also now deploys ServiceMonitor CRDs in your Kubernetes cluster (when possibly), to record the metrics of the outposts.

  If you're using a manually deployed outpost, keep in mind that the ports change to 9000 and 9443 instead of 4180 and 4443

- New metrics

  This version introduces new and simplified Prometheus metrics. There is a new common monitoring port across the server and all outposts, 9300. This port requires no authentication, making it easier to configure.

  For the core application, this endpoint contains metrics for both authentik and the inbuilt outpost.

## Minor changes

- \*: use common user agent for all outgoing requests
- admin: migrate to new update check, add option to disable update check
- api: add additional filters for ldap and proxy providers
- core: optimize groups api by removing member superuser status
- core: remove ?v from static files
- events: add mark\_all\_seen
- events: allow setting a mapping for webhook transport to customize request payloads
- internal: fix font loading errors on safari
- lifecycle: fix worker startup error when docker socket's group is not called docker
- outpost: fix spans being sent without parent context
- outpost: update global outpost config on refresh
- outposts: add expected outpost replica count to metrics
- outposts/controllers: re-create service when mismatched ports to prevent errors
- outposts/controllers/kubernetes: don't create service monitor for embedded outpost
- outposts/ldap: improve logging of client IPs
- policies/password: fix symbols not being checked correctly
- root: include authentik version in backup naming
- root: show location header in logs when redirecting
- sources/oauth: prevent potentially confidential data from being logged
- stages/authenticator\_duo: add API to "import" devices from duo
- stages/identification: fix empty user\_fields query returning first user
- tenants: optimize db queries in middleware
- web: allow duplicate messages
- web: ignore network error
- web/admin: fix notification clear all not triggering render
- web/admin: fix user selection in token form
- web/admin: increase default expiry for refresh tokens
- web/admin: show applications instead of providers in outpost form
- web/flows: fix display error when using IdentificationStage without input fields

## Fixed in 2021.9.1-rc2

- core: fix token expiry for service accounts being only 30 minutes
- outposts: add consistent name and type to metrics
- outposts/proxy: remove deprecated rs256
- policies: improve error handling when using bindings without policy
- providers/saml: improved error handling
- stages/email: don't crash when testing stage does not exist
- web: update background image

## Fixed in 2021.9.1-rc3

- core: allow admins to create tokens with all parameters, re-add user to token form
- core: fix tokens not being viewable by superusers
- root: log failed celery tasks to event log
- sources/ldap: bump timeout, run each sync component in its own task
- sources/ldap: improve messages of sync tasks in UI
- sources/ldap: prevent error when retrying old system task with no arguments
- web: fix datetime-local fields throwing errors on firefox
- web: fix text color in delete form in dark mode
- web: improve display of action buttons with non-primary classes
- web/admin: fix error in firefox when creating token
- web/admin: fix ldap sync status for new API
- web/admin: fix settings link on user avatar
- web/admin: trigger refresh after syncing ldap
- web/user: add auto-focus search for applications
- web/user: add missing stop impersonation button
- web/user: fix edit button for applications
- web/user: fix final redirect after stage setup
- web/user: optimize load, fix unread status for notifications

## Fixed in 2021.9.1

- api: disable include\_format\_suffixes
- core: fix token identifier not being slugified when created with user-controller input
- outposts: don't map port 9300 on docker, only expose port
- outposts: don't restart container when health checks are starting
- outposts/ldap: allow custom attributes to shadow built-in attributes
- policies/expression: add ak\_user\_has\_authenticator
- root: use tagged go client version
- stages/email: don't throw 404 when token can't be found
- stages/email: slugify token identifier
- stages/email: use different query arguments for email and invitation tokens
- web: fix notification badge not refreshing after clearing notifications

## Fixed in 2021.9.2

- api: add logging to sentry proxy
- internal: add asset paths for user interface
- web: fix import order of polyfills causing shadydom to not work on firefox and safari
- web/user: enable sentry

## Fixed in 2021.9.3

- core: fix api return code for user self-update
- events: add additional validation for event transport
- outposts: ensure service is always re-created with mismatching ports
- outposts: fix outposts not correctly updating central state
- outposts: make AUTHENTIK\_HOST\_BROWSER configurable from central config
- outposts/proxy: ensure cookies only last as long as tokens
- outposts/proxy: Fix failing traefik healthcheck (#1470)
- outposts/proxyv2: fix routing not working correctly for domain auth
- providers/proxy: add token\_validity field for outpost configuration
- web/admin: add notice for recovery
- web/admin: fix NotificationWebhookMapping not loading correctly
- web/admin: fix Transport Form not loading mode correctly on edit
- web/admin: handle error correctly when creating user recovery link
- web/elements: fix token copy error in safari
- web/elements: improve error handling on forms
- web/user: fix brand not being shown in safari
- web/user: search apps when user typed before apps have loaded
- website/docs: fix typos and grammar (#1459)

## Fixed in 2021.9.4

- outposts: allow disabling of docker controller port mapping
- outposts/proxy: fix duplicate protocol in domain auth mode
- root: Use fully qualified names for docker bases base images. (#1490)
- sources/ldap: add support for Active Directory `userAccountControl` attribute
- sources/ldap: don't sync ldap source when no property mappings are set
- web/admin: don't require username nor name for activate/deactivate toggles
- web/admin: fix LDAP Source form not exposing syncParentGroup
- web/elements: fix initialLoad not being done when viewportCheck was disabled
- web/elements: use dedicated button for search clear instead of webkit exclusive one

## Fixed in 2021.9.5

- events: add missing migration
- lifecycle: switch to h11 uvicorn worker for now
- outpost/proxy: fix missing negation for internal host ssl verification
- outposts: check ports of deployment in kubernetes outpost controller
- outposts: don't always build permissions on outpost.user access, only in signals and tasks
- outposts: fix circular import in kubernetes controller
- outposts/proxy: add new headers with unified naming
- outposts/proxy: show full error message when user is authenticated
- providers/ldap: use RDN when using posixGroup's memberUid attribute (#1514)
- providers/proxy: always check ingress secret in kubernetes controller
- sources/ldap: fix logic error in Active Directory account disabled status
- stages/email: add activate\_user\_on\_success flag, add for all example flows
- stages/user\_login: add check for user.is\_active and tests
- tests/integration: fix tests failing due to incorrect comparison
- web/admin: fix search group label

## Fixed in 2021.9.6

- admin: clear update notification when notification's version matches current version
- api: ensure viewsets have default ordering
- core: include group uuids in self serializer
- core: make user's name field fully options
- core: only return group names for user\_self
- internal: add internal healthchecking to prevent websocket errors
- outposts: fix error when comparing ports in docker controller when port mapping is disabled
- root: add docker-native healthcheck for web and celery
- root: remove redundant internal network from compose
- web: add locale detection
- web: fix rendering of token copy button in dark mode
- web: fix strings not being translated at all when matching browser locale not found
- web/admin: only show outpost deployment info when not embedded
- web/elements: fix model form always loading when viewport check is disabled
- web/flows: adjust message for email stage
- web/user: don't show managed tokens in user interface

## Fixed in 2021.9.7

- root: fix syntax error in dockerfile healthcheck
- web/admin: fix description for flow import

## Fixed in 2021.9.8

- web: fix interface crashing in non-blink browsers

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2021.9 from [here](https://goauthentik.io/version/2021.9/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2021.9.1
```

---

## Release 2022.1

## Breaking changes

This release mostly removes legacy fields and features that have been deprecated for several releases.

- LDAP Outposts:

  This release removes the `accountStatus` and `superuser` fields. Use the direct replacements `goauthentik.io/ldap/active` and `goauthentik.io/ldap/superuser`.

- Proxy Outposts:

  This release consolidates headers sent by authentik to have a common prefix.

  The following headers have been removed:

  - X-Auth-Username, use `X-authentik-username`
  - X-Auth-Groups, use `X-authentik-groups`
  - X-Forwarded-Email, use `X-authentik-email`
  - X-Forwarded-Preferred-Username, use `X-authentik-username`
  - X-Forwarded-User, use `X-authentik-uid`

  The proxy now also sets the host header based on what is configured as upstream in the proxy provider. The original Host is forwarded as `X-Forwarded-Host`.

  Additionally, the header requirements for nginx have changed. Either a `X-Original-URL` or `X-Original-URI` header are now required. See the [*Proxy provider*](../../add-secure-apps/providers/proxy/forward_auth.mdx) documentation for updated snippets.

- API:

  The deprecated /api/v2beta/ Endpoint is removed. Use `/api/v3/`.

- Backup:

  The integrated backup has been deprecated for the following reasons:

  - Difficulty with restores not working properly
  - Inflexible configuration (fixed retention, limited to once a day, only S3 supported)
  - Most users will already have an existing backup infrastructure

## Minor changes/fixes

- core: don't return 404 when trying to view key of expired token
- crypto: fully parse certificate on validation in serializer to prevent invalid certificates from being saved
- flows: handle error if flow title contains invalid format string
- internal: route traffic to proxy providers based on cookie domain when multiple domain-level providers exist
- internal: use math.MaxInt for compatibility
- lifecycle: add early check for missing/invalid secret key
- outposts/proxyv2: allow access to /outpost.goauthentik.io urls in forward auth mode to make routing in nginx/traefik easier
- outposts/proxyv2: fix before-redirect url not being saved in proxy mode
- outposts/proxyv2: fix JWKS url pointing to localhost on embedded outpost
- providers/oauth2: change default redirect uri behavior; set first used url when blank and use star for wildcard
- root: allow customization of ports in compose without override
- root: decrease to 10 backup history
- root: fix backups running every minute instead of once
- stages/authenticator\_webauthn: make more WebAuthn options configurable
- web: add polyfill for Intl.ListFormat
- web: directly read csrf token before injecting into request
- web: fix double plural in label
- web/admin: also set embedded outpost host when it doesn't include scheme
- web/admin: fix missing configure flow setting on webauthn setup stage form
- web/flows: remove node directly instead of using removeChild()

## Fixed in 2022.1.2

- internal/proxyv2: only allow access to /outpost.goauthentik.io in nginx mode when forward url could be extracted
- lib: disable backup by default, add note to configuration
- lifecycle: replace lowercase, deprecated prometheus\_multiproc\_dir
- outposts: allow custom label for docker containers
- policies/hibp: ensure password is encodable
- providers/proxy: add PathPrefix to auto-traefik labels
- root: upgrade python dependencies

## Fixed in 2022.1.3

- internal: add support for X-Original-URL
- internal: add optional debug server listening on 9900
- internal: don't override server header
- internal: start adding tests to outpost
- lifecycle: make secret\_key warning more prominent
- lifecycle: wait for db in worker
- outposts/ldap: Fix more case sensitivity issues. (#2144)
- outposts/proxy: add more test cases for domain-level auth
- outposts/proxy: fix potential empty redirect, add tests
- outposts/proxy: trace full headers to debug
- providers/proxy: fix traefik label
- root: add max-requests for gunicorn and max tasks for celery
- root: fix redis passwords not being encoded correctly
- web/admin: fix links which look like labels
- web/admin: fix SMS Stage form not working

## Fixed in 2022.1.4

- core: fix view\_token permission not being assigned on token creation for non-admin user
- lifecycle: remove gunicorn reload option
- lifecycle: send analytics in gunicorn config to decrease outgoing requests when workers get restarted
- providers/proxy: add support for X-Original-URI in nginx, better handle missing headers and report errors to authentik
- providers/proxy: don't include hostname and scheme in redirect when we only got a path and not a full URL
- providers/proxy: fix routing for external\_host when using forward\_auth\_domain
- providers/proxy: set traefik labels using object\_naming\_template instead of UUID
- sources/ldap: add list\_flatten function to property mappings, enable on managed LDAP mappings
- web: add es locale
- web: add pl locale
- web/admin: only check first half of locale when detecting
- web/flows: fix width on flow container
- web/user: include locale code in locale selection

## Fixed in 2022.1.5

- build(deps): bump uvicorn from 0.17.1 to 0.17.3 (#2229)
- core: allow formatting strings to be used for applications' launch URLs
- internal: don't attempt to lookup SNI Certificate if no SNI is sent
- internal: fix CSRF error caused by Host header
- internal: improve error handling for internal reverse proxy
- internal: remove uvicorn server header
- internal: trace headers and url for backend requests
- outposts: fix channel not always having a logger attribute
- outposts: fix compare\_ports to support both service and container ports
- outposts: fix service reconciler re-creating services
- outposts: remove node\_port on V1ServicePort checks to prevent service creation loops
- providers/proxy: fix Host/ not being modified
- providers/proxy: fix nil error in claims
- providers/proxy: improve error handling for invalid backend\_override
- sources/ldap: log entire exception
- sources/saml: fix incorrect ProtocolBinding being sent
- sources/saml: fix server error
- stages/authenticator\_validate: handle non-existent device\_challenges
- web/admin: fix mismatched icons in overview and lists

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.1 from [here](https://goauthentik.io/version/2022.1/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.1.1
```

---

## Release 2022.10

## Breaking changes

- This version removes old migrations that have been replaced by squashed versions in previous versions. As such it is only possible to upgrade to this version from **2022.1** or later.
- Several challenge components have been renamed to better match the rest of the challenges
- The SAML Source has been updated to use connection objects instead of directly creating users.

## New features

- Support for OAuth2 Device flow

  See more in the OAuth2 provider docs [here](../../add-secure-apps/providers/oauth2/device_code.mdx). This flow allows users to authenticate on devices that have limited input possibilities and or no browser access.

- Customizable payload for SMS Authenticator stage when using Generic provider.

- Revamped SAML Source

  The SAML source uses connection objects and the same Flow manager as the OAuth and Plex source. Additionally error-handling has been improved.

  This also allows for mapping fields from SAML Source to users.

- Twitch OAuth Source has been added

- Optimized loading speed of Flows & Stages

  This affects listing Flows & Stages in the admin interface, as well as loading prompts within forms. Also the flow planning has been improved to use less queries.

- Reduced possibility of redirect loops when using Forward auth

## API Changes

#### What's New

***

##### `POST` /flows/instances/import/

##### `GET` /sources/user\_connections/saml/

##### `POST` /sources/user\_connections/saml/

##### `GET` /sources/user\_connections/saml/\{id}/

##### `PUT` /sources/user\_connections/saml/\{id}/

##### `DELETE` /sources/user\_connections/saml/\{id}/

##### `PATCH` /sources/user\_connections/saml/\{id}/

##### `GET` /sources/user\_connections/saml/\{id}/used\_by/

#### What's Deleted

***

##### `POST` /flows/instances/import\_flow/

#### What's Changed

***

##### `GET` /core/tenants/\{tenant\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `flow_device_code` (string)

##### `PUT` /core/tenants/\{tenant\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `flow_device_code` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `flow_device_code` (string)

##### `PATCH` /core/tenants/\{tenant\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `flow_device_code` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `flow_device_code` (string)

##### `GET` /propertymappings/notification/\{pm\_uuid}/

###### Parameters:

Changed: `pm_uuid` in `path`

> A UUID string identifying this Webhook Mapping.

##### `PUT` /propertymappings/notification/\{pm\_uuid}/

###### Parameters:

Changed: `pm_uuid` in `path`

> A UUID string identifying this Webhook Mapping.

##### `DELETE` /propertymappings/notification/\{pm\_uuid}/

###### Parameters:

Changed: `pm_uuid` in `path`

> A UUID string identifying this Webhook Mapping.

##### `PATCH` /propertymappings/notification/\{pm\_uuid}/

###### Parameters:

Changed: `pm_uuid` in `path`

> A UUID string identifying this Webhook Mapping.

##### `GET` /admin/metrics/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `authorizations_per_1h`

  * Added property `authorizations_per_1h` (array)

    Items (object): > Coordinates for diagrams

    - Property `x_cord` (integer)

    - Property `y_cord` (integer)

##### `POST` /core/tenants/

###### Request:

Changed content type : `application/json`

- Added property `flow_device_code` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `flow_device_code` (string)

##### `GET` /core/tenants/

###### Parameters:

Added: `flow_device_code` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Tenant Serializer

    - Added property `flow_device_code` (string)

##### `GET` /core/tenants/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `flow_device_code` (string)

##### `GET` /crypto/certificatekeypairs/

###### Parameters:

Added: `include_details` in `query`

##### `GET` /propertymappings/notification/\{pm\_uuid}/used\_by/

###### Parameters:

Changed: `pm_uuid` in `path`

> A UUID string identifying this Webhook Mapping.

##### `GET` /root/config/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `capabilities` (array)

    Changed items (string):

    Added enum value:

    - `can_debug`

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_type` (string)

    Added enum value:

    - `twitch`

##### `PUT` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `provider_type` (string)

  Added enum value:

  - `twitch`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_type` (string)

    Added enum value:

    - `twitch`

##### `PATCH` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `provider_type` (string)

  Added enum value:

  - `twitch`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_type` (string)

    Added enum value:

    - `twitch`

##### `GET` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `PUT` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `PATCH` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `provider_type` (string)

  Added enum value:

  - `twitch`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `provider_type` (string)

    Added enum value:

    - `twitch`

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `provider_type` (string)

      Added enum value:

      - `twitch`

##### `GET` /stages/all/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/duo/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/sms/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mapping` (string)

    > Optionally modify the payload being sent to custom providers.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `mapping` (string)

  > Optionally modify the payload being sent to custom providers.

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mapping` (string)

    > Optionally modify the payload being sent to custom providers.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `mapping` (string)

  > Optionally modify the payload being sent to custom providers.

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mapping` (string)

    > Optionally modify the payload being sent to custom providers.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/static/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/authenticator/static/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/authenticator/static/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/totp/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/authenticator/totp/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/authenticator/totp/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/validate/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/consent/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/consent/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/consent/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/deny/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/dummy/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/dummy/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/dummy/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/email/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/identification/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/invitation/stages/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/invitation/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/invitation/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/password/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/prompt/stages/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/prompt/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/prompt/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_delete/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/user\_delete/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/user\_delete/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_login/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_logout/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/user\_logout/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/user\_logout/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_write/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PUT` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `PATCH` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `POST` /flows/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > FlowStageBinding Serializer

    - Changed property `stage_obj` (object)

      > Stage Serializer

      - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New optional properties:

        - `cache_count`
        - `policies`
        - `stages`

        * Deleted property `stages` (array)

        * Deleted property `policies` (array)

        * Deleted property `cache_count` (integer)

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Deleted 'ak-flow-sources-plex' component
  Deleted 'ak-flow-sources-oauth-apple' component
  Added 'ak-provider-oauth2-device-code' component:

  - Property `type` (string)

    Enum values:

    - `native`
    - `shell`
    - `redirect`

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

    - Property `title` (string)

    - Property `background` (string)

    - Property `cancel_url` (string)

    - Property `layout` (string)

      Enum values:

      - `stacked`
      - `content_left`
      - `content_right`
      - `sidebar_left`
      - `sidebar_right`

  - Property `component` (string)

  - Property `response_errors` (object)

  Added 'ak-source-oauth-apple' component:

  - Property `type` (string)

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `client_id` (string)

  - Property `scope` (string)

  - Property `redirect_uri` (string)

  - Property `state` (string)

  Added 'ak-source-plex' component:

  - Property `type` (string)

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `client_id` (string)

  - Property `slug` (string)

  Added 'ak-provider-oauth2-device-code-finish' component:

  - Property `type` (string)

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

  - Property `component` (string)

  - Property `response_errors` (object)

  Updated `ak-stage-identification` component:

  - Changed property `sources` (array)

    Changed items (object): > Serializer for Login buttons of sources

    - Changed property `challenge` (object)

      Deleted 'ak-flow-sources-plex' component
      Deleted 'ak-flow-sources-oauth-apple' component
      Added 'ak-source-oauth-apple' component:
      Added 'ak-source-plex' component:

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Deleted 'ak-flow-sources-plex' component
Deleted 'ak-flow-sources-oauth-apple' component
Added 'ak-provider-oauth2-device-code' component:

- Property `component` (string)

- Property `code` (integer)

Added 'ak-source-oauth-apple' component:

- Property `component` (string)

Added 'ak-source-plex' component:

- Property `component` (string)

Added 'ak-provider-oauth2-device-code-finish' component:

- Property `component` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Deleted 'ak-flow-sources-plex' component
  Deleted 'ak-flow-sources-oauth-apple' component
  Added 'ak-provider-oauth2-device-code' component:
  Added 'ak-source-oauth-apple' component:
  Added 'ak-source-plex' component:
  Added 'ak-provider-oauth2-device-code-finish' component:
  Updated `ak-stage-identification` component:

  - Changed property `sources` (array)

    Changed items (object): > Serializer for Login buttons of sources

    - Changed property `challenge` (object)

      Deleted 'ak-flow-sources-plex' component
      Deleted 'ak-flow-sources-oauth-apple' component
      Added 'ak-source-oauth-apple' component:
      Added 'ak-source-plex' component:

##### `GET` /flows/inspector/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `plans` (array)

    Changed items (object): > Serializer for an active FlowPlan

    - Changed property `current_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `stage_obj` (object)

        > Stage Serializer

        - Changed property `flow_set` (array)

          Changed items (object): > Stripped down flow serializer

          New optional properties:

          - `cache_count`
          - `policies`
          - `stages`

          * Deleted property `stages` (array)

          * Deleted property `policies` (array)

          * Deleted property `cache_count` (integer)

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/authenticator/duo/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorDuoStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/authenticator/sms/

###### Request:

Changed content type : `application/json`

- Added property `mapping` (string)

  > Optionally modify the payload being sent to custom providers.

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `mapping` (string)

    > Optionally modify the payload being sent to custom providers.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/sms/

###### Parameters:

Added: `mapping` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorSMSStage Serializer

    - Added property `mapping` (string)

      > Optionally modify the payload being sent to custom providers.

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/authenticator/static/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorStaticStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/authenticator/totp/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorTOTPStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorValidateStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticateWebAuthnStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/consent/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ConsentStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/deny/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DenyStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/dummy/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DummyStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > EmailStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > IdentificationStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/invitation/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > InvitationStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PasswordStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `GET` /stages/prompt/prompts/\{prompt\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `PUT` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `PATCH` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/prompt/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PromptStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/user\_delete/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserDeleteStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/user\_login/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_login/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLoginStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/user\_logout/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLogoutStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/user\_write/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    New optional properties:

    - `cache_count`
    - `policies`
    - `stages`

    * Deleted property `stages` (array)

    * Deleted property `policies` (array)

    * Deleted property `cache_count` (integer)

##### `GET` /stages/user\_write/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserWriteStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      New optional properties:

      - `cache_count`
      - `policies`
      - `stages`

      * Deleted property `stages` (array)

      * Deleted property `policies` (array)

      * Deleted property `cache_count` (integer)

##### `GET` /stages/prompt/prompts/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Prompt Serializer

    - Changed property `promptstage_set` (array)

      Changed items (object): > Stage Serializer

      - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New optional properties:

        - `cache_count`
        - `policies`
        - `stages`

        * Deleted property `stages` (array)

        * Deleted property `policies` (array)

        * Deleted property `cache_count` (integer)

## Minor changes/fixes

- \*: improve error handling in ldap outpost, ignore additional errors
- admin: add authorizations metric (#3811)
- blueprints: fix error when exporting objects with lazily translated strings
- core: fallback to empty user object for PropertyMappingEvaluator
- core: fix messages not being shown when no client is connected
- core: fix title in generic error template
- crypto: fix cert\_expiry not having the correct format
- crypto: fix import\_certificate checking private key as certificate
- crypto: make certificate parsing optional for crypto api (#3711)
- flows: always show flow inspector in debug mode, don't require admin in debug (#3786)
- flows: improved import (show logs, improve UI) (#3807)
- flows: optimize queries for flow and stage API endpoints
- internal: limit body size
- outposts/ldap: increase compatibility with different types in user and group attributes
- providers/oauth2: add all hardcoded claims to claims\_supported list
- providers/oauth2: add device flow (#3334)
- providers/oauth2: exclude at\_hash claim if not set instead of being null
- providers/oauth2: fix issues with es256 and add tests (#3808)
- providers/saml: don't attempt verification of SAML request when no verification certificate is configured
- root: add global fallback throttle
- root: Add setting to adjust database config for pgbouncer (#3769)
- root: decrease default token size to 60 chars for compatibility (#3710)
- root: save email template directory in config
- sources/oauth: add Twitch OAuth source (#3746)
- sources/oauth: allow overriding of all scopes
- sources/saml: improve error handling for missing assertion and missing subject
- sources/saml: revamp SAML Source (#3785)
- stages/authenticator\_sms: make sms stage payload customisable (#3780)
- stages/email: don't check that email templates exist on startup
- web: use drawSelection to workaround cursor bug when using CodeMirror with ShadowDOM in firefox
- web/\*: fix blank api drawer
- web/admin: allow web-based sources to have empty enrollment/authentication flow
- web/admin: rework scrolling in modals, ensure overlay covers everything
- web/admin: set card headers and icons in card class
- web/flows: improve display for action-showing stages
- web/flows: update flow background
- website/docs: add warning to trace log level

## Fixed in 2022.10.1

- blueprints: fix error when cleaning up unset attribute
- blueprints: improve error handling
- core: check if session is authenticated before showing linked message
- core: explicitly enable locales (#3889)
- core: refactor MessageStage to not use dynamic class
- core: set prehydrated locale based on active backend locale
- core: show success message when authenticating/enrolling after flow is finished
- flows: fix error due to not validating error challenge
- sources/saml: set username field to name\_id attribute
- web/common: disable API Drawer by default in user interface

## Fixed in 2022.10.2

- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.mdx), Reported by [@sdimovv](https://github.com/sdimovv)

## Fixed in 2022.10.3

- web: fix Flow Form failing to load due to outdated API client

## Fixed in 2022.10.4

- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.mdx), Reported by [@DreamingRaven](https://github.com/DreamingRaven)
- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.mdx), Reported by [@fuomag9](https://github.com/fuomag9)

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.10 from [here](https://goauthentik.io/version/2022.10/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.10.1
```

---

## Release 2022.11

## Breaking changes

- Have I Been Pwned policy is deprecated

  The policy has been merged with the password policy which provides the same functionality. Existing Have I Been Pwned policies will automatically be migrated.

- Instead of using multiple redis databases, authentik now uses a single redis database

  This will temporarily loose some cached information after the upgrade, like cached system tasks and policy results. This data will be re-cached in the background.

## New features

- authentik now runs on Python 3.11
- Expanded password policy

  The "Have I been Pwned" policy has been merged into the password policy, and additionally passwords can be checked using [zxcvbn](https://github.com/dropbox/zxcvbn) to provider concise feedback.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.11 from [here](https://goauthentik.io/version/2022.11/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.11.1
```

## Minor changes/fixes

- api: fix missing scheme in securitySchemes
- blueprints: Fixed bug causing blueprint instance context be discarded (#3990)
- core: fix error when propertymappings return complex value
- core: simplify group serializer for user API endpoint (#3899)
- events: deepcopy event kwargs to prevent objects being removed, remove workaround
- events: sanitize generator for json safety
- lib: fix complex objects being included in event context for ak\_create\_event
- lifecycle: fix incorrect messages looped
- outposts/kubernetes: ingress class (#4002)
- policies: only cache policies for authenticated users
- policies/password: merge hibp add zxcvbn (#4001)
- providers/oauth2: fix inconsistent expiry encoded in JWT
- root: make sentry DSN configurable (#4016)
- root: relicense and launch blog post
- root: use single redis db (#4009)
- sources: add custom icon support (#4022)
- stages/authenticator\_\*: cleanup
- stages/authenticator\_validate: add flag to configure user\_verification for webauthn devices
- stages/invitation: directly delete invitation now that flow plan is saved in email token
- web: fix twitter icon
- web/flows: always hide static user info when its not set in the flow

## Fixed in 2022.11.1

- blueprints: add desired state attribute to objects (#4061)
- core: fix tab-complete in shell
- root: fix build on arm64
- stages/email: add test for email translation
- web/admin: fix error when importing duo devices
- web/admin: reset cookie\_domain when setting non-domain forward auth

## Fixed in 2022.11.2

- \*: fix [CVE-2022-46145](../../security/cves/CVE-2022-46145.mdx), Reported by [@sdimovv](https://github.com/sdimovv)

## Fixed in 2022.11.3

- web: fix Flow Form failing to load due to outdated API client

## Fixed in 2022.11.4

- \*: fix [CVE-2022-46172](../../security/cves/CVE-2022-46172.mdx), Reported by [@DreamingRaven](https://github.com/DreamingRaven)
- \*: fix [CVE-2022-23555](../../security/cves/CVE-2022-23555.mdx), Reported by [@fuomag9](https://github.com/fuomag9)

## API Changes

#### What's Changed

***

##### `GET` /policies/password/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `check_static_rules` (boolean)

  - Added property `check_have_i_been_pwned` (boolean)

  - Added property `check_zxcvbn` (boolean)

  - Added property `hibp_allowed_count` (integer)

    > How many times the password hash is allowed to be on haveibeenpwned

  - Added property `zxcvbn_score_threshold` (integer)
    > If the zxcvbn score is equal or less than this value, the policy will fail.

##### `PUT` /policies/password/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `check_static_rules` (boolean)

- Added property `check_have_i_been_pwned` (boolean)

- Added property `check_zxcvbn` (boolean)

- Added property `hibp_allowed_count` (integer)

  > How many times the password hash is allowed to be on haveibeenpwned

- Added property `zxcvbn_score_threshold` (integer)
  > If the zxcvbn score is equal or less than this value, the policy will fail.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `check_static_rules` (boolean)

  - Added property `check_have_i_been_pwned` (boolean)

  - Added property `check_zxcvbn` (boolean)

  - Added property `hibp_allowed_count` (integer)

    > How many times the password hash is allowed to be on haveibeenpwned

  - Added property `zxcvbn_score_threshold` (integer)
    > If the zxcvbn score is equal or less than this value, the policy will fail.

##### `PATCH` /policies/password/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `check_static_rules` (boolean)

- Added property `check_have_i_been_pwned` (boolean)

- Added property `check_zxcvbn` (boolean)

- Added property `hibp_allowed_count` (integer)

  > How many times the password hash is allowed to be on haveibeenpwned

- Added property `zxcvbn_score_threshold` (integer)
  > If the zxcvbn score is equal or less than this value, the policy will fail.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `check_static_rules` (boolean)

  - Added property `check_have_i_been_pwned` (boolean)

  - Added property `check_zxcvbn` (boolean)

  - Added property `hibp_allowed_count` (integer)

    > How many times the password hash is allowed to be on haveibeenpwned

  - Added property `zxcvbn_score_threshold` (integer)
    > If the zxcvbn score is equal or less than this value, the policy will fail.

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `PUT` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `PATCH` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `GET` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `groups_obj` (array)

    Changed items (object): > Simplified Group Serializer for user's groups

    New optional properties:

    - `users_obj`

    * Deleted property `users` (array)

    * Deleted property `users_obj` (array)

##### `PUT` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `groups_obj` (array)

    Changed items (object): > Simplified Group Serializer for user's groups

    New optional properties:

    - `users_obj`

    * Deleted property `users` (array)

    * Deleted property `users_obj` (array)

##### `PATCH` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `groups_obj` (array)

    Changed items (object): > Simplified Group Serializer for user's groups

    New optional properties:

    - `users_obj`

    * Deleted property `users` (array)

    * Deleted property `users_obj` (array)

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `POST` /policies/password/

###### Request:

Changed content type : `application/json`

- Added property `check_static_rules` (boolean)

- Added property `check_have_i_been_pwned` (boolean)

- Added property `check_zxcvbn` (boolean)

- Added property `hibp_allowed_count` (integer)

  > How many times the password hash is allowed to be on haveibeenpwned

- Added property `zxcvbn_score_threshold` (integer)
  > If the zxcvbn score is equal or less than this value, the policy will fail.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `check_static_rules` (boolean)

  - Added property `check_have_i_been_pwned` (boolean)

  - Added property `check_zxcvbn` (boolean)

  - Added property `hibp_allowed_count` (integer)

    > How many times the password hash is allowed to be on haveibeenpwned

  - Added property `zxcvbn_score_threshold` (integer)
    > If the zxcvbn score is equal or less than this value, the policy will fail.

##### `GET` /policies/password/

###### Parameters:

Added: `check_have_i_been_pwned` in `query`

Added: `check_static_rules` in `query`

Added: `check_zxcvbn` in `query`

Added: `hibp_allowed_count` in `query`

Added: `zxcvbn_score_threshold` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Password Policy Serializer

    - Added property `check_static_rules` (boolean)

    - Added property `check_have_i_been_pwned` (boolean)

    - Added property `check_zxcvbn` (boolean)

    - Added property `hibp_allowed_count` (integer)

      > How many times the password hash is allowed to be on haveibeenpwned

    - Added property `zxcvbn_score_threshold` (integer)
      > If the zxcvbn score is equal or less than this value, the policy will fail.

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups

        New optional properties:

        - `users_obj`

        * Deleted property `users` (array)

        * Deleted property `users_obj` (array)

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `groups_obj` (array)

    Changed items (object): > Simplified Group Serializer for user's groups

    New optional properties:

    - `users_obj`

    * Deleted property `users` (array)

    * Deleted property `users_obj` (array)

##### `GET` /core/users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `groups_obj` (array)

      Changed items (object): > Simplified Group Serializer for user's groups

      New optional properties:

      - `users_obj`

      * Deleted property `users` (array)

      * Deleted property `users_obj` (array)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups

        New optional properties:

        - `users_obj`

        * Deleted property `users` (array)

        * Deleted property `users_obj` (array)

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `user` (object)

      > User Serializer

      - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups

        New optional properties:

        - `users_obj`

        * Deleted property `users` (array)

        * Deleted property `users_obj` (array)

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `user` (object)

      > User Serializer

      - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups

        New optional properties:

        - `users_obj`

        * Deleted property `users` (array)

        * Deleted property `users_obj` (array)

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups

        New optional properties:

        - `users_obj`

        * Deleted property `users` (array)

        * Deleted property `users_obj` (array)

---

## Release 2022.12

## Breaking changes

- Blueprints fetched via OCI require oci:// schema

  To better detect if a blueprint should be fetched locally or via OCI, all OCI sourced blueprints require an `oci://` protocol.

## New features

- Bundled GeoIP City database

  authentik now comes with a bundled MaxMind GeoLite2 City database. This allows everyone to take advantage of the extra data provided by GeoIP. The default docker-compose file removes the GeoIP update container as it is no longer needed. See more [here](../../sys-mgmt/ops/geoip.mdx).

- Improved UX for user & group management and stage/policy binding

  Users can now more easily be added to and removed from groups, both when viewing a single user and viewing a group.

  When creating new stages or policies, authentik will now automatically offer an option to bind them to the object in whose context they were created in.

  Select inputs were previously limited to showing a single page of items (default size of 100 items). These inputs have been replaced by dynamically loading inputs which support searching and better show the properties of the item.

- Preview for OAuth2 and SAML providers

  OAuth2 and SAML providers can now preview what the currently selected property/scope mappings's outcome will look like. This helps with seeing what data is sent to the client and implementing and testing custom mappings.

- Customisable Captcha stage

  The captcha stage now supports alternate compatible providers, like [hCaptcha](https://docs.hcaptcha.com/switch/) and [Turnstile](https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha/).

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.12 from [here](https://goauthentik.io/version/2022.12/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.12.0
```

## Minor changes/fixes

- blueprints: add !Env tag
- blueprints: add `!If` tag (#4264)
- blueprints: add conditions to blueprint schema
- blueprints: Added conditional entry application (#4167)
- blueprints: better OCI support in UI (#4263)
- blueprints: fixed bug causing filtering with an empty query (#4106)
- blueprints: Support nested custom tags in `!Find` and `!Format` tags (#4127)
- core: add endpoints to add/remove users from group atomically
- core: bundle geoip (#4250)
- events: fix incorrect EventAction being used
- events: improve handling creation of events with non-pickleable objects
- events: remove legacy logger declaration
- events: save login event in session after login
- flows: fix redirect from plan context "redirect" not being wrapped in flow response
- flows: set stage name and verbose\_name for in\_memory stages
- internal: don't error if environment config isn't found
- internal: remove sentry proxy
- internal: reuse http transport to prevent leaking connections (#3996)
- lib: enable sentry profiles\_sample\_rate
- lib: fix uploaded files not being saved correctly, add tests
- lifecycle: don't set user/group in gunicorn
- lifecycle: improve explanation for user: root and docket socket mount
- policies: don't log context when policy returns None
- policies: log correct cache state
- policies: make name required
- policies/password: Always add generic message to failing zxcvbn check (#4100)
- providers: add preview for mappings (#4254)
- providers/ldap: improve mapping of LDAP filters to authentik queries
- providers/oauth2: optimize and cache signing key, prevent key being loaded multiple times
- providers/oauth2: set amr values based on login event
- providers/proxy: correctly set id\_token\_hint if possible
- providers/saml: set AuthnContextClassRef based on login event
- root: allow custom settings via python module
- root: migrate to hosted sentry with rate-limited DSN
- security: fix CVE 2022 23555 (#4274)
- security: fix CVE 2022 46145 (#4140)
- security: fix CVE 2022 46172 (#4275)
- stages/authenticator\_duo: fix imported duo devices not being confirmed
- stages/authenticator\_validate: fix validation to ensure configuration stage is set
- stages/authenticator\_validate: improve validation for not\_configured\_action
- stages/authenticator\_validate: log duo error
- stages/authenticator\_validate: save used mfa devices in login event
- stages/captcha: customisable URLs (#3832)
- stages/invitation: fix incorrect pk check for invitation's flow
- stages/user\_login: prevent double success message when logging in via source
- stages/user\_write: always ignore `component` field and prevent warning
- web: fix authentication with Plex on iOS (#4095)
- web: ignore d3 circular deps warning, treat unresolved import as error
- web: use version family subdomain for in-app doc links
- web/admin: better show metadata download for saml provider
- web/admin: break all in code blocks in event info
- web/admin: clarify phrasing that user ID is required
- web/admin: fix action button order for blueprints
- web/admin: fix alignment in tables with multiple elements in cell
- web/admin: fix empty request being sent due to multiple forms in duo import modal
- web/admin: improve i18n for documentation link in outpost form
- web/admin: improve UI for removing users from groups and groups from users
- web/admin: improve user/group UX for adding/removing users to and from groups
- web/admin: more consistent label usage, use compact labels
- web/admin: rework markdown, correctly render Admonitions, fix links
- web/admin: show bound policies order first to match stages
- web/admin: show policy binding form when creating policy in bound list
- web/admin: show stage binding form when creating stage in bound list
- web/elements: fix alignment for checkboxes in table
- web/elements: fix alignment with checkbox in table
- web/elements: fix log level for diagram
- web/elements: fix table select-all checkbox being checked with no elements
- web/elements: fix wizard form page changing state before being active
- web/elements: unselect top checkbox in table when not all elements are selected
- web/flows: fix display for long redirect URLs
- web/flows: improve error messages for failed duo push
- web/flows: update flow background
- web/user: fix styling for clear all button in notification drawer

## Fixed in 2022.12.1

- api: add filter backend for secret key to allow access to tenants and certificates
- blueprints: fix error when entry with state absent doesn't exist
- blueprints: Resolve yamltags in state and model attributes (#4299)
- outposts: include hostname in outpost heartbeat
- outposts/ldap: only use common cert if cert is configured
- outposts/ldap: use configured certificate for LDAPS when all providers' certificates are identical
- web/admin: migrate selection to ak-search-select
- web/admin: rework outpost health
- web/elements: add grouping and descriptions to search select
- web/elements: make ak-search-select limited in height and scroll
- web/elements: render ak-seach-select dropdown correctly in modals
- web/user: fix user settings stuck loading

## Fixed in 2022.12.2

- admin: use matching environment for system API
- crypto: fix type for has\_key
- providers/oauth2: fix null amr value not being removed from id\_token
- providers/saml: don't error if no request in API serializer context
- stages/captcha: fix captcha not loading correctly, add tests
- stages/dummy: add toggle to throw error for debugging
- stages/email: make template tests less flaky
- stages/email: use pending user correctly
- stages/prompt: use stage.get\_pending\_user() to fallback to the correct user
- web: add check compile test to prevent compile errors/warnings
- web: ensure locales are built for tsc check
- web: update tsconfig strictness
- web/admin: add Radio control, search-select fixes (#4333)
- web/admin: fix error in outpost form dropdown
- web/admin: fix error when creating SAML Provider from metadata
- web/elements: correctly display selected empty option when blankable is enabled
- web/elements: fix dropdown menu closing before selecting item sometimes
- web/elements: fix selection of blank elements in search-select, fix issue when re-opening dropdown
- web/elements: tabs: only find pages for directly related slots
- web/elements: trigger search select data update on connected callback
- web/flows: add close button to flow inspector
- web/flows: fix alternate captchas not loading
- web/flows: rework error display, always use ak-stage-flow-error instead of shell

## Fixed in 2022.12.3

- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.mdx), Reported by [@fuomag9](https://github.com/fuomag9)

## API Changes

#### What's Changed

***

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `js_url` (string)

  - Added property `api_url` (string)

  - Changed property `public_key` (string)
    > Public key, acquired your captcha Provider.

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `js_url` (string)

- Added property `api_url` (string)

- Changed property `public_key` (string)

  > Public key, acquired your captcha Provider.

- Changed property `private_key` (string)
  > Private key, acquired your captcha Provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `js_url` (string)

  - Added property `api_url` (string)

  - Changed property `public_key` (string)
    > Public key, acquired your captcha Provider.

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `js_url` (string)

- Added property `api_url` (string)

- Changed property `public_key` (string)

  > Public key, acquired your captcha Provider.

- Changed property `private_key` (string)
  > Private key, acquired your captcha Provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `js_url` (string)

  - Added property `api_url` (string)

  - Changed property `public_key` (string)
    > Public key, acquired your captcha Provider.

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-captcha` component:
  New required properties:

  - `js_url`

  * Added property `js_url` (string)

##### `POST` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-captcha` component:
  New required properties:

  - `js_url`

  * Added property `js_url` (string)

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Added property `js_url` (string)

- Added property `api_url` (string)

- Changed property `public_key` (string)

  > Public key, acquired your captcha Provider.

- Changed property `private_key` (string)
  > Private key, acquired your captcha Provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `js_url` (string)

  - Added property `api_url` (string)

  - Changed property `public_key` (string)
    > Public key, acquired your captcha Provider.

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Added property `js_url` (string)

    - Added property `api_url` (string)

    - Changed property `public_key` (string)
      > Public key, acquired your captcha Provider.

---

## Release 2022.2

## Breaking changes

### Removal of integrated backup

The integrated backup functionality has been removed due to the following reasons:

- It caused a lot of issues during restore, with things breaking and difficult to restore backups
- Limited compatibility (only supported local and S3 backups)
- Most environments already have a solution for backups, so we feel that investing more time into making this feature better should be spent on more important things.

If you don't already have a standard backup solution for other applications, you can consider these replacements:

- [https://github.com/kartoza/docker-pg-backup](https://github.com/kartoza/docker-pg-backup) for docker-compose and
- [https://devtron.ai/blog/creating-a-kubernetes-cron-job-to-backup-postgres-db/](https://devtron.ai/blog/creating-a-kubernetes-cron-job-to-backup-postgres-db/) or [https://cwienczek.com/2020/06/simple-backup-of-postgres-database-in-kubernetes/](https://cwienczek.com/2020/06/simple-backup-of-postgres-database-in-kubernetes/) for Kubernetes

### Changed URLs for forward auth

`akprox` in URLs has been changed to `outpost.goauthentik.io`. All the documentation now reflects this, and outpost integrations will migrate this automatically for you.

## New features

### Authenticator enrollment picker

In an authenticator validation stage you can now configure multiple configuration stages, which will be present to the user to choose which device they want to enroll.

## Minor changes/fixes

- \*: add placeholder custom.css to easily allow user customization
- \*: rename akprox to outpost.goauthentik.io (#2266)
- internal: don't attempt to lookup SNI Certificate if no SNI is sent
- internal: improve error handling for internal reverse proxy
- internal: increase logging for no hostname found
- internal: remove uvicorn server header
- outposts: ensure keypair is set for SSH connections
- outposts: fix channel not always having a logger attribute
- outposts: fix compare\_ports to support both service and container ports
- outposts: fix service reconciler re-creating services
- outposts: make local discovery configurable
- outposts: remove node\_port on V1ServicePort checks to prevent service creation loops
- outposts/proxy: correctly check host in forward domain redirect
- outposts/proxy: correctly handle ?rd= param
- providers/oauth2: add support for explicit response\_mode
- providers/oauth2: fix redirect\_uri being lowercased on successful validation
- providers/proxy: enable TLS in ingress via traefik annotation
- providers/proxy: improve error handling for invalid backend\_override
- providers/proxy: remove leading slash to allow subdirectories in proxy
- sources/ldap: log entire exception
- sources/ldap: use merger that only appends unique items to list
- sources/saml: fix incorrect ProtocolBinding being sent
- stages/authenticator\_validate: add ability to select multiple configuration stages which the user can choose
- stages/authenticator\_validate: fix handling when single configuration stage is selected
- stages/authenticator\_validate: handle non-existent device\_challenges
- Translate /web/src/locales/en.po in de (#2291)
- Translate /web/src/locales/en.po in pl (#2274)
- Translate /web/src/locales/en.po in zh\_TW (#2263)
- Translate /web/src/locales/en.po in zh-Hans (#2262)
- Translate /web/src/locales/en.po in zh-Hant (#2261)
- web/admin: fix invalid URLs in example proxy config
- web/admin: fix mismatched icons in overview and lists

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.2 from [here](https://goauthentik.io/version/2022.2/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

The previous backup directory will persist, and can still be used with other tools.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.2.1
```

Backup-related settings can be removed but will not cause any errors either.

---

## Release 2022.3

## New features

### Customizable user settings

User settings are now configured using flows and stages, allowing administrators to configure fields, add additional fields and run custom validation for user settings.

### `client_credentials` support

authentik now supports the OAuth `client_credentials` grant for machine-to-machine authentication. See [OAuth2 Provider](../../add-secure-apps/providers/oauth2/index.mdx)

## Deprecations

### `:stable` tag

To simplify the release process we don't publish explicitly tagged release-candidate versions anymore. With this change, the  tag will continue to point at the latest tagged release.

## Minor changes/fixes

- core: add initial app launch url (#2367)
- core: customisable user settings (#2397)
- core/api: allow filtering users by uid, add uid to search
- internal/ldap: fix panic when parsing lists with mixed types
- lib: fix default geoip path
- providers/oauth2: fix invalid launch URL being generated
- providers/oauth2: initial client\_credentials grant support (#2437)
- providers/proxy: always set rd param in addition to session to prevent wrong url in session
- web: cleanup default footer links
- web: prioritize ?locale parameter over saved locale
- web/admin: improve user and group management by showing related objects
- web/admin: use searchable select field for users and groups in policy binding form
- web/flows: fix rendering of help text on prompt stages

## Fixed in 2022.3.2

- core: replace uid with uuid search
- flows: revert default flow user change
- lib: lower default sample rate
- sources/ldap: fix parent\_group not being applied
- stages/authenticator\_validate: fix passwordless flows not working
- web/elements: fix error with blank SearchSelect elements in forms
- web/elements: fix search select background in dark mode
- web/elements: fix search-select hover background
- web/user: filter applications by launch URL lto show empty state
- web/user: fix duplicate help text in prompts

## Fixed in 2022.3.3

- core: fix provider launch URL being prioritized over manually configured launch URL
- crypto: open files in read-only mode for importing (#2536)
- outposts/ldap: prevent operations error from nil dereference (#2447)
- outposts/proxy: use Prefix in ingress for k8s
- web: fix style for selected item in select in dark mode
- web/admin: default to not include current session in flow play, add option to start with current session
- web/admin: fix user defaulting to 0 when not set in PolicyBindingForm
- web/elements: make SearchSelect optionally blankable

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.3 from [here](https://goauthentik.io/version/2022.3/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.3.1
```

---

## Release 2022.4

## Breaking changes

- Removal of HTTP Basic authentication for API requests

  For legacy reasons, authentik used to support HTTP-Basic authenticated requests, using the token as a password. This has been removed.

- Removal of deprecated context in Expression policies used in prompt stages

  Before this version, you could use both `context['*field_name*']` and `context['prompt_data']['*field_name*']`. The former one has been removed as it could overwrite other data in the context if the field name is the same as another context value.

- Added name field for invitations

  Invitations now require a name, used to better identify their purpose.

## New features

- Application Grouping

  Applications can now be grouped together to better organize connected applications in the user dashboard.

- JWT authentication for `client_credentials` grants

  Providers can now be configured to accept JWTs signed by configured certificates, which makes it a lot easier to services access to authentik, when an existing machine/service identity is provided (for example, this can be used to let Kubernetes Pods authenticate themselves to authentik via their service account)

## Minor changes/fixes

- core: add method to set key of token
- core: add num\_pk to group for applications that need a numerical group id
- internal: disable HTML encoding in go-generated log messages
- lifecycle: fix password and hostname in redis URI not properly quoted
- outposts: check if docker ports should be mapped before comparing ports
- policies: add policy log messages to test endpoints
- providers/oauth2: map internal groups to GitHub teams in GHE OAuth emulation (#2497)
- providers/oauth2: pass scope and other parameters to access policy request context
- stages/email: allow overriding of destination email in plan context
- stages/invitation: add invitation name
- stages/prompt: filter rest\_framework.fields.empty when field is not required
- stages/prompt: fix non-required fields not allowing blank values
- stages/prompt: set field default based on placeholder
- tenants: add tenant-level attributes, applied to users based on request
- web: live-convert to slug in fields where only slugs are allowed
- web: migrate dropdowns to wizards (#2633)
- web/admin: allow editing of invitations
- web/admin: fix missing protocols on generated nginx config
- web/admin: trigger update when provider wizard finishes
- web/user: add column layouts

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.4 from [here](https://goauthentik.io/version/2022.4/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.4.1
```

---

## Release 2022.5

## Breaking changes

- Twitter Source has been migrated to OAuth2

  This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs [here](../../users-sources/sources/social-logins/twitter/index.mdx).

- OAuth Provider: Redirect URIs are now checked using regular expressions

  Allowed Redirect URIs now accepts regular expressions to check redirect URIs to support wildcards. In most cases this will not change anything, however casing is also important now. Meaning if your redirect URI is "[https://Foo.bar](https://Foo.bar)" and allowed is "[https://foo.bar](https://foo.bar)", authorization will not be allowed. Additionally, the special handling when *Redirect URIs/Origins* is set to `*` has been removed. To get the same behavior, set *Redirect URIs/Origins* to `.+`.

## New features

- LDAP Outpost cached binding

  Instead of always executing the configured flow when a new Bind request is received, the provider can now be configured to cache the session from the initial flow execution, and directly validate credentials in the outpost. This drastically improves the bind performance.

  See [LDAP provider](../../add-secure-apps/providers/ldap/index.mdx#cached-bind)

- OAuth2: Add support for `form_post` response mode

- Don't prompt users for MFA when they've authenticated themselves within a time period

  You can now configure any [Authenticator Validation Stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx) stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the `Last validation threshold`.

- Optimize bundling of web assets

  Previous versions had the entire frontend bundled in a single file (per interface). This has been revamped to produce smaller bundle sizes for each interface to improve the loading times.

  Additionally, only the locales configured will be loaded on start, instead of all locales.

  Certain parts of the application are purposefully still contained in the initial bundle, especially for commonly used pages and default routes.

## Minor changes/fixes

- \*: decrease frequency of background tasks, smear tasks based on name and fqdn
- api: fix OwnerFilter filtering out objects for superusers
- core: add custom shell command which imports all models and creates events for model events
- core: add flag to globally disable impersonation
- events: fix created events only being logged as debug level
- flows: handle flow title formatting error better, add user to flow title context
- internal: add signal handler for SIGTERM
- outposts/ldap: cached bind (#2824)
- policies: fix current user not being set in server-side policy deny
- providers/oauth2: add support for form\_post response mode (#2818)
- providers/oauth2: allow regex matches for allowed redirect\_uri
- providers/oauth2: don't create events before client\_id can be verified to prevent spam
- providers/saml: make SAML metadata generation consistent
- root: export poetry deps to requirements.txt so we don't need poetry … (#2823)
- root: handle JSON error in metrics
- root: set SESSION\_SAVE\_EVERY\_REQUEST to enable sliding sessions
- sources/oauth: Fix wording for OAuth source names (#2732)
- stages/authenticator\_validate: remember (#2828)
- stages/identification: redirect with QS to keep next parameters (#2909)
- stages/user\_delete: fix delete stage failing when pending user is not explicitly set
- web: fix dateTimeLocal() dropping local timezone
- web: lazy load parts of interfaces (#2864)
- web/user: add missing checkbox element in user settings (#2762)

## Fixed in 2022.5.2

- internal: fix nil pointer dereference in ldap outpost
- internal: revert cookie path on proxy causing redirect loops
- outposts: allow externally managed SSH Config for outposts (#2917)
- outposts: ensure the user and token are created on initial outpost save
- root: fix missing curl in dockerfile
- web/admin: improve error handling in TokenCopyButton
- web/admin: make external host clickable
- web/user: fix use sub-pages not redirecting back to the subpage

## Fixed in 2022.5.3

- api: migrate to openapi generator v6 (#2968)
- api: update API browser to match admin UI and auto-switch theme
- core: fix username validator not allowing changes that can be done via flows
- crypto: set SAN in default generated Certificate to semi-random domain
- ensure all viewsets have filter and search and add tests (#2946)
- events: fix transport not allowing blank values
- flows: fix re-imports of entries with identical PK re-creating objects (#2941)
- providers/oauth2: handle attribute errors when validation JWK contains private key
- providers/oauth2: improve error handling for invalid regular expressions
- providers/oauth2: only set expiry on user when it was freshly created
- providers/oauth2: regex-escape URLs when set to blank
- providers/oauth2: set related\_name for many-to-many connections so used by detects the connection
- providers/saml: handle parse error
- root: Add docker-compose postgresql and redis healthchecks (#2958)
- stages/user\_write: fix typo in request context variable
- web: decrease elements that refresh on global refresh signal
- web/admin: add note that regex is used for redirect URIs
- web/admin: add set password button to user view page
- web/admin: fix broken flow execute link (#2940)
- web/admin: fix display of LDAP bind mode
- web/admin: fix flow diagram not updating on flow changes
- web/admin: fix phrasing on LDAP provider form for bind mode
- web/admin: refactor table refresh to preserve selected/expanded elements correctly
- web/elements: fix missing click handler on wizard close button
- web/elements: fix used\_by refreshing for all elements when using DeleteBulkForm
- website/docs: Fix misconfiguration causing POST requests behind Nginx to timeout (#2967)

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.5 from [here](https://goauthentik.io/version/2022.5/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.5.1
```

---

## Release 2022.6

## New features

- Added OIDC well-known and JWKS URL in OAuth Source

  These fields can be used to automatically configure OAuth Sources based on the [OpenID Connect Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html). Additionally, you can manually define a JWKS URL or raw JWKS data, and this can be used for Machine-to-machine authentication for OAuth2 Providers.

- Notifications are no longer created by default

  Instead of creating a Notification with each transport, there is now a new Transport mode called "Local", which locally creates the Notifications. This also adds the ability to customize the notification using a mapping.

- MFA Validation threshold has been migrated to signed cookies

  Last MFA validation is now saved in a signed cookie, which changes the behavior so that only the current browser is affected by MFA validation, and an attacker cannot exploit the fact that a user has recently authenticated with MFA.

- Verification-only SMS Devices

  SMS authenticator stages can now be configured to hash the phone number. This is useful if you want to require your users to configure and confirm their phone numbers, without saving them in a readable-format.

- The LDAP outpost would incorrectly return `groupOfUniqueNames` as a group class when the members where returned in a manner like `groupOfNames` requires. `groupOfNames` has been added as an objectClass for LDAP Groups, and `groupOfUniqueNames` will be removed in the next version.

- Preview support for forward auth when using Envoy

## Minor changes/fixes

- api: migrate to openapi generator v6 (#2968)
- api: update API browser to match admin UI and auto-switch theme
- core: improve loading speed of flow background
- ensure all viewsets have filter and search and add tests (#2946)
- flows: fix re-imports of entries with identical PK re-creating objects
- lifecycle: cleanup prometheus metrics, remove PII (#2972)
- policies: fix incorrect bound\_to count
- providers/oauth2: add configuration error event when wrong redirect uri is used in token request
- providers/oauth2: handle attribute errors when validation JWK contains private key
- providers/oauth2: only set expiry on user when it was freshly created
- providers/oauth2: regex-escape URLs when set to blank
- root: Add docker-compose postgresql and redis healthchecks (#2958)
- root: disable session\_save\_every\_request as it causes race conditions
- web/elements: fix top-right dialog close button not resetting form
- web/elements: fix used\_by refreshing for all elements when using DeleteBulkForm
- web/user: fix static prompt fields being rendered with label
- web/user: improve ux for restarting user settings flow

## Fixed in 2022.6.2

- \*: make user logging more consistent
- core: add additional filters to source viewset
- core: add setting to open application launch URL in a new browser tab (#3037)
- core: add slug to built-in source
- events: fix error when attempting to create event with GeoIP City in context
- providers/ldap: fix existing binder not being carried forward correctly
- providers/oauth2: add JWKS URL to OAuth2ProviderSetupURLs
- providers/proxy: use same redirect-save code for all modes
- sources/oauth: fix twitter client missing basic auth
- stages/authenticator\_validate: fix error in passwordless webauthn
- web/elements: add error handler when table fails to fetch objects

## Fixed in 2022.6.3

- core: fix migrations when creating bootstrap token
- internal: don't sample gunicorn proxied requests
- internal: fix routing to embedded outpost
- internal: skip tracing for go healthcheck and metrics endpoints
- lifecycle: run bootstrap tasks inline when using automated install
- policies: consolidate log user and application
- providers/oauth2: add test to ensure capitalized redirect\_uri isn't changed
- providers/oauth2: don't lowercase URL for token requests (#3114)
- providers/oauth2: if a redirect\_uri cannot be parsed as regex, compare strict (#3070)
- providers/proxy: only send misconfiguration event once
- root: ignore healthcheck routes in sentry tracing
- stages/authenticator\_validate: add webauthn tests (#3069)
- web/admin: lint bound group under policies
- web/admin: remove invalid requirement for usernames
- web/elements: add spinner when loading dynamic routes
- web/flows: add divider to identification stage for security key
- web/flows: fix error when webauthn operations failed and user retries
- web/flows: remove autofocus from password field of identifications stage

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.6 from [here](https://goauthentik.io/version/2022.6/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.6.1
```

---

## Release 2022.7

## Breaking changes

- Removal of verification certificates for Machine-to-Machine authentication in OAuth 2 Provider

  Instead, create an OAuth Source with the certificate configured as JWKS Data, and enable the source in the provider.

- Maximum Limit of group recursion

  In earlier versions, cyclic group relations can lead to a deadlock when one of groups in the relationship are bound to an application/flow/etc.
  This is now limited to 20 levels of recursion.

- Change in context behavior for policies executed within flows

  In previous versions, the policy context would be set to a reference to the currently active flow plan context. This makes it so any changes to `context` were directly reflected in the flow context. The context has been changed to only include the values, and as such updates like this won't be reflected in the flow. Instead, `context['flow_plan']` is now set, which contains a full reference to the flow Plan, allowing for more customizability than previously. Context changes can be made by modifying `context['flow_plan'].context`.

## New features

- User paths

  To better organize users, they can now be assigned a path. This allows for organization of users based on sources they enrolled with/got imported from, organizational structure or any other structure.

  Sources now have a path template to specify which path users created by it should be assigned. Additionally, you can set the path in the user\_write stage in any flow, and it can be dynamically overwritten within a flow's context.

- API Authentication using JWT

  OAuth Refresh tokens that have been issued with the scope `goauthentik.io/api` can now be used to authenticate to the API on behalf of the user the token belongs to.

- Version-family tagged Container images

  Instead of having to choose between using the `:latest` tag and explicit versions like `:2022.7.1`, there are now also version-family tags (:2022.7). This allows for sticking with a single version but still getting bugfix updates.

- OAuth2 Provider default Scopes

  Starting with authentik 2022.7, when an OAuth client doesn't specify any scopes, authentik will treat the request as if all the configured scopes of that provider had been requested. Normal consent is still required depending on the configured flow. No special scopes will be added, as those can't be selected in the configuration.

## Minor changes/fixes

- \*: define prometheus metrics in apps to prevent re-import
- api: add basic jwt auth support with required scope (#2624)
- ci: add version family (#3059)
- core: add limit of 20 to group recursion
- core: create FlowToken instead of regular token for generated recovery links (#3193)
- core: mark session as modified instead of saving it directly to bump expiry
- core: re-create anonymous user when repairing permissions
- core: user paths (#3085)
- flows: add shortcut to redirect current flow (#3192)
- flows: denied action (#3194)
- flows: show messages from ak\_message when flow is denied
- internal: failback with self-signed cert if cert for tenant fails to load
- internal: fix nil pointer reference
- internal: skip tracing for go healthcheck and metrics endpoints
- lifecycle: fix confusing success messages in startup healthiness check
- lifecycle: run bootstrap tasks inline when using automated install
- lifecycle: Update postgres healthcheck for compose with user information (#3143)
- policies: consolidate log user and application
- providers/oauth2: don't lowercase URL for token requests (#3114)
- providers/oauth2: ensure refresh tokens are URL safe
- providers/oauth2: fix OAuth form\_post response mode for code response\_type
- providers/oauth2: if a redirect\_uri cannot be parsed as regex, compare strict (#3070)
- providers/oauth2: if no scopes are sent in authorize request, select all configured scopes
- providers/oauth2: remove deprecated verification\_keys (#3071)
- providers/oauth2: token revoke (#3077)
- providers/proxy: only send misconfiguration event once
- root: ignore healthcheck routes in sentry tracing
- sources/ldap: add configuration for LDAP Source ciphers
- web: fix redirect when accessing authentik URLs authenticated
- web: improve detection for locales
- web/admin: default to users path in sidebar link
- web/admin: link bound group under policies
- web/admin: only pre-select oauth2 provider key if creating a new instance
- web/admin: remove invalid requirement for usernames
- web/elements: add spinner when loading dynamic routes
- web/elements: auto-switch themes for codemirror
- web/flows: add divider to identification stage for security key
- web/flows: fix error when webauthn operations failed and user retries
- web/flows: remove autofocus from password field of identifications stage
- web/flows: statically import webauthn-related stages for safari issues

## Fixed in 2022.7.2

- flows: fix OOB flow incorrectly setting pending user
- stages/prompt: add basic file field (#3156)
- tenants: add default\_locale read only field, pre-hydrate in flows and read in autodetect as first choice

## Fixed in 2022.7.3

- core: delete expired models when filtering instead of excluding them
- providers/oauth2: correctly log authenticated user for OAuth views using protected\_resource\_view
- sources/oauth: use oidc preferred\_username if set, otherwise nickname
- stages/consent: fix permissions for consent API (allow owner to delete)
- stages/prompt: force required to false when using readonlyfield
- stages/prompt: try to base64 decode file, fallback to keeping value as-is
- web/elements: improve contrast for codemirror backgrounds

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.7 from [here](https://goauthentik.io/version/2022.7/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.7.1
```

---

## Release 2022.8

## Breaking changes

- Prompt fields with file type are now a full Base64 Data-URI

  Previously the data was parsed into a string when possible, and when decoding failed, the raw base64 would be saved. Now, the entire URI is parsed, validated and kept in one piece, to make it possible to validate/save the MIME type.

## New features

- Blueprints

  Blueprints allow for the configuration, automation and templating of authentik objects and configurations. They can be used to bootstrap new instances, configure them automatically without external tools, and to template configurations for sharing. See more [here](../../customize/blueprints/index.mdx).

  For installations upgrading to 2022.8, if a single flow exists, then the default blueprints will not be activated, to not overwrite user modifications.

- Simplified forward auth

  In previous releases, to use forward auth, the reverse proxy would have to be configured to both send auth requests to the outpost, but also allow access to URLs starting with `/outpost.goauthentik.io`. The second part is now no longer required, with the exception of nginx. Existing setups should continue to function as previously.

- Support for Caddy forward auth

  Based on the traefik support, there is now dedicated support for Caddy with configuration examples, see [here](../../add-secure-apps/providers/proxy/forward_auth.mdx).

## Minor changes/fixes

- \*: improve error handling for startup tasks
- core: add API Endpoint to get all MFA devices, add web ui to delete MFA devices of any user
- core: add attributes. avatar method to allow custom uploaded avatars
- core: pre-hydrate config into templates to directly load correct assets
- flows: migrate flows to be yaml (#3335)
- internal: centralise config for listeners to use same config system everywhere (#3367)
- internal: fix outposts not reacting to signals while starting
- internal: fix race conditions when accessing settings before bootstrap
- internal: walk config in go, check, parse and load from scheme like in python
- lifecycle: optimize container lifecycle and process signals (#3332)
- providers/oauth2: don't separate scopes by comma-space in created events
- providers/oauth2: fix scopes without descriptions not being saved in consent
- providers/proxy: add caddy endpoint (#3330)
- providers/proxy: add is\_superuser to ak\_proxy object, only show full error when superuser
- providers/proxy: no exposed urls (#3151)
- root: fix dockerfile for blueprints
- sources/oauth: correctly concatenate URLs to allow custom parameters to be passed to authorization server
- sources/oauth: only send header authentication for OIDC source
- sources/oauth: use mailcow full\_name as username for mailcow source (#3299)
- stages/\*: use stage-bound logger when possible
- stages/authenticator\_validate: improve error handling for duo
- stages/authenticator\_duo: fix imported Duo Device not having a name
- stages/authenticator\_sms: use twilio SDK, improve docs
- stages/authenticator\_totp: remove single device per user limit
- stages/consent: fix error when requests with identical empty permissions
- stages/consent: fix for post requests (#3339)
- stages/prompt: fix tests for file field

## Fixed in 2022.8.2

- blueprints: add generic export next to flow exporter (#3439)
- blueprints: allow for adding remote blueprints (#3435)
- blueprints: fix exporter not ignoring non-SerializerModel objects
- blueprints: fix issue in prod setups with encoding dataclasses via json
- blueprints: remove \_state from exporter blueprints
- core: fix pre-hydrated config not being escaped properly
- events: correctly handle lists for cleaning/sanitization
- internal: fix routing for requests with querystring signature to embedded outpost
- lifecycle: add worker-status command to debug worker cpu usage issues
- providers/oauth2: fix oauth2 requests being logged as unauthenticated
- sources/oauth: fix missing doseq param for updating URL query string
- web/elements: fix automatic slug not working on newly opened forms
- web/flows: simplify consent's permission handling

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.8 from [here](https://goauthentik.io/version/2022.8/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.8.1
```

---

## Release 2022.9

## Breaking changes

- `WORKERS` environment variable has been renamed to match other config options, see [Configuration](../../install-config/configuration/configuration.mdx#authentik_web__workers)

## New features

- UI for Duo device Import

  Instead of manually having to call an API endpoint, there's now a UI for importing Duo devices.

- Duo Admin API integration

  When using a Duo MFA, Duo Access or Duo Beyond plan, authentik can now automatically import devices from Duo into authentik. More info [here](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx).

## API Changes

#### What's New

***

##### `POST` /stages/authenticator/duo/\{stage\_uuid}/import\_device\_manual/

##### `POST` /stages/authenticator/duo/\{stage\_uuid}/import\_devices\_automatic/

#### What's Deleted

***

##### `POST` /stages/authenticator/duo/\{stage\_uuid}/import\_devices/

#### What's Changed

***

##### `GET` /stages/authenticator/duo/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `admin_integration_key` (string)

##### `PUT` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `admin_integration_key` (string)

- Added property `admin_secret_key` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `admin_integration_key` (string)

##### `PATCH` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `admin_integration_key` (string)

- Added property `admin_secret_key` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `admin_integration_key` (string)

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'xak-flow-error' component:

  - Property `type` (string)

    Enum values:

    - `native`
    - `shell`
    - `redirect`

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

    - Property `title` (string)

    - Property `background` (string)

    - Property `cancel_url` (string)

    - Property `layout` (string)

      Enum values:

      - `stacked`
      - `content_left`
      - `content_right`
      - `sidebar_left`
      - `sidebar_right`

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `pending_user` (string)

  - Property `pending_user_avatar` (string)

  - Property `request_id` (string)

  - Property `error` (string)

  - Property `traceback` (string)

##### `POST` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'xak-flow-error' component:

  - Property `type` (string)

    Enum values:

    - `native`
    - `shell`
    - `redirect`

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

    - Property `title` (string)

    - Property `background` (string)

    - Property `cancel_url` (string)

    - Property `layout` (string)

      Enum values:

      - `stacked`
      - `content_left`
      - `content_right`
      - `sidebar_left`
      - `sidebar_right`

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `pending_user` (string)

  - Property `pending_user_avatar` (string)

  - Property `request_id` (string)

  - Property `error` (string)

  - Property `traceback` (string)

##### `POST` /stages/authenticator/duo/

###### Request:

Changed content type : `application/json`

- Added property `admin_integration_key` (string)

- Added property `admin_secret_key` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `admin_integration_key` (string)

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorDuoStage Serializer

    - Added property `admin_integration_key` (string)

## Minor changes/fixes

- \*: cleanup stray print calls
- \*: remove remaining default creation code in squashed migrations
- blueprint: fix EntryInvalidError not being handled in tasks
- blueprints: add meta model to apply blueprint within blueprint for dependencies (#3486)
- blueprints: don't export events by default and exclude anonymous user
- blueprints: OCI registry support (#3500)
- blueprints: use correct log level when re-logging import validation logs
- core: fix custom favicon not being set correctly on load
- core: improve error template (#3521)
- crypto: add command to import certificates
- events: fix MonitoredTasks' save\_on\_success not behaving as expected
- events: reset task info when not saving on success
- events: save event to test notification transport
- flows: fix incorrect diagram for policies bound to flows
- flows: migrate FlowExecutor error handler to native challenge instead of shell
- internal: fix outposts not logging flow execution errors correctly
- internal: optimize outpost's flow executor to use less requests
- internal: use config system for workers/threads, document the settings (#3626)
- outposts: fix oauth state when using signature routing (#3616)
- outposts/proxy: fix redirect path when external host is a subdirectory (#3628)
- providers/oauth2: add x5c (#3556)
- providers/proxy: fix routing based on signature in traefik and caddy
- root: make redis persistent in docker-compose
- root: reuse custom log helper from config and cleanup duplicate functions
- root: shorten outpost docker healthcheck intervals
- sources/ldap: start\_tls before binding but without reading server info
- sources/oauth: use GitHub's dedicated email API when no public email address is configured
- sources/oauth: use UPN for username with azure AD source
- stages/authenticator\_duo: fix 404 when current user does not have permissions to view stage
- stages/authenticator\_duo: improved import (#3601)
- stages/consent: default to expiring consent instead of always\_require
- tenants: handle all errors in default\_locale
- web: fix checkbox styling on applications form
- web: fix scrolling in modals in low-height views (#3596)
- web: use mermaidjs (#3623)
- web/admin: enable blueprint instances by default
- web/flows: fix ak-locale prompt being rendered without name attribute
- web/flows: update flow background
- web/user: justify content on user settings page on desktop

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2022.9 from [here](https://goauthentik.io/version/2022.9/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.9.1
```

---

## Release 2023.1

## Breaking changes

- Deprecated HaveIBeenPwned policy has been removed

  This policy type has been deprecated since 2022.11 and was automatically migrated to the password policy with equivalent options.

## New features

- SLO Support for SAML provider

  authentik now supports SAML SLO (Single logout).

- Proxy provider now accepts HTTP Basic and Bearer authentication

  See [Header authentication](../../add-secure-apps/providers/proxy/header_authentication.mdx).

- LDAP provider now works with Code-based MFA stages

  If the configured authentication flow has an authenticator validation stage which allows code-based devices, and the user attempting to login has a TOTP or Static device, they can enter their password followed by a semicolon and the authenticator code to login. SMS devices are not supported.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2023.1 from [here](https://goauthentik.io/version/2023.1/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2023.1.0
```

## Minor changes/fixes

- \*: strip leading and trailing whitespace when reading config values from files
- admin: include task duration in API (#4428)
- blueprints: Add `!Enumerate`, `!Value` and `!Index` tags (#4338)
- blueprints: don't set session\_duration in default and example flows (#4448)
- blueprints: Fix resolve model\_name in `!Find` tag (#4371)
- blueprints: internal storage (#4397)
- crypto: prevent creation of duplicate self-signed default certs
- events: exclude base models from model audit log
- events: rework metrics (#4407)
- internal: check certificate value and not IsSet
- internal: fix race condition with config loading on startup, add index on debug server
- internal: improve error handling
- outposts: use common config loader for outposts to support loading values from file
- outposts/ldap: decrease verbosity
- outposts/proxy: add header to prevent redirects
- outposts/proxy: allow setting no-redirect via header or query param
- outposts/proxy: cache basic and bearer credentials for one minute
- outposts/proxy: fix error handling, remove requirement for profile/etc scopes
- outposts/proxy: make logged user more consistent, set FlushInterval
- outposts/proxy: set http code when no redirect header is set
- policies/hibp: remove deprecated (#4363)
- providers/ldap: add code-MFA support for ldap provider (#4354)
- providers/oauth2: correctly fill claims\_supported based on selected scopes (#4429)
- providers/oauth2: don't allow spaces in scope\_name
- providers/oauth2: fallback to anonymous user for policy engine
- providers/oauth2: use guardian anonymous user to get claims for provider info
- providers/proxy: add initial header token auth (#4421)
- providers/proxy: add setting to intercept authorization header (#4457)
- providers/proxy: add tests for proxy basic auth (#4357)
- providers/saml: initial SLO implementation (#2346)
- root: show error when geoIP download fails
- sources/ldap: don't run membership sync if group sync is disabled
- sources/ldap: make task timeout adjustable
- sources/ldap: manual import (#4456)
- sources/ldap: only warn about missing groups when source is configured to sync groups
- stages/user\_write: add more user creation options (#4367)
- web: add core-js polyfill for safari
- web: ensure img tags have alt attributes
- web: fix radio label code in dark mode
- web: fix scrollbar corner color in dark mode
- web: migrate checkbox to switch (#4409)
- web/admin: better show dev build
- web/admin: fix certificate filtering for LDAP verification certificate
- web/admin: fix overflow in aggregate cards
- web/admin: link impersonation user for events
- web/admin: rework admin dashboard, add more links, remove user and group graphs (#4399)
- web/admin: show GeoIP information inline in events
- web/elements: fix pagination page button colors in dark mode
- web/elements: use correct Action Label for user related events

## Fixed in 2023.1.1

- add tests to prevent empty SAN
- blueprints: fix OOB email field overwriting user settings email field
- ci: build beta for amd64 and arm64 (#4468)
- crypto: ensure we don't generate an empty SAN certificate
- crypto: fallback when no SAN values are given
- outposts/ldap: fix queries filtering objectClass with non-lowercase values
- outposts/proxy: fix panic due to IsSet misbehaving
- providers/oauth2: more x5c and ecdsa x/y tests (#4463)
- providers/proxy: fix issuer for embedded outpost (#4480)
- sources/ldap: add e2e LDAP source tests (#4462)
- stages: always use get\_pending\_user instead of getting context user
- stages/authenticator\_sms: fix code not being sent when phone\_number is in context
- web/admin: don't enable execution logging by default
- web/admin: improve display of rule severity
- web/admin: improve display of system task exception
- web/admin: link group of notification rule
- web/elements: fix pf-c-switch not rendering correctly in pure tables
- web/elements: fix SearchSelect not working on safari
- web/flows: fix flow executor background overlay in safari

## Fixed in 2023.1.2

- stages/user\_write: fix migration setting wrong value, fix form

## Fixed in 2023.1.3

- \*: fix [CVE-2023-26481](../../security/cves/CVE-2023-26481.mdx), Reported by [@fuomag9](https://github.com/fuomag9)

## API Changes

#### What's Deleted

***

##### `GET` /policies/haveibeenpwned/

##### `POST` /policies/haveibeenpwned/

##### `GET` /policies/haveibeenpwned/\{policy\_uuid}/

##### `PUT` /policies/haveibeenpwned/\{policy\_uuid}/

##### `DELETE` /policies/haveibeenpwned/\{policy\_uuid}/

##### `PATCH` /policies/haveibeenpwned/\{policy\_uuid}/

##### `GET` /policies/haveibeenpwned/\{policy\_uuid}/used\_by/

#### What's Changed

***

##### `GET` /admin/metrics/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `authorizations`
  - `logins`
  - `logins_failed`

  New optional properties:

  - `authorizations_per_1h`
  - `logins_failed_per_1h`
  - `logins_per_1h`

  * Added property `logins` (array)

    Items (object): > Coordinates for diagrams

    - Property `x_cord` (integer)

    - Property `y_cord` (integer)

  * Added property `logins_failed` (array)

  * Added property `authorizations` (array)

  * Deleted property `logins_per_1h` (array)

  * Deleted property `logins_failed_per_1h` (array)

  * Deleted property `authorizations_per_1h` (array)

##### `GET` /core/users/\{id}/metrics/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `authorizations`
  - `logins`
  - `logins_failed`

  New optional properties:

  - `authorizations_per_1h`
  - `logins_failed_per_1h`
  - `logins_per_1h`

  * Added property `logins` (array)

  * Added property `logins_failed` (array)

  * Added property `authorizations` (array)

  * Deleted property `logins_per_1h` (array)

  * Deleted property `logins_failed_per_1h` (array)

  * Deleted property `authorizations_per_1h` (array)

##### `GET` /managed/blueprints/\{instance\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `path`

  * Added property `content` (string)

##### `PUT` /managed/blueprints/\{instance\_uuid}/

###### Request:

Changed content type : `application/json`

New optional properties:

- `path`

* Added property `content` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `path`

  * Added property `content` (string)

##### `PATCH` /managed/blueprints/\{instance\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `content` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `path`

  * Added property `content` (string)

##### `POST` /managed/blueprints/\{instance\_uuid}/apply/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `path`

  * Added property `content` (string)

##### `GET` /outposts/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `intercept_header_auth` (boolean)
    > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Removed enum value:

    - `authentik.policies.hibp`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Removed enum value:

  - `authentik.policies.hibp`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Removed enum value:

    - `authentik.policies.hibp`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Removed enum value:

  - `authentik.policies.hibp`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Removed enum value:

    - `authentik.policies.hibp`

##### `GET` /propertymappings/scope/\{pm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `scope_name` (string)
    > Scope name requested by the client

##### `PUT` /propertymappings/scope/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `scope_name` (string)
  > Scope name requested by the client

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `scope_name` (string)
    > Scope name requested by the client

##### `PATCH` /propertymappings/scope/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `scope_name` (string)
  > Scope name requested by the client

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `scope_name` (string)
    > Scope name requested by the client

##### `GET` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `client_id`

  * Added property `client_id` (string)

  * Added property `intercept_header_auth` (boolean)

    > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

  * Added property `jwks_sources` (array)

    Items (string):

##### `PUT` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `intercept_header_auth` (boolean)

  > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

- Added property `jwks_sources` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `client_id`

  * Added property `client_id` (string)

  * Added property `intercept_header_auth` (boolean)

    > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

  * Added property `jwks_sources` (array)

##### `PATCH` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `intercept_header_auth` (boolean)

  > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

- Added property `jwks_sources` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `client_id`

  * Added property `client_id` (string)

  * Added property `intercept_header_auth` (boolean)

    > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

  * Added property `jwks_sources` (array)

##### `GET` /admin/system\_tasks/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serialize TaskInfo and TaskResult

  New required properties:

  - `task_duration`

  * Added property `task_duration` (integer)

##### `GET` /admin/system\_tasks/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `task_duration`

  * Added property `task_duration` (integer)

##### `POST` /managed/blueprints/

###### Request:

Changed content type : `application/json`

New optional properties:

- `path`

* Added property `content` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New optional properties:

  - `path`

  * Added property `content` (string)

##### `GET` /managed/blueprints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Info about a single blueprint instance file

    New optional properties:

    - `path`

    * Added property `content` (string)

##### `GET` /outposts/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Proxy provider serializer for outposts

    - Added property `intercept_header_auth` (boolean)
      > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Removed enum value:

  - `authentik.policies.hibp`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Removed enum value:

    - `authentik.policies.hibp`

##### `GET` /policies/event\_matcher/

###### Parameters:

Changed: `app` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Removed enum value:

      - `authentik.policies.hibp`

##### `POST` /propertymappings/scope/

###### Request:

Changed content type : `application/json`

- Changed property `scope_name` (string)
  > Scope name requested by the client

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `scope_name` (string)
    > Scope name requested by the client

##### `GET` /propertymappings/scope/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ScopeMapping Serializer

    - Changed property `scope_name` (string)
      > Scope name requested by the client

##### `POST` /providers/proxy/

###### Request:

Changed content type : `application/json`

- Added property `intercept_header_auth` (boolean)

  > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

- Added property `jwks_sources` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `client_id`

  * Added property `client_id` (string)

  * Added property `intercept_header_auth` (boolean)

    > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

  * Added property `jwks_sources` (array)

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ProxyProvider Serializer

    New required properties:

    - `client_id`

    * Added property `client_id` (string)

    * Added property `intercept_header_auth` (boolean)

      > When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

    * Added property `jwks_sources` (array)

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_slo_post`
  - `url_slo_redirect`

  * Added property `url_slo_post` (string)

  * Added property `url_slo_redirect` (string)

##### `PUT` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_slo_post`
  - `url_slo_redirect`

  * Added property `url_slo_post` (string)

  * Added property `url_slo_redirect` (string)

##### `PATCH` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_slo_post`
  - `url_slo_redirect`

  * Added property `url_slo_post` (string)

  * Added property `url_slo_redirect` (string)

##### `GET` /sources/ldap/\{slug}/sync\_status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serialize TaskInfo and TaskResult

  New required properties:

  - `task_duration`

  * Added property `task_duration` (integer)

##### `POST` /providers/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `url_slo_post`
  - `url_slo_redirect`

  * Added property `url_slo_post` (string)

  * Added property `url_slo_redirect` (string)

##### `GET` /providers/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    New required properties:

    - `url_slo_post`
    - `url_slo_redirect`

    * Added property `url_slo_post` (string)

    * Added property `url_slo_redirect` (string)

##### `GET` /sources/oauth/

###### Parameters:

Added: `has_jwks` in `query`

> Only return sources with JWKS data

##### `GET` /stages/user\_write/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `user_creation_mode` (string)

    Enum values:

    - `never_create`
    - `create_when_required`
    - `always_create`

  - Deleted property `can_create_users` (boolean)
    > When set, this stage can create users. If not enabled and no user is available, stage will fail.

##### `PUT` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `user_creation_mode` (string)

- Deleted property `can_create_users` (boolean)
  > When set, this stage can create users. If not enabled and no user is available, stage will fail.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `user_creation_mode` (string)

  - Deleted property `can_create_users` (boolean)
    > When set, this stage can create users. If not enabled and no user is available, stage will fail.

##### `PATCH` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `user_creation_mode` (string)

- Deleted property `can_create_users` (boolean)
  > When set, this stage can create users. If not enabled and no user is available, stage will fail.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `user_creation_mode` (string)

  - Deleted property `can_create_users` (boolean)
    > When set, this stage can create users. If not enabled and no user is available, stage will fail.

##### `POST` /stages/user\_write/

###### Request:

Changed content type : `application/json`

- Added property `user_creation_mode` (string)

- Deleted property `can_create_users` (boolean)
  > When set, this stage can create users. If not enabled and no user is available, stage will fail.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `user_creation_mode` (string)

  - Deleted property `can_create_users` (boolean)
    > When set, this stage can create users. If not enabled and no user is available, stage will fail.

##### `GET` /stages/user\_write/

###### Parameters:

Added: `user_creation_mode` in `query`

Deleted: `can_create_users` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserWriteStage Serializer

    - Added property `user_creation_mode` (string)

    - Deleted property `can_create_users` (boolean)
      > When set, this stage can create users. If not enabled and no user is available, stage will fail.

---

## Release 2023.10

## Breaking changes

- Requests with missing trailing slash are no longer redirected

  In previous versions, requests to a path like `/api/v3/core/users` would be redirected to `[...]/users/`. This redirect would cause mutating requests (such as POST, PUT and PATCH) to fail as they would get redirected to `[...]/users/`. The redirect has been disabled, which will not have an impact on a correctly configured setup.

- It is only possible to upgrade to 2023.10 from 2023.8. This is due to a bug in the migrations which will be fixed in a future release (#7326).

- Warning: The first 2024.x version of this chart will see a rework that will include breaking changes. The breaking changes will be noted in the next Release notes.

## New features

- RBAC (preview)

  With this release we're introducing the ability to finely configure permissions within authentik. These permissions can be used to delegate different tasks, such as user management, application creation and more to users without granting them full superuser permissions. With this system, a least-privilege system can also be implemented much more easily. See more info [here](../../users-sources/access-control/index.mdx)

- LDAP Provider improvements

  The LDAP Provider now has an expanded schema, increasing the compatibility with clients that use the LDAP schema to parse data and .NET applications on Windows.

- Improved Proxy provider logout

  The proxy provider will now terminate all sessions when a user logs out of authentik or their session expires.

- LDAP Source structure mirroring

  The LDAP Source has a new default property mapping called `authentik default LDAP Mapping: DN to User Path` which will map the LDAP users' DN to the user path in authentik, keeping the same structure as the directory the source syncs from.

- OAuth Source OIDC auto-refresh

  OAuth sources that have a *OIDC Well-known URL* or *OIDC JWKS URL* set will periodically be updated to use the correct configuration based on the configured URLs.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2023.10/docker-compose.yml
docker-compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.10
```

## Minor changes/fixes

- blueprints: fix mismatched user-login stage order (#7030)
- ci: test with postgres 16
- core/api: add uuid field to core api user http response (#7110)
- core: Initial RBAC (#6806)
- core: Use branding\_title in the end session page (#7282)
- core: prevent self-impersonation (#6885)
- core: remove celery's duplicate max\_tasks\_per\_child (#6840)
- events: fix error when storing events with date/time/datetime/etc (#7028)
- flows: remove need for post() wrapper by using dispatch (#6765)
- flows: stage\_invalid() makes flow restart depending on invalid\_response\_action setting (#6780)
- outposts: use channel groups instead of saving channel names (#7183)
- policies/reputation: require either check to be enabled (#6764)
- policies: fix cached policy metric (#7068)
- providers/ldap: add windows adsi support (#7098)
- providers/proxy: improve SLO by backchannel logging out sessions (#7099)
- providers/radius: TOTP MFA support (#7217)
- providers/saml: add default RelayState value for IDP-initiated requests (#7100)
- providers/saml: set WantAuthnRequestsSigned in metadata (#6851)
- providers/scim: check that a provider exists before starting scim task (#6841)
- providers/scim: remove preview banner (#7166)
- root: add option to disable beat when running worker (#6849)
- root: connect to backend via socket (#6720)
- root: disable APPEND\_SLASH (#6928)
- root: extended flow and policy metrics (#7067)
- root: handle SIGHUP and SIGUSR2, healthcheck gunicorn (#6630)
- root: make Celery worker concurrency configurable (#6837)
- root: replace boj/redistore with vendored version of rbcervilla/redisstore (#6988)
- sources/ldap: add default property mapping to mirror directory structure (#6990)
- sources/ldap: add lock to sync (#6930)
- sources/ldap: add warning when a property mapping returns None or bytes (#6913)
- sources/ldap: fix FreeIPA nsaccountlock sync (#6745)
- sources/ldap: fix attribute path resolution (#7090)
- sources/ldap: fix inverted interpretation of FreeIPA nsaccountlock (#6877)
- sources/ldap: fix task timeout for ldap\_sync\_all and ldap\_sync\_single (#6809)
- sources/oauth: fix oidc well-known parsing (#7248)
- sources/oauth: include default JWKS URLs for OAuth sources (#6992)
- sources/oauth: periodically update OAuth sources' OIDC configuration (#7245)
- stages/authenticator\_sms: fix error when phone number from context already exists (#7264)
- stages/authenticator: vendor otp (#6741)
- stages/deny: add custom message (#7144)
- stages/email: Fix query parameters getting lost in Email links (#5376)
- stages/email: rework email templates (#7029)
- stages/invitation: fix mis-matched serializer class for invitation (#7018)
- stages/password: fix failed\_attempts\_before\_cancel allowing one too many (#6763)
- web/admin: add additional Flow info (#7155)
- web/admin: fix application icon size (#6738)
- web/admin: fix flow-search not being able to unset (#6838)
- web/admin: fix not being able to unset certificates (#6767)
- web/admin: fix prompt form and codemirror mode (#7231)
- web/admin: fix webauthn label order, add raw value (#6905)
- web/admin: improve user email button labels (#7233)
- web/admin: invitation stage: default "continue without invitation" to false
- web/admin: use `<pre>` for order field on bound elements (#7031)
- web/admin: user details few tooltip buttons (#6899)
- web/flows: fix plex login not opening new tab on mobile safari (#7050)
- web/user: fix incorrect link to admin interface (#6993)
- web/user: fix unenrollment flow not being shown (#6972)
- web: change 'Attributes' to 'Custom attributes' on Invitation Field (#7145)
- web: the return of pseudolocalization (#7190)

## Fixed in 2023.10.1

- lifecycle: fix otp merge migration (#7315)

## Fixed in 2023.10.2

- \*: fix [CVE-2023-46249](../../security/cves/CVE-2023-46249.mdx), reported by [@devSparkle](https://github.com/devSparkle)
- blueprints: fix entries with state: absent not being deleted if their serializer has errors (#7345)
- crypto: fix race conditions when creating self-signed certificates on startup (#7344)
- lifecycle: rework otp\_merge migration (#7359)
- providers/proxy: to fix duplicate cookie (#7324)
- rbac: handle lookup error (#7341)
- stages/email: fix sending emails from task (#7325)
- web/admin: fix @change handler for ak-radio elements (#7348)
- web/admin: fix role form reacting to enter (#7330)

## Fixed in 2023.10.3

- ci: explicitly give write permissions to packages (cherry-pick #7428) (#7430)
- core: fix worker beat toggle inverted (cherry-pick #7508) (#7509)
- events: fix gdpr compliance always running (cherry-pick #7491) (#7505)
- providers/oauth2: set auth\_via for token and other endpoints (cherry-pick #7417) (#7427)
- providers/proxy: fix closed redis client (cherry-pick #7385) (#7429)
- root: Improve multi arch Docker image build speed (cherry-pick #7355) (#7426)
- sources/oauth: fix patreon (cherry-pick #7454) (#7456)
- stages/email: fix duplicate querystring encoding (cherry-pick #7386) (#7425)
- web: bugfix: broken backchannel selector (cherry-pick #7480) (#7507)
- web/admin: fix html error on oauth2 provider page (cherry-pick #7384) (#7424)
- web/flows: attempt to fix bitwareden android compatibility (cherry-pick #7455) (#7457)

## Fixed in 2023.10.4

- ci: fix permissions for release pipeline to publish binaries (cherry-pick #7512) (#7621)
- core: bump golang from 1.21.3-bookworm to 1.21.4-bookworm (cherry-pick #7483) (#7622)
- events: don't update internal service accounts unless needed (cherry-pick #7611) (#7640)
- events: fix missing model\_\* events when not directly authenticated (cherry-pick #7588) (#7597)
- events: sanitize functions (cherry-pick #7587) (#7589)
- providers/proxy: Fix duplicate cookies when using file system store. (cherry-pick #7541) (#7544)
- providers/scim: fix missing schemas attribute for User and Group (cherry-pick #7477) (#7596)
- root: specify node and python versions in respective config files, deduplicate in CI (#7620)
- security: fix [CVE-2023-48228](../../security/cves/CVE-2023-48228.mdx), Reported by [@Sapd](https://github.com/Sapd) (#7666)
- stages/email: use uuid for email confirmation token instead of username (cherry-pick #7581) (#7584)
- web/admin: fix admins not able to delete MFA devices (#7660)

## Fixed in 2023.10.5

- blueprints: improve file change handler (cherry-pick #7813) (#7934)
- events: add better fallback for sanitize\_item to ensure everything can be saved as JSON (cherry-pick #7694) (#7937)
- events: fix lint (#7700)
- events: include user agent in events (cherry-pick #7693) (#7938)
- providers/scim: change familyName default (cherry-pick #7904) (#7930)
- root: don't show warning when app has no URLs to import (cherry-pick #7765) (#7935)
- root: Fix cache related image build issues (cherry-pick #7831) (#7932)
- stages/email: improve error handling for incorrect template syntax (cherry-pick #7758) (#7936)
- tests: fix flaky tests (cherry-pick #7676) (#7939)
- web: dark/light theme fixes (#7872)
- web: fix overflow glitch on ak-page-header (cherry-pick #7883) (#7931)
- web/admin: always show oidc well-known URL fields when they're set (#7560)
- web/user: fix search not updating app (cherry-pick #7825) (#7933)

## Fixed in 2023.10.6

- core: fix PropertyMapping context not being available in request context
- outposts: disable deployment and secret reconciler for embedded outpost in code instead of in config (cherry-pick #8021) (#8024)
- outposts: fix Outpost reconcile not re-assigning managed attribute (cherry-pick #8014) (#8020)
- providers/oauth2: fix [CVE-2024-21637](../../security/cves/CVE-2024-21637.mdx), Reported by [@lauritzh](https://github.com/lauritzh) (#8104)
- providers/oauth2: remember session\_id from initial token (cherry-pick #7976) (#7977)
- providers/proxy: use access token (cherry-pick #8022) (#8023)
- rbac: fix error when looking up permissions for now uninstalled apps (cherry-pick #8068) (#8070)
- sources/oauth: fix missing get\_user\_id for OIDC-like sources (Azure AD) (#7970)
- web/flows: fix device picker incorrect foreground color (cherry-pick #8067) (#8069)

## Fixed in 2023.10.7

- providers/oauth2: fix [CVE-2024-23647](../../security/cves/CVE-2024-23647.mdx) (cherry-pick #8345) (#8347)
- rbac: fix invitations listing with restricted permissions (cherry-pick #8227) (#8229)
- root: fix listen trusted\_proxy\_cidrs config loading from environment (#8075)
- root: fix redis config not being updated to match previous change
- sources/oauth: fix azure\_ad user\_id and add test and fallback (cherry-pick #8146) (#8152)
- sources/oauth: fix URLs being overwritten by OIDC urls (cherry-pick #8147) (#8156)
- sources/oauth: revert azure\_ad profile URL change (cherry-pick #8139) (#8141)
- stages/authenticator\_validate: use friendly\_name for stage selector when enrolling (cherry-pick #8255) (#8256)
- web/flows: fix icon for generic oauth source with dark theme (cherry-pick #8148) (#8151)

## API Changes

#### What's New

***

##### `PUT` /core/transactional/applications/

##### `GET` /rbac/permissions/

##### `GET` /rbac/permissions/\{id}/

##### `GET` /rbac/permissions/assigned\_by\_roles/

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

##### `GET` /rbac/permissions/assigned\_by\_users/

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

##### `GET` /rbac/permissions/roles/

##### `GET` /rbac/permissions/users/

##### `GET` /rbac/roles/

##### `POST` /rbac/roles/

##### `GET` /rbac/roles/\{uuid}/

##### `PUT` /rbac/roles/\{uuid}/

##### `DELETE` /rbac/roles/\{uuid}/

##### `PATCH` /rbac/roles/\{uuid}/

##### `GET` /rbac/roles/\{uuid}/used\_by/

#### What's Changed

***

##### `GET` /authenticators/admin/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `PUT` /authenticators/admin/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `DELETE` /authenticators/admin/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `PATCH` /authenticators/admin/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `GET` /authenticators/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `PUT` /authenticators/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `DELETE` /authenticators/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `PATCH` /authenticators/totp/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `POST` /core/groups/\{group\_uuid}/add\_user/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

##### `POST` /core/groups/\{group\_uuid}/remove\_user/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

##### `GET` /enterprise/license/\{license\_uuid}/

###### Parameters:

Changed: `license_uuid` in `path`

> A UUID string identifying this License.

##### `PUT` /enterprise/license/\{license\_uuid}/

###### Parameters:

Changed: `license_uuid` in `path`

> A UUID string identifying this License.

##### `DELETE` /enterprise/license/\{license\_uuid}/

###### Parameters:

Changed: `license_uuid` in `path`

> A UUID string identifying this License.

##### `PATCH` /enterprise/license/\{license\_uuid}/

###### Parameters:

Changed: `license_uuid` in `path`

> A UUID string identifying this License.

##### `GET` /outposts/instances/\{uuid}/health/

###### Parameters:

Changed: `uuid` in `path`

> A UUID string identifying this Outpost.

##### `GET` /outposts/radius/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mfa_support` (boolean)
    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum values:

    - `authentik.rbac`
    - `authentik.stages.authenticator`

  - Changed property `model` (string)

    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - Reputation Score
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License

    Added enum values:

    - `authentik_rbac.role`
    - `authentik_stages_authenticator_static.staticdevice`
    - `authentik_stages_authenticator_totp.totpdevice`
    - `authentik_enterprise.license`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.rbac` - authentik RBAC
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator` - authentik Stages.Authenticator
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Added enum values:

  - `authentik.rbac`
  - `authentik.stages.authenticator`

- Changed property `model` (string)

  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies_reputation.reputation` - Reputation Score
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
  > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
  > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_tenants.tenant` - Tenant
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License

  Added enum values:

  - `authentik_rbac.role`
  - `authentik_stages_authenticator_static.staticdevice`
  - `authentik_stages_authenticator_totp.totpdevice`
  - `authentik_enterprise.license`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum values:

    - `authentik.rbac`
    - `authentik.stages.authenticator`

  - Changed property `model` (string)

    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - Reputation Score
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License

    Added enum values:

    - `authentik_rbac.role`
    - `authentik_stages_authenticator_static.staticdevice`
    - `authentik_stages_authenticator_totp.totpdevice`
    - `authentik_enterprise.license`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.rbac` - authentik RBAC
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator` - authentik Stages.Authenticator
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Added enum values:

  - `authentik.rbac`
  - `authentik.stages.authenticator`

- Changed property `model` (string)

  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies_reputation.reputation` - Reputation Score
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
  > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
  > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_tenants.tenant` - Tenant
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License

  Added enum values:

  - `authentik_rbac.role`
  - `authentik_stages_authenticator_static.staticdevice`
  - `authentik_stages_authenticator_totp.totpdevice`
  - `authentik_enterprise.license`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum values:

    - `authentik.rbac`
    - `authentik.stages.authenticator`

  - Changed property `model` (string)

    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - Reputation Score
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License

    Added enum values:

    - `authentik_rbac.role`
    - `authentik_stages_authenticator_static.staticdevice`
    - `authentik_stages_authenticator_totp.totpdevice`
    - `authentik_enterprise.license`

##### `GET` /providers/radius/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mfa_support` (boolean)
    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `PUT` /providers/radius/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `mfa_support` (boolean)
  > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mfa_support` (boolean)
    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `PATCH` /providers/radius/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `mfa_support` (boolean)
  > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `mfa_support` (boolean)
    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `GET` /sources/oauth/source\_types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serializer for SourceType

  New required properties:

  - `oidc_jwks_url`
  - `oidc_well_known_url`

  * Added property `oidc_well_known_url` (string)

  * Added property `oidc_jwks_url` (string)

##### `DELETE` /authenticators/admin/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `GET` /authenticators/admin/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `PUT` /authenticators/admin/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `PATCH` /authenticators/admin/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `DELETE` /authenticators/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `GET` /authenticators/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `PUT` /authenticators/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `PATCH` /authenticators/static/\{id}/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `GET` /authenticators/static/\{id}/used\_by/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this Static Device.

##### `GET` /authenticators/totp/\{id}/used\_by/

###### Parameters:

Changed: `id` in `path`

> A unique integer value identifying this TOTP Device.

##### `DELETE` /core/groups/\{group\_uuid}/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

##### `GET` /core/groups/\{group\_uuid}/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `roles_obj`

  * Added property `roles` (array)

    Items (string):

  * Added property `roles_obj` (array)

    Items (object): > Role serializer

    - Property `pk` (string)

    - Property `name` (string)

##### `PUT` /core/groups/\{group\_uuid}/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

###### Request:

Changed content type : `application/json`

- Added property `roles` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `roles_obj`

  * Added property `roles` (array)

  * Added property `roles_obj` (array)

##### `PATCH` /core/groups/\{group\_uuid}/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

###### Request:

Changed content type : `application/json`

- Added property `roles` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `roles_obj`

  * Added property `roles` (array)

  * Added property `roles_obj` (array)

##### `GET` /core/groups/\{group\_uuid}/used\_by/

###### Parameters:

Changed: `group_uuid` in `path`

> A UUID string identifying this Group.

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `PUT` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `PATCH` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `GET` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `uuid`

  * Added property `uuid` (string)

##### `PUT` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `uuid`

  * Added property `uuid` (string)

##### `PATCH` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `uuid`

  * Added property `uuid` (string)

##### `GET` /enterprise/license/\{license\_uuid}/used\_by/

###### Parameters:

Changed: `license_uuid` in `path`

> A UUID string identifying this License.

##### `GET` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

##### `PUT` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

##### `PATCH` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

##### `DELETE` /outposts/instances/\{uuid}/

###### Parameters:

Changed: `uuid` in `path`

> A UUID string identifying this Outpost.

##### `GET` /outposts/instances/\{uuid}/

###### Parameters:

Changed: `uuid` in `path`

> A UUID string identifying this Outpost.

##### `PUT` /outposts/instances/\{uuid}/

###### Parameters:

Changed: `uuid` in `path`

> A UUID string identifying this Outpost.

##### `PATCH` /outposts/instances/\{uuid}/

###### Parameters:

Changed: `uuid` in `path`

> A UUID string identifying this Outpost.

##### `GET` /outposts/instances/\{uuid}/used\_by/

###### Parameters:

Changed: `uuid` in `path`

> A UUID string identifying this Outpost.

##### `GET` /outposts/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > RadiusProvider Serializer

    - Added property `mfa_support` (boolean)
      > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `failure_result` (boolean)

    > Result if the Policy execution fails.

  - Changed property `timeout` (integer)

    > Timeout after which Policy execution is terminated.

  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `failure_result` (boolean)

  > Result if the Policy execution fails.

- Changed property `timeout` (integer)
  > Timeout after which Policy execution is terminated.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `failure_result` (boolean)

    > Result if the Policy execution fails.

  - Changed property `timeout` (integer)

    > Timeout after which Policy execution is terminated.

  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `failure_result` (boolean)

  > Result if the Policy execution fails.

- Changed property `timeout` (integer)
  > Timeout after which Policy execution is terminated.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `failure_result` (boolean)

    > Result if the Policy execution fails.

  - Changed property `timeout` (integer)

    > Timeout after which Policy execution is terminated.

  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.rbac` - authentik RBAC
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator` - authentik Stages.Authenticator
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Added enum values:

  - `authentik.rbac`
  - `authentik.stages.authenticator`

- Changed property `model` (string)

  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies_reputation.reputation` - Reputation Score
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
  > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
  > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_tenants.tenant` - Tenant
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License

  Added enum values:

  - `authentik_rbac.role`
  - `authentik_stages_authenticator_static.staticdevice`
  - `authentik_stages_authenticator_totp.totpdevice`
  - `authentik_enterprise.license`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum values:

    - `authentik.rbac`
    - `authentik.stages.authenticator`

  - Changed property `model` (string)

    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - Reputation Score
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License

    Added enum values:

    - `authentik_rbac.role`
    - `authentik_stages_authenticator_static.staticdevice`
    - `authentik_stages_authenticator_totp.totpdevice`
    - `authentik_enterprise.license`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > - `authentik.admin` - authentik Admin
      > - `authentik.api` - authentik API
      > - `authentik.crypto` - authentik Crypto
      > - `authentik.events` - authentik Events
      > - `authentik.flows` - authentik Flows
      > - `authentik.outposts` - authentik Outpost
      > - `authentik.policies.dummy` - authentik Policies.Dummy
      > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
      > - `authentik.policies.expiry` - authentik Policies.Expiry
      > - `authentik.policies.expression` - authentik Policies.Expression
      > - `authentik.policies.password` - authentik Policies.Password
      > - `authentik.policies.reputation` - authentik Policies.Reputation
      > - `authentik.policies` - authentik Policies
      > - `authentik.providers.ldap` - authentik Providers.LDAP
      > - `authentik.providers.oauth2` - authentik Providers.OAuth2
      > - `authentik.providers.proxy` - authentik Providers.Proxy
      > - `authentik.providers.radius` - authentik Providers.Radius
      > - `authentik.providers.saml` - authentik Providers.SAML
      > - `authentik.providers.scim` - authentik Providers.SCIM
      > - `authentik.rbac` - authentik RBAC
      > - `authentik.recovery` - authentik Recovery
      > - `authentik.sources.ldap` - authentik Sources.LDAP
      > - `authentik.sources.oauth` - authentik Sources.OAuth
      > - `authentik.sources.plex` - authentik Sources.Plex
      > - `authentik.sources.saml` - authentik Sources.SAML
      > - `authentik.stages.authenticator` - authentik Stages.Authenticator
      > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
      > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
      > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
      > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
      > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
      > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
      > - `authentik.stages.captcha` - authentik Stages.Captcha
      > - `authentik.stages.consent` - authentik Stages.Consent
      > - `authentik.stages.deny` - authentik Stages.Deny
      > - `authentik.stages.dummy` - authentik Stages.Dummy
      > - `authentik.stages.email` - authentik Stages.Email
      > - `authentik.stages.identification` - authentik Stages.Identification
      > - `authentik.stages.invitation` - authentik Stages.User Invitation
      > - `authentik.stages.password` - authentik Stages.Password
      > - `authentik.stages.prompt` - authentik Stages.Prompt
      > - `authentik.stages.user_delete` - authentik Stages.User Delete
      > - `authentik.stages.user_login` - authentik Stages.User Login
      > - `authentik.stages.user_logout` - authentik Stages.User Logout
      > - `authentik.stages.user_write` - authentik Stages.User Write
      > - `authentik.tenants` - authentik Tenants
      > - `authentik.blueprints` - authentik Blueprints
      > - `authentik.core` - authentik Core
      > - `authentik.enterprise` - authentik Enterprise

      Added enum values:

      - `authentik.rbac`
      - `authentik.stages.authenticator`

    - Changed property `model` (string)

      > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
      > - `authentik_events.event` - Event
      > - `authentik_events.notificationtransport` - Notification Transport
      > - `authentik_events.notification` - Notification
      > - `authentik_events.notificationrule` - Notification Rule
      > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
      > - `authentik_flows.flow` - Flow
      > - `authentik_flows.flowstagebinding` - Flow Stage Binding
      > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
      > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
      > - `authentik_outposts.outpost` - Outpost
      > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
      > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
      > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
      > - `authentik_policies_expression.expressionpolicy` - Expression Policy
      > - `authentik_policies_password.passwordpolicy` - Password Policy
      > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
      > - `authentik_policies_reputation.reputation` - Reputation Score
      > - `authentik_policies.policybinding` - Policy Binding
      > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
      > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
      > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
      > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
      > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
      > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
      > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
      > - `authentik_providers_radius.radiusprovider` - Radius Provider
      > - `authentik_providers_saml.samlprovider` - SAML Provider
      > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
      > - `authentik_providers_scim.scimprovider` - SCIM Provider
      > - `authentik_providers_scim.scimmapping` - SCIM Mapping
      > - `authentik_rbac.role` - Role
      > - `authentik_sources_ldap.ldapsource` - LDAP Source
      > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
      > - `authentik_sources_oauth.oauthsource` - OAuth Source
      > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
      > - `authentik_sources_plex.plexsource` - Plex Source
      > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
      > - `authentik_sources_saml.samlsource` - SAML Source
      > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
      > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
      > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
      > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
      > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
      > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
      > - `authentik_stages_authenticator_static.staticdevice` - Static Device
      > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
      > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
      > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
      > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
      > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
      > - `authentik_stages_captcha.captchastage` - Captcha Stage
      > - `authentik_stages_consent.consentstage` - Consent Stage
      > - `authentik_stages_consent.userconsent` - User Consent
      > - `authentik_stages_deny.denystage` - Deny Stage
      > - `authentik_stages_dummy.dummystage` - Dummy Stage
      > - `authentik_stages_email.emailstage` - Email Stage
      > - `authentik_stages_identification.identificationstage` - Identification Stage
      > - `authentik_stages_invitation.invitationstage` - Invitation Stage
      > - `authentik_stages_invitation.invitation` - Invitation
      > - `authentik_stages_password.passwordstage` - Password Stage
      > - `authentik_stages_prompt.prompt` - Prompt
      > - `authentik_stages_prompt.promptstage` - Prompt Stage
      > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
      > - `authentik_stages_user_login.userloginstage` - User Login Stage
      > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
      > - `authentik_stages_user_write.userwritestage` - User Write Stage
      > - `authentik_tenants.tenant` - Tenant
      > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
      > - `authentik_core.group` - Group
      > - `authentik_core.user` - User
      > - `authentik_core.application` - Application
      > - `authentik_core.token` - Token
      > - `authentik_enterprise.license` - License

      Added enum values:

      - `authentik_rbac.role`
      - `authentik_stages_authenticator_static.staticdevice`
      - `authentik_stages_authenticator_totp.totpdevice`
      - `authentik_enterprise.license`

##### `POST` /providers/radius/

###### Request:

Changed content type : `application/json`

- Added property `mfa_support` (boolean)
  > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `mfa_support` (boolean)
    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `GET` /providers/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > RadiusProvider Serializer

    - Added property `mfa_support` (boolean)
      > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `default_relay_state` (string)
    > Default relay\_state value for IDP-initiated logins

##### `PUT` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `default_relay_state` (string)
  > Default relay\_state value for IDP-initiated logins

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `default_relay_state` (string)
    > Default relay\_state value for IDP-initiated logins

##### `PATCH` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `default_relay_state` (string)
  > Default relay\_state value for IDP-initiated logins

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `default_relay_state` (string)
    > Default relay\_state value for IDP-initiated logins

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `oidc_jwks_url`
    - `oidc_well_known_url`

    * Added property `oidc_well_known_url` (string)

    * Added property `oidc_jwks_url` (string)

##### `PUT` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `oidc_jwks_url`
    - `oidc_well_known_url`

    * Added property `oidc_well_known_url` (string)

    * Added property `oidc_jwks_url` (string)

##### `PATCH` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `oidc_jwks_url`
    - `oidc_well_known_url`

    * Added property `oidc_well_known_url` (string)

    * Added property `oidc_jwks_url` (string)

##### `POST` /core/groups/

###### Request:

Changed content type : `application/json`

- Added property `roles` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `roles_obj`

  * Added property `roles` (array)

  * Added property `roles_obj` (array)

##### `GET` /core/groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `uuid`

      * Added property `uuid` (string)

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `uuid`

  * Added property `uuid` (string)

##### `GET` /core/users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `GET` /core/users/me/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer for information a user can retrieve about themselves

    New required properties:

    - `system_permissions`

    * Added property `system_permissions` (array)

      > Get all system permissions assigned to the user

      Items (string):

##### `POST` /events/rules/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

##### `GET` /events/rules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > NotificationRule Serializer

    - Changed property `group_obj` (object)

      > Group Serializer

      New required properties:

      - `roles_obj`

      * Added property `roles` (array)

      * Added property `roles_obj` (array)

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `POST` /policies/bindings/

###### Request:

Changed content type : `application/json`

- Added property `failure_result` (boolean)

  > Result if the Policy execution fails.

- Changed property `timeout` (integer)
  > Timeout after which Policy execution is terminated.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `failure_result` (boolean)

    > Result if the Policy execution fails.

  - Changed property `timeout` (integer)

    > Timeout after which Policy execution is terminated.

  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `roles_obj`

    * Added property `roles` (array)

    * Added property `roles_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `uuid`

    * Added property `uuid` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Added property `failure_result` (boolean)

      > Result if the Policy execution fails.

    - Changed property `timeout` (integer)

      > Timeout after which Policy execution is terminated.

    - Changed property `group_obj` (object)

      > Group Serializer

      New required properties:

      - `roles_obj`

      * Added property `roles` (array)

      * Added property `roles_obj` (array)

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `uuid`

      * Added property `uuid` (string)

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Added property `default_relay_state` (string)
  > Default relay\_state value for IDP-initiated logins

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `default_relay_state` (string)
    > Default relay\_state value for IDP-initiated logins

##### `GET` /providers/saml/

###### Parameters:

Added: `default_relay_state` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    - Added property `default_relay_state` (string)
      > Default relay\_state value for IDP-initiated logins

##### `POST` /sources/oauth/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `oidc_jwks_url`
    - `oidc_well_known_url`

    * Added property `oidc_well_known_url` (string)

    * Added property `oidc_jwks_url` (string)

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `type` (object)

      > Serializer for SourceType

      New required properties:

      - `oidc_jwks_url`
      - `oidc_well_known_url`

      * Added property `oidc_well_known_url` (string)

      * Added property `oidc_jwks_url` (string)

##### `GET` /stages/authenticator/sms/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `verify_only` (boolean)
    > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

##### `PUT` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `verify_only` (boolean)
  > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `verify_only` (boolean)
    > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

##### `PATCH` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `verify_only` (boolean)
  > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `verify_only` (boolean)
    > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

##### `GET` /stages/deny/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `deny_message` (string)

##### `PUT` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `deny_message` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `deny_message` (string)

##### `PATCH` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `deny_message` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `deny_message` (string)

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `uuid`

      * Added property `uuid` (string)

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `uuid`

      * Added property `uuid` (string)

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `uuid`

      * Added property `uuid` (string)

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `uuid`

      * Added property `uuid` (string)

##### `POST` /stages/authenticator/sms/

###### Request:

Changed content type : `application/json`

- Changed property `verify_only` (boolean)
  > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `verify_only` (boolean)
    > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

##### `GET` /stages/authenticator/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorSMSStage Serializer

    - Changed property `verify_only` (boolean)
      > When enabled, the Phone number is only used during enrollment to verify the users authenticity. Only a hash of the phone number is saved to ensure it is not reused in the future.

##### `POST` /stages/deny/

###### Request:

Changed content type : `application/json`

- Added property `deny_message` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `deny_message` (string)

##### `GET` /stages/deny/

###### Parameters:

Added: `deny_message` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DenyStage Serializer

    - Added property `deny_message` (string)

---

## Release 2023.2 - Signout and Avatar improvements

## New features

- Proxy provider logout improvements

  In previous versions, logging out of a single proxied application would only invalidate that application's session. Starting with this release, when logging out of a proxied application (via the */outpost.goauthentik.io/sign\_out* URL), all user sessions within the outpost are terminated. Sessions in other outposts and with other protocols are unaffected.

  Additionally, different providers now have different cookies, instead of all using the same "authentik\_proxy" token.

- UX Improvements

  As with the previous improvements, we've made a lot of minor improvements to the general authentik UX to make your life easier.

- OAuth2 Provider improvements

  The OAuth2 provider has been reworked to be closer to OAuth specifications and better support refresh tokens and offline access. Additionally the expiry for access tokens and refresh tokens can be adjusted separately now.

- Generated avatars, multiple avatar modes

  authentik now supports multiple avatar modes, and will use the next configured mode when a mode doesn't have an avatar. For example, the new default configuration attempts to use gravatar, but if the user's email does not have a gravatar setup, it will instead use the new generated avatars. See [Configuration](../../sys-mgmt/settings.mdx#avatars)

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2023.2 from [here](https://goauthentik.io/version/2023.2/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2023.2.0
```

## Minor changes/fixes

- \*/saml: disable pretty\_print, add signature tests
- blueprints: don't update default tenant
- blueprints: handle error when blueprint entry identifier field does not exist
- core: Add support for auto generating unique avatars based on the user's initials (#4663)
- core: delete session when user is set to inactive
- core: fix inconsistent branding in end\_session view
- core: fix missing uniqueness validator on user api
- core: fix token's set\_key accessing data incorrectly
- events: don't log oauth temporary model creation
- events: improve sanitizing for tuples and sets
- events: prevent error when request fails without response
- internal: better error message when outpost API controller couldn't fetch outposts
- internal: fix cache-control header
- policies/event\_matcher: fix empty app label not being allowed, require at least 1 criteria
- providers/ldap: add unbind flow execution (#4484)
- providers/ldap: fix error not being checked correctly when fetching users
- providers/oauth2: add user id as "sub" mode
- providers/oauth2: don't use policy cache for token requests
- providers/oauth2: only set auth\_time in ID token when a login event is stored in the session
- providers/oauth2: optimize client credentials JWT database lookup (#4606)
- providers/oauth2: rework OAuth2 Provider (#4652)
- providers/proxy: add token support for basic auth
- providers/proxy: different cookie name based on hashed client id (#4666)
- providers/proxy: outpost wide logout implementation (#4605)
- providers/saml: fix invalid SAML provider metadata, add schema tests
- providers/saml: fix mismatched SAML SLO Urls (#4655)
- stages/authenticator\_validate: fix error with passwordless webauthn login
- stages/prompt: field name (#4497)
- stages/user\_write: fix migration setting wrong value, fix form
- web: fix token delete form not showing token identifiers
- web/admin: add notice for user\_login stage session cookie behavior
- web/admin: clarify access code expiration
- web/admin: default to disable policy execution logging
- web/admin: fix certificate filtering for SAML verification certificate
- web/admin: rework event info page to show all event infos
- web/elements: add dropdown css to DOM directly instead of including
- web/elements: fix ak-expand not using correct font
- web/elements: fix clashing page url param
- web/elements: improve codemirror contrast in dark theme
- web/elements: make table rows clickable to select items
- web/elements: persist table page in URL parameters
- web/flows: fix flow background overlay on firefox
- web/user: filter tokens by username
- web/user: refactor loading of data in userinterface

## Fixed in 2023.2.1

- internal: fix scheme not being forwarded correctly for host intercepted requests
- sources/ldap: add LDAP Debug endpoint
- web/admin: improve action button spinner on ldap source page
- web/admin: remove groups and users from users and group form to prevent accidental removal when updating
- web/admin: use full page size for modals

## Fixed in 2023.2.2

- flows: include flow authentication requirement in diagram
- lib: don't try to cache generated avatar with full user, only cache with name
- providers/ldap: check MFA password on password stage
- providers/proxy: fix client credential flows not using http interceptor
- providers/proxy: fix value is too long with filesystem sessions
- root: use channel send workaround for sync sending of websocket messages
- web/admin: fix error when creating new users
- web/user: revert truncate behavior for application description

## Fixed in 2023.2.3

- \*: fix [CVE-2023-26481.md](../../security/cves/CVE-2023-26481.mdx), Reported by [@fuomag9](https://github.com/fuomag9)

## API Changes

#### What's New

***

##### `POST` /admin/system/

#### What's Changed

***

##### `POST` /core/tokens/\{identifier}/set\_key/

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    Added enum value:

    - `user_id`

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `sub_mode` (string)

  > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

  Added enum value:

  - `user_id`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    Added enum value:

    - `user_id`

##### `PATCH` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `sub_mode` (string)

  > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

  Added enum value:

  - `user_id`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    Added enum value:

    - `user_id`

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Changed property `sub_mode` (string)

  > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

  Added enum value:

  - `user_id`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    Added enum value:

    - `user_id`

##### `GET` /providers/oauth2/

###### Parameters:

Changed: `sub_mode` in `query`

> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    - Changed property `sub_mode` (string)

      > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

      Added enum value:

      - `user_id`

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Changed property `sub_mode` (string)

      > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

      Added enum value:

      - `user_id`

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Changed property `sub_mode` (string)

      > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

      Added enum value:

      - `user_id`

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

        Added enum value:

        - `user_id`

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

        Added enum value:

        - `user_id`

##### `GET` /stages/prompt/prompts/\{prompt\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `name`

  * Added property `name` (string)

##### `PUT` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

New required properties:

- `name`

* Added property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `name`

  * Added property `name` (string)

##### `PATCH` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `name`

  * Added property `name` (string)

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

New required properties:

- `name`

* Added property `name` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `name`

  * Added property `name` (string)

##### `GET` /stages/prompt/prompts/

###### Parameters:

Added: `name` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Prompt Serializer

    New required properties:

    - `name`

    * Added property `name` (string)

---

## Release 2023.3 - SCIM support

## New features

- SCIM support

  This feature is still in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues).

  authentik can now provision users into other IT systems via the SCIM (System for Cross-domain Identity Management) protocol. The provider synchronizes Users, Groups and the user membership. Objects are synced both when they are saved and based on a pre-defined schedule in the background.

  Documentation: [SCIM Provider](../../add-secure-apps/providers/scim/index.mdx)

- Theming improvements
  - The custom.css file is now loaded in ShadowDOMs, allowing for much greater customization, as previously it was only possible to style elements outside of the ShadowDOM. See docs for the [User interface](../../customize/interfaces/user/index.mdx) and [Admin interface](../../customize/interfaces/admin/index.mdx).
  - Previously, authentik would automatically switch between dark and light theme based on the users' browsers' settings. This can now be overridden to either force the light or dark theme, per user/group/brand. See docs for the [User interface](../../customize/interfaces/user/index.mdx) and [Admin interface](../../customize/interfaces/admin/index.mdx).

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the `docker-compose.yml` file for 2023.3 from [here](https://goauthentik.io/version/2023.3/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2023.3.0
```

## Minor changes/fixes included in release 2023.3

- \*: add additional Prometheus metrics, remove unusable high entropy metrics
- blueprints: improve error handling in example flow
- core: Add `resolve_dns` and `reverse_dns` functions to evaluator (#4769)
- core: bootstrap email (#4788)
- core: enforce unique on names where it makes sense (#4866)
- core: fix bug causing whitespace-only names to raise exception when generating avatars (#4746)
- core: fix error when creating token without request in context
- core: improve service account creation (#4751)
- events: fix m2m\_change events not being logged
- events: set task start time before start, not on time of init (#4908)
- flows: change default flow stage binding settings (#4784)
- flows: planner error handling (#4812)
- internal: fix crash when port 9000 is in use (#4863)
- providers: SCIM (#4835)
- providers/ldap: improve compatibility with LDAP clients (#4750)
- providers/ldap: making LDAP compatible with Synology (#4694)
- providers/oauth2: fix missing information for revoked token access events
- providers/oauth2: OpenID conformance (#4758)
- providers/proxy: ensure issuer is correct when browser URL override is set
- providers/proxy: strip scheme when comparing redirect URL
- providers/scim: add option to filter out service accounts, parent group (#4862)
- providers/scim: customizable externalId, document behavior (#4868)
- providers/scim: handle ServiceProviderConfig 404 (#4915)
- root: fix session middleware for websocket connections (#4909)
- sources/ldap: improve error handling for password complexity (#4780)
- sources/oauth: fix not all token errors being logged with response
- sources/plex: fix check\_token error unusable if token is empty (#4834)
- stages/authenticator\_sms: fix twilio sending (#4829)
- stages/user\_login: add option to terminate other sessions (#4754)
- stages/user\_login: set session expiry before login (#4920)
- tests/e2e: use example blueprints for testing (#4805)
- web: fetch custom.css via fetch and add stylesheet (#4804)
- web: toggle dark/light theme manually (#4876)
- web/admin: fix chart display with no sources (#4782)
- web/admin: fix issue with wizard's Next button incorrectly disabled when radio button is already selected (#4821)
- web/admin: fix SCIM provider layout (#4919)
- web/admin: workaround for tenant certificate selection being cut off (#4820)
- web/elements: add loading spinner for charts, render middle text with CSS
- web/elements: fix center text not scrolling with container (#4853)
- web/elements: fix copy on insecure origins (#4917)
- web/elements: fix flipped theme in codemirror (#4901)
- web/flows: fix compatibility mode (#4910)
- web/flows: fix fa:// icons in sources not shown correctly
- web/user: fix source connections not being filtered (#4778)

## Fixed in 2023.3.1

- \*: fix mismatched task names for discovery, make output service connection task monitored (#4956)
- core: fix application launch url validator (#4957)
- providers: fix authorization\_flow not required in API (#4932)
- providers/ldap: fix duplicate attributes (#4972)
- providers/oauth2: fix response for response\_type code and response\_mode fragment (#4975)
- stages/authenticator\_webauthn: remove credential\_id size limit (#4931)
- web/admin: fix wizards with radio selects not working correctly after use (#4933)
- web/common: fix tab label color on dark theme (#4959)
- web/flows: fix authenticator selector in dark mode (#4974)
- web/user: fix custom user interface background with dark theme (#4960)

## API Changes

#### What's New

***

##### `GET` /propertymappings/scim/

##### `POST` /propertymappings/scim/

##### `GET` /propertymappings/scim/\{pm\_uuid}/

##### `PUT` /propertymappings/scim/\{pm\_uuid}/

##### `DELETE` /propertymappings/scim/\{pm\_uuid}/

##### `PATCH` /propertymappings/scim/\{pm\_uuid}/

##### `GET` /propertymappings/scim/\{pm\_uuid}/used\_by/

##### `GET` /providers/scim/

##### `POST` /providers/scim/

##### `GET` /providers/scim/\{id}/

##### `PUT` /providers/scim/\{id}/

##### `DELETE` /providers/scim/\{id}/

##### `PATCH` /providers/scim/\{id}/

##### `GET` /providers/scim/\{id}/sync\_status/

##### `GET` /providers/scim/\{id}/used\_by/

#### What's Changed

***

##### `POST` /core/users/service\_account/

###### Request:

Changed content type : `application/json`

- Added property `expiring` (boolean)

- Added property `expires` (string)
  > If not provided, valid for 360 days

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.providers.scim`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.providers.scim`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.providers.scim`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.providers.scim`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.providers.scim`

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PATCH` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PUT` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PATCH` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /core/groups/\{group\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `users_obj` (array)

    Changed items (object): > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `PUT` /core/groups/\{group\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `users_obj` (array)

    Changed items (object): > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `PATCH` /core/groups/\{group\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `users_obj` (array)

    Changed items (object): > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `GET` /core/tenants/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `ui_theme`

  * Added property `ui_theme` (object)

    Enum values:

    - `automatic`
    - `light`
    - `dark`

##### `GET` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `PUT` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `PATCH` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.providers.scim`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.providers.scim`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum value:

      - `authentik.providers.scim`

##### `GET` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PUT` /providers/ldap/\{id}/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PATCH` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    New optional properties:

    - `authorization_flow`

##### `POST` /providers/proxy/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ProxyProvider Serializer

    New optional properties:

    - `authorization_flow`

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PUT` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `PATCH` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `created_by` (object)

    > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `PUT` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `created_by` (object)

    > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `PATCH` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `created_by` (object)

    > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `POST` /core/groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `users_obj` (array)

    Changed items (object): > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `GET` /core/groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `POST` /events/rules/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `GET` /events/rules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > NotificationRule Serializer

    - Changed property `group_obj` (object)

      > Group Serializer

      - Changed property `users_obj` (array)

        Changed items (object): > Stripped down user serializer to show relevant users for groups

        New optional properties:

        - `avatar`

        * Deleted property `avatar` (string)

##### `GET` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `evaluate_on_plan` (boolean)
    > Evaluate policies during the Flow planning process.

##### `PUT` /flows/bindings/\{fsb\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `evaluate_on_plan` (boolean)
  > Evaluate policies during the Flow planning process.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `evaluate_on_plan` (boolean)
    > Evaluate policies during the Flow planning process.

##### `PATCH` /flows/bindings/\{fsb\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `evaluate_on_plan` (boolean)
  > Evaluate policies during the Flow planning process.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `evaluate_on_plan` (boolean)
    > Evaluate policies during the Flow planning process.

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New optional properties:

    - `authorization_flow`

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New optional properties:

    - `authorization_flow`

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New optional properties:

    - `authorization_flow`

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    - Changed property `users_obj` (array)

      Changed items (object): > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Changed property `group_obj` (object)

      > Group Serializer

      - Changed property `users_obj` (array)

        Changed items (object): > Stripped down user serializer to show relevant users for groups

        New optional properties:

        - `avatar`

        * Deleted property `avatar` (string)

##### `POST` /providers/ldap/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    New optional properties:

    - `authorization_flow`

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

New optional properties:

- `authorization_flow`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`

##### `GET` /providers/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    New optional properties:

    - `authorization_flow`

##### `GET` /sources/user\_connections/all/

###### Parameters:

Added: `user` in `query`

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `created_by` (object)

    > Stripped down user serializer to show relevant users for groups

    New optional properties:

    - `avatar`

    * Deleted property `avatar` (string)

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Invitation Serializer

    - Changed property `created_by` (object)

      > Stripped down user serializer to show relevant users for groups

      New optional properties:

      - `avatar`

      * Deleted property `avatar` (string)

##### `GET` /stages/user\_login/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `terminate_other_sessions` (boolean)
    > Terminate all other sessions of the user logging in.

##### `PUT` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `terminate_other_sessions` (boolean)
  > Terminate all other sessions of the user logging in.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `terminate_other_sessions` (boolean)
    > Terminate all other sessions of the user logging in.

##### `PATCH` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `terminate_other_sessions` (boolean)
  > Terminate all other sessions of the user logging in.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `terminate_other_sessions` (boolean)
    > Terminate all other sessions of the user logging in.

##### `POST` /flows/bindings/

###### Request:

Changed content type : `application/json`

- Changed property `evaluate_on_plan` (boolean)
  > Evaluate policies during the Flow planning process.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `evaluate_on_plan` (boolean)
    > Evaluate policies during the Flow planning process.

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > FlowStageBinding Serializer

    - Changed property `evaluate_on_plan` (boolean)
      > Evaluate policies during the Flow planning process.

##### `GET` /flows/inspector/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `plans` (array)

    Changed items (object): > Serializer for an active FlowPlan

    - Changed property `next_planned_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `evaluate_on_plan` (boolean)
        > Evaluate policies during the Flow planning process.

    - Changed property `current_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `evaluate_on_plan` (boolean)
        > Evaluate policies during the Flow planning process.

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New optional properties:

      - `authorization_flow`

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New optional properties:

      - `authorization_flow`

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New optional properties:

      - `authorization_flow`

##### `POST` /stages/user\_login/

###### Request:

Changed content type : `application/json`

- Added property `terminate_other_sessions` (boolean)
  > Terminate all other sessions of the user logging in.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `terminate_other_sessions` (boolean)
    > Terminate all other sessions of the user logging in.

##### `GET` /stages/user\_login/

###### Parameters:

Added: `terminate_other_sessions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLoginStage Serializer

    - Added property `terminate_other_sessions` (boolean)
      > Terminate all other sessions of the user logging in.

---

## Release 2023.4 - RADIUS support

## Breaking changes

- (Kubernetes only) Changes to RBAC objects created by helm

  In previous versions, the helm chart would create a *ClusterRole* and *ClusterRoleBinding* if the service account creation was enabled. This was done to allow the deployment of outposts in any namespace in kubernetes. As this conflicted with multiple authentik installs per cluster, and was often not used, the new helm chart changes these resources to a *Role* and *RoleBinding*, which give authentik access to deploy in the same namespace.

  To keep the old behavior, you can install the [authentik-remote-cluster](https://artifacthub.io/packages/helm/goauthentik/authentik-remote-cluster) chart, which deploys the same RBAC into any other namespace or cluster.

## New features

- RADIUS support

  This feature is still in technical preview, so please report any Bugs you run into on [GitHub](https://github.com/goauthentik/authentik/issues).

  authentik now supports the [RADIUS protocol](https://en.wikipedia.org/wiki/RADIUS) for authentication, allowing for the integration of a wider variety of systems such as VPN software, network switches/routers, and others.

  The RADIUS provider also uses a flow to authenticate users, and supports the same stages as the [LDAP Provider](../../add-secure-apps/providers/ldap/index.mdx).

  Documentation: [RADIUS Provider](../../add-secure-apps/providers/radius/index.mdx)

- Decreased CPU usage for workers

  Previously, authentik used a method to ensure that the worker containers are running correctly called "pinging", which would send a request to the worker and ensure it was processed correctly. This however used a lot of resources every time the health check ran. We've switched to a simpler method, one that will reduce CPU and memory usage (only affects Docker-Compose).

- Configurable authentication flow for providers

  It is now possible to configure the authentication flow per provider. This configured flow will be used when an un-authenticated user tries to access the application the provider is used with. If no flow is set on a provider, the default authentication flow configured on the tenant will be used.

- "Stay logged in" prompt

  In the [User login stage](../../add-secure-apps/flows-stages/stages/user_login/index.mdx), an admin can use the new "Stay Logged In" option to add additional minutes or hours to the defined `session duration` value. When this "Stay Logged In" offset time is configured, the user logging in is presented with a prompt asking if they want to extend their session.

- Prompt preview

  When creating a single prompt for use with a [Prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx), a live preview of the prompt is now shown. This makes it easier to test how a prompt will behave, and also shows what data it will send, and how it will be available in the flow context.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 2023.4 from [here](https://goauthentik.io/version/2023.4/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2023.4.0
```

## Minor changes/fixes

- \*: load websocket paths similarly to URLs (#5018)
- blueprints: allow setting of token key in blueprint context (#4995)
- core: Add unique constraint to user UUID (#5004)
- core: extend Postgres configuration (#5138)
- core: fix app launch URL flow selection (#5113)
- lifecycle: also migrate before starting worker, trap exit to cleanup mode (#5123)
- lifecycle: don't use celery ping for worker healthcheck (#5153)
- outposts: run containers as non root (#5212)
- outposts: set Kubernetes deployment security context (#5163)
- policies: provider raw result for better policy reusability (#5189)
- providers/ldap: fix duplicate attributes (#4972)
- providers/oauth2: fix response for response\_type code and response\_mode fragment (#4975)
- providers/proxy: rework endpoints logic (#4993)
- providers/radius: simple RADIUS outpost (#1796)
- providers/scim: add missing default fields (#5108)
- providers/scim: fix error when user-group m2m is updated forward (#5082)
- providers: Add ability to choose a default authentication flow (#5070)
- stages/authenticator\_validate: fix stage not working without pending user (#5096)
- stages/identification: revert is\_active check (#5183)
- stages/prompt: Add Radio Button Group, Dropdown and Text Area prompt fields (#4822)
- stages/prompt: Fix dropdown invalid choice (#5046)
- stages/user\_login: stay logged in (#4958)
- stages/user\_write: improve error handling (#5136)
- stages: Add ability to set user friendly names for MFA stages (#5005)
- web/admin: fix error adding users to groups (#5016)
- web/admin: fix error listing blueprints with missing metadata (#5041)
- web/admin: fix error when creating bindings due to hidden inputs (#5081)
- web/admin: fix inconsistent display of flows in selections (#4977)
- web/admin: fix ldap form when editing scim provider from view page (#5164)
- web/admin: fix prompt field display (#4990)
- web/admin: fix sidebar avatar not loaded (#5184)
- web/admin: prompt preview (#5078)
- web/admin: show warning when adding user to superuser group (#5091)
- web/elements: fix search select inconsistency (#4989)
- web/elements: only render form once instance is loaded (#5049)
- web/flows: fix authenticator selector in dark mode (#4974)
- web/user: rework search (#5107)
- web: only show debug locale if debug mode is enabled (#5111)
- web: remove more until (#5057)

## Fixed in 2023.4.1

- ci: fix tag lookup for previous stable version (#5257)
- lifecycle: fix worker healthcheck (#5259)
- lifecycle: re-add exec to ak wrapper (#5253)

## Fixed in 2023.4.2

- security: Address pen-test findings from the [2023-06 Cure53 Code audit](../../security/audits-and-certs/2023-06-cure53.mdx)

## Fixed in 2023.4.3

- \*: fix [CVE-2023-36456](../../security/cves/CVE-2023-36456.mdx), Reported by [@thijsa](https://github.com/thijsa)

## API Changes

#### What's New

***

##### `GET` /outposts/radius/

##### `GET` /outposts/radius/\{id}/

##### `GET` /providers/radius/

##### `POST` /providers/radius/

##### `GET` /providers/radius/\{id}/

##### `PUT` /providers/radius/\{id}/

##### `DELETE` /providers/radius/\{id}/

##### `PATCH` /providers/radius/\{id}/

##### `GET` /providers/radius/\{id}/used\_by/

##### `POST` /stages/prompt/prompts/preview/

#### What's Changed

***

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core

    Added enum value:

    - `authentik.providers.radius`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.lib` - authentik lib
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core

  Added enum value:

  - `authentik.providers.radius`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core

    Added enum value:

    - `authentik.providers.radius`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.lib` - authentik lib
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core

  Added enum value:

  - `authentik.providers.radius`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core

    Added enum value:

    - `authentik.providers.radius`

##### `GET` /providers/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PATCH` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PUT` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PATCH` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PUT` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PATCH` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius

    Added enum value:

    - `radius`

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PUT` /outposts/instances/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

  > - `proxy` - Proxy
  > - `ldap` - Ldap
  > - `radius` - Radius

  Added enum value:

  - `radius`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius

    Added enum value:

    - `radius`

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PATCH` /outposts/instances/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

  > - `proxy` - Proxy
  > - `ldap` - Ldap
  > - `radius` - Radius

  Added enum value:

  - `radius`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius

    Added enum value:

    - `radius`

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.lib` - authentik lib
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core

  Added enum value:

  - `authentik.providers.radius`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core

    Added enum value:

    - `authentik.providers.radius`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > - `authentik.admin` - authentik Admin
      > - `authentik.api` - authentik API
      > - `authentik.crypto` - authentik Crypto
      > - `authentik.events` - authentik Events
      > - `authentik.flows` - authentik Flows
      > - `authentik.lib` - authentik lib
      > - `authentik.outposts` - authentik Outpost
      > - `authentik.policies.dummy` - authentik Policies.Dummy
      > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
      > - `authentik.policies.expiry` - authentik Policies.Expiry
      > - `authentik.policies.expression` - authentik Policies.Expression
      > - `authentik.policies.password` - authentik Policies.Password
      > - `authentik.policies.reputation` - authentik Policies.Reputation
      > - `authentik.policies` - authentik Policies
      > - `authentik.providers.ldap` - authentik Providers.LDAP
      > - `authentik.providers.oauth2` - authentik Providers.OAuth2
      > - `authentik.providers.proxy` - authentik Providers.Proxy
      > - `authentik.providers.radius` - authentik Providers.Radius
      > - `authentik.providers.saml` - authentik Providers.SAML
      > - `authentik.providers.scim` - authentik Providers.SCIM
      > - `authentik.recovery` - authentik Recovery
      > - `authentik.sources.ldap` - authentik Sources.LDAP
      > - `authentik.sources.oauth` - authentik Sources.OAuth
      > - `authentik.sources.plex` - authentik Sources.Plex
      > - `authentik.sources.saml` - authentik Sources.SAML
      > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
      > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
      > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
      > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
      > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
      > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
      > - `authentik.stages.captcha` - authentik Stages.Captcha
      > - `authentik.stages.consent` - authentik Stages.Consent
      > - `authentik.stages.deny` - authentik Stages.Deny
      > - `authentik.stages.dummy` - authentik Stages.Dummy
      > - `authentik.stages.email` - authentik Stages.Email
      > - `authentik.stages.identification` - authentik Stages.Identification
      > - `authentik.stages.invitation` - authentik Stages.User Invitation
      > - `authentik.stages.password` - authentik Stages.Password
      > - `authentik.stages.prompt` - authentik Stages.Prompt
      > - `authentik.stages.user_delete` - authentik Stages.User Delete
      > - `authentik.stages.user_login` - authentik Stages.User Login
      > - `authentik.stages.user_logout` - authentik Stages.User Logout
      > - `authentik.stages.user_write` - authentik Stages.User Write
      > - `authentik.tenants` - authentik Tenants
      > - `authentik.blueprints` - authentik Blueprints
      > - `authentik.core` - authentik Core

      Added enum value:

      - `authentik.providers.radius`

##### `GET` /providers/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PUT` /providers/ldap/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PATCH` /providers/ldap/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /providers/proxy/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ProxyProvider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PUT` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `PATCH` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /core/applications/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Application Serializer

    - Changed property `provider_obj` (object)

      > Provider Serializer

      - Added property `authentication_flow` (string)
        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `application` (object)

    > Application Serializer

    - Changed property `provider_obj` (object)

      > Provider Serializer

      - Added property `authentication_flow` (string)
        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /outposts/instances/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

  > - `proxy` - Proxy
  > - `ldap` - Ldap
  > - `radius` - Radius

  Added enum value:

  - `radius`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius

    Added enum value:

    - `radius`

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Outpost Serializer

    - Changed property `type` (string)

      > - `proxy` - Proxy
      > - `ldap` - Ldap
      > - `radius` - Radius

      Added enum value:

      - `radius`

    - Changed property `providers_obj` (array)

      Changed items (object): > Provider Serializer

      - Added property `authentication_flow` (string)
        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /providers/ldap/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Added property `authentication_flow` (string)
  > Flow used for authentication when the associated application is accessed by an un-authenticated user.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `authentication_flow` (string)
    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /providers/saml/

###### Parameters:

Added: `authentication_flow` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    - Added property `authentication_flow` (string)
      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /stages/user\_login/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `remember_me_offset` (string)
    > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

##### `PUT` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `remember_me_offset` (string)
  > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `remember_me_offset` (string)
    > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

##### `PATCH` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `remember_me_offset` (string)
  > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `remember_me_offset` (string)
    > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `application` (object)

      > Application Serializer

      - Changed property `provider_obj` (object)

        > Provider Serializer

        - Added property `authentication_flow` (string)
          > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'ak-stage-user-login' component:

  - Property `type` (string)

    > - `native` - NATIVE
    > - `shell` - SHELL
    > - `redirect` - REDIRECT

    Enum values:

    - `native`
    - `shell`
    - `redirect`

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

    - Property `title` (string)

    - Property `background` (string)

    - Property `cancel_url` (string)

    - Property `layout` (string)

      > - `stacked` - STACKED
      > - `content_left` - CONTENT\_LEFT
      > - `content_right` - CONTENT\_RIGHT
      > - `sidebar_left` - SIDEBAR\_LEFT
      > - `sidebar_right` - SIDEBAR\_RIGHT

      Enum values:

      - `stacked`
      - `content_left`
      - `content_right`
      - `sidebar_left`
      - `sidebar_right`

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `pending_user` (string)

  - Property `pending_user_avatar` (string)

  Updated `ak-stage-prompt` component:

  - Changed property `fields` (array)

    Changed items (object): > Serializer for a single Prompt field

    New required properties:

    - `choices`

    * Added property `choices` (array)

      Items (string):

    * Changed property `type` (string)

      > - `text` - Text: Simple Text input
      > - `text_area` - Text area: Multiline Text Input.
      > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
      > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
      > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
      > - `email` - Email: Text field with Email type.
      > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
      > - `number` - Number
      > - `checkbox` - Checkbox
      > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
      > - `dropdown` - Fixed choice field rendered as a dropdown.
      > - `date` - Date
      > - `date-time` - Date Time
      > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
      > - `separator` - Separator: Static Separator Line
      > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
      > - `static` - Static: Static value, displayed as-is.
      > - `ak-locale` - authentik: Selection of locales authentik supports

      Added enum values:

      - `text_area`
      - `text_area_read_only`
      - `radio-button-group`
      - `dropdown`

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Added 'ak-stage-user-login' component:

- Property `component` (string)

- Property `remember_me` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'ak-stage-user-login' component:
  Updated `ak-stage-prompt` component:

  - Changed property `fields` (array)

    Changed items (object): > Serializer for a single Prompt field

    New required properties:

    - `choices`

    * Added property `choices` (array)

    * Changed property `type` (string)

      > - `text` - Text: Simple Text input
      > - `text_area` - Text area: Multiline Text Input.
      > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
      > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
      > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
      > - `email` - Email: Text field with Email type.
      > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
      > - `number` - Number
      > - `checkbox` - Checkbox
      > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
      > - `dropdown` - Fixed choice field rendered as a dropdown.
      > - `date` - Date
      > - `date-time` - Date Time
      > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
      > - `separator` - Separator: Static Separator Line
      > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
      > - `static` - Static: Static value, displayed as-is.
      > - `ak-locale` - authentik: Selection of locales authentik supports

      Added enum values:

      - `text_area`
      - `text_area_read_only`
      - `radio-button-group`
      - `dropdown`

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `authentication_flow` (string)
        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `authentication_flow` (string)
        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `authentication_flow` (string)
        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

##### `GET` /stages/prompt/prompts/\{prompt\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `placeholder` (string)

    > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `type` (string)

    > - `text` - Text: Simple Text input
    > - `text_area` - Text area: Multiline Text Input.
    > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
    > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
    > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
    > - `email` - Email: Text field with Email type.
    > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
    > - `number` - Number
    > - `checkbox` - Checkbox
    > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
    > - `dropdown` - Fixed choice field rendered as a dropdown.
    > - `date` - Date
    > - `date-time` - Date Time
    > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
    > - `separator` - Separator: Static Separator Line
    > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
    > - `static` - Static: Static value, displayed as-is.
    > - `ak-locale` - authentik: Selection of locales authentik supports

    Added enum values:

    - `text_area`
    - `text_area_read_only`
    - `radio-button-group`
    - `dropdown`

##### `PUT` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `placeholder` (string)

  > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

- Changed property `type` (string)

  > - `text` - Text: Simple Text input
  > - `text_area` - Text area: Multiline Text Input.
  > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
  > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
  > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
  > - `email` - Email: Text field with Email type.
  > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
  > - `number` - Number
  > - `checkbox` - Checkbox
  > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
  > - `dropdown` - Fixed choice field rendered as a dropdown.
  > - `date` - Date
  > - `date-time` - Date Time
  > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
  > - `separator` - Separator: Static Separator Line
  > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
  > - `static` - Static: Static value, displayed as-is.
  > - `ak-locale` - authentik: Selection of locales authentik supports

  Added enum values:

  - `text_area`
  - `text_area_read_only`
  - `radio-button-group`
  - `dropdown`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `placeholder` (string)

    > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `type` (string)

    > - `text` - Text: Simple Text input
    > - `text_area` - Text area: Multiline Text Input.
    > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
    > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
    > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
    > - `email` - Email: Text field with Email type.
    > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
    > - `number` - Number
    > - `checkbox` - Checkbox
    > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
    > - `dropdown` - Fixed choice field rendered as a dropdown.
    > - `date` - Date
    > - `date-time` - Date Time
    > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
    > - `separator` - Separator: Static Separator Line
    > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
    > - `static` - Static: Static value, displayed as-is.
    > - `ak-locale` - authentik: Selection of locales authentik supports

    Added enum values:

    - `text_area`
    - `text_area_read_only`
    - `radio-button-group`
    - `dropdown`

##### `PATCH` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `placeholder` (string)

  > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

- Changed property `type` (string)

  > - `text` - Text: Simple Text input
  > - `text_area` - Text area: Multiline Text Input.
  > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
  > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
  > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
  > - `email` - Email: Text field with Email type.
  > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
  > - `number` - Number
  > - `checkbox` - Checkbox
  > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
  > - `dropdown` - Fixed choice field rendered as a dropdown.
  > - `date` - Date
  > - `date-time` - Date Time
  > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
  > - `separator` - Separator: Static Separator Line
  > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
  > - `static` - Static: Static value, displayed as-is.
  > - `ak-locale` - authentik: Selection of locales authentik supports

  Added enum values:

  - `text_area`
  - `text_area_read_only`
  - `radio-button-group`
  - `dropdown`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `placeholder` (string)

    > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `type` (string)

    > - `text` - Text: Simple Text input
    > - `text_area` - Text area: Multiline Text Input.
    > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
    > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
    > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
    > - `email` - Email: Text field with Email type.
    > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
    > - `number` - Number
    > - `checkbox` - Checkbox
    > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
    > - `dropdown` - Fixed choice field rendered as a dropdown.
    > - `date` - Date
    > - `date-time` - Date Time
    > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
    > - `separator` - Separator: Static Separator Line
    > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
    > - `static` - Static: Static value, displayed as-is.
    > - `ak-locale` - authentik: Selection of locales authentik supports

    Added enum values:

    - `text_area`
    - `text_area_read_only`
    - `radio-button-group`
    - `dropdown`

##### `POST` /stages/user\_login/

###### Request:

Changed content type : `application/json`

- Added property `remember_me_offset` (string)
  > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `remember_me_offset` (string)
    > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

##### `GET` /stages/user\_login/

###### Parameters:

Added: `remember_me_offset` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLoginStage Serializer

    - Added property `remember_me_offset` (string)
      > Offset the session will be extended by when the user picks the remember me option. Default of 0 means that the remember me option will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

- Changed property `placeholder` (string)

  > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

- Changed property `type` (string)

  > - `text` - Text: Simple Text input
  > - `text_area` - Text area: Multiline Text Input.
  > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
  > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
  > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
  > - `email` - Email: Text field with Email type.
  > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
  > - `number` - Number
  > - `checkbox` - Checkbox
  > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
  > - `dropdown` - Fixed choice field rendered as a dropdown.
  > - `date` - Date
  > - `date-time` - Date Time
  > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
  > - `separator` - Separator: Static Separator Line
  > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
  > - `static` - Static: Static value, displayed as-is.
  > - `ak-locale` - authentik: Selection of locales authentik supports

  Added enum values:

  - `text_area`
  - `text_area_read_only`
  - `radio-button-group`
  - `dropdown`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `placeholder` (string)

    > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `type` (string)

    > - `text` - Text: Simple Text input
    > - `text_area` - Text area: Multiline Text Input.
    > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
    > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
    > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
    > - `email` - Email: Text field with Email type.
    > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
    > - `number` - Number
    > - `checkbox` - Checkbox
    > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
    > - `dropdown` - Fixed choice field rendered as a dropdown.
    > - `date` - Date
    > - `date-time` - Date Time
    > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
    > - `separator` - Separator: Static Separator Line
    > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
    > - `static` - Static: Static value, displayed as-is.
    > - `ak-locale` - authentik: Selection of locales authentik supports

    Added enum values:

    - `text_area`
    - `text_area_read_only`
    - `radio-button-group`
    - `dropdown`

##### `GET` /stages/prompt/prompts/

###### Parameters:

Changed: `type` in `query`

> - `text` - Text: Simple Text input
> - `text_area` - Text area: Multiline Text Input.
> - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
> - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
> - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
> - `email` - Email: Text field with Email type.
> - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
> - `number` - Number
> - `checkbox` - Checkbox
> - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
> - `dropdown` - Fixed choice field rendered as a dropdown.
> - `date` - Date
> - `date-time` - Date Time
> - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
> - `separator` - Separator: Static Separator Line
> - `hidden` - Hidden: Hidden field, can be used to insert data into form.
> - `static` - Static: Static value, displayed as-is.
> - `ak-locale` - authentik: Selection of locales authentik supports
> - `text` - Text: Simple Text input
> - `text_area` - Text area: Multiline Text Input.
> - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
> - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
> - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
> - `email` - Email: Text field with Email type.
> - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
> - `number` - Number
> - `checkbox` - Checkbox
> - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
> - `dropdown` - Fixed choice field rendered as a dropdown.
> - `date` - Date
> - `date-time` - Date Time
> - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
> - `separator` - Separator: Static Separator Line
> - `hidden` - Hidden: Hidden field, can be used to insert data into form.
> - `static` - Static: Static value, displayed as-is.
> - `ak-locale` - authentik: Selection of locales authentik supports

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Prompt Serializer

    - Changed property `placeholder` (string)

      > When creating a Radio Button Group or Dropdown, enable interpreting as expression and return a list to return multiple choices.

    - Changed property `type` (string)

      > - `text` - Text: Simple Text input
      > - `text_area` - Text area: Multiline Text Input.
      > - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
      > - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
      > - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
      > - `email` - Email: Text field with Email type.
      > - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
      > - `number` - Number
      > - `checkbox` - Checkbox
      > - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
      > - `dropdown` - Fixed choice field rendered as a dropdown.
      > - `date` - Date
      > - `date-time` - Date Time
      > - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
      > - `separator` - Separator: Static Separator Line
      > - `hidden` - Hidden: Hidden field, can be used to insert data into form.
      > - `static` - Static: Static value, displayed as-is.
      > - `ak-locale` - authentik: Selection of locales authentik supports

      Added enum values:

      - `text_area`
      - `text_area_read_only`
      - `radio-button-group`
      - `dropdown`

---

## Release 2023.5

## Breaking changes

- Deprecation of PostgreSQL 11 support

  The next release of authentik will only support PostgreSQL 12 and newer. Upgrading can be done with [https://github.com/tianon/docker-postgres-upgrade](https://github.com/tianon/docker-postgres-upgrade) or by exporting the database and re-importing the database into a new PostgreSQL instance.

- Removal of deprecated LDAP fields

  This version removes the deprecated LDAP fields `goauthentik.io/ldap/active` and `goauthentik.io/ldap/superuser`.

  Additionally, any custom fields based on user attributes will only be represented with their sanitized key, removing any slashes with dashes, and removing periods.

- Renamed docker-compose environment variables

  To better distinguish settings that configure authentik itself and settings that configure docker-compose, the environment variables `AUTHENTIK_PORT_HTTP` and `AUTHENTIK_PORT_HTTPS` have been renamed to `COMPOSE_PORT_HTTP` and `COMPOSE_PORT_HTTPS` respectively.

## New features

- Backchannel providers

  Backchannel providers can augment the functionality of applications by using additional protocols. The main provider of an application provides the SSO protocol that is used for logging into the application. Then, additional backchannel providers can be used for protocols such as [SCIM](../../add-secure-apps/providers/scim/index.mdx) and [LDAP](../../add-secure-apps/providers/ldap/index.mdx) to provide directory syncing.

  Access restrictions that are configured on an application apply to all of its backchannel providers.

- Improved blueprint developer experience

  The blueprint schema has been greatly expanded to make writing blueprints easier. Where previously only possible models would be autocompleted, with the new schema all model fields are suggested with their types and possible values.

  Additionally, it is now possible to set Application and Source icons and Flow backgrounds via blueprints, by specifying their value as a URL.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2023.5/docker-compose.yml
docker-compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2023.5.0
```

## Minor changes/fixes

- api: modular urls (#5551)
- blueprints: adjust wording on managed field (#5558)
- blueprints: fix error when imported blueprint is invalid (#5414)
- blueprints: ignore hidden files in discovery (#5472)
- blueprints: improve schema generation by including model schema (#5503)
- blueprints: specify schema for blueprint metadata (#5509)
- blueprints: support setting file URLs in blueprints (#5510)
- cmd: use live endpoint instead of ready for inbuild healthcheck
- core: applications backchannel provider (#5449)
- crypto: make name field unique to prevent double certs (#5406)
- events: always run policies for notification rules even if no group is selected (#5353)
- events: cleanse http query string in events (#5508)
- events: include event user in webhook notification (#5524)
- internal: ignore insecure TLS certs (#5483)
- lifecycle: migrate internal healthcheck to use go (#5322)
- outposts: make state more consistent (#5403)
- policies: clear app cache when writing user, groups, policies (#5371)
- policies: make policy engine modes consistent with database values (#5462)
- providers/ldap: correctly use pagination in search results in both modes (#5492)
- providers/ldap: remove deprecated fields (#5154)
- providers/oauth2: use simpler charset for refresh tokens (#5502)
- providers/scim: correctly handle 404 by re-creating object (#5405)
- providers/scim: ensure scim group member isn't None (#5391)
- providers/scim: fix missing user/group filtering on SCIM direct save signals (#5473)
- providers/scim: improve compatibility (#5425)
- providers/scim: patch group name (#5564)
- root: Change docker-compose HTTP and HTTPS port variables (#5335)
- root: optimize healthchecks (#5337)
- sources/oauth: add patreon type (#5452)
- sources/oauth: fix reddit (#5557)
- stages/prompt: Add initial\_data prompt field and ability to select a default choice for choice fields (#5095)
- web/admin: add example data for ldap property mapping (#5530)
- web/admin: add notes for users and groups (#5459)
- web/admin: add toggle to hide deactivated users (#5419)
- web/admin: disable generated proxy config by default (#5372)
- web/admin: fix blueprint instance list without metadata or labels (#5296)
- web/admin: fix cert expiry coloring (#5354)
- web/admin: fix error when prompt previewing fails when loading the page (#5290)
- web/admin: fix file path setting not saved properly (#5463)
- web/admin: fix flow stage binding update failing (#5287)
- web/admin: fix outpost integration list (#5418)
- web/admin: fix radius view page not imported (#5450)
- web/admin: fix state issue after clearIcon/Background is used and for… (#5423)
- web/admin: remove grouping (#5343)
- web/admin: use radio for client type (#5499)
- web/flow: render prompt inputs without unsafeHTML (#5404)
- web/flows: rework redirect logic (#5498)
- web/user: fix empty banner on application page not showing correctly (#5555)
- web: Fix label not clickable for checkbox and choice field in prompts (#5355)
- web: fix API browser error (#5402)
- web: fix loading text not being loaded (#5497)

## Fixed in 2023.5.1

- lib: fix fallback\_names migration not working when multiple objects with the same name exist (#5637)
- providers/radius: add warning message when radius provider is not used with outpost (#5656)
- providers/scim: default to None for fields instead of empty list (#5642)
- providers/scim: improve backchannel signalling (#5657)
- sources/ldap: improve error message (#5653)
- sources/ldap: log full exception when user password set fails (#5678)
- web/admin: fix radius provider page (#5651)
- web/flows: fix authenticator\_validate device selection not sent to backend (#5638)
- web/flows: improve UI for TOTP code input (#5676)
- web/flows: update flow background (#5639)

## Fixed in 2023.5.2

- blueprints: fix check for file path not being run on worker (#5703)
- blueprints: support custom ports for OCI blueprints (#5727)
- core: bump coverage from 7.2.5 to 7.2.6 (#5738)
- core: make groups field for user optional (#5702)
- events: fix ak\_create\_event using wrong request for event creation (#5731)
- lib: add tests for ak\_create\_event (#5710)
- outposts: fix missing radius outpost controller (#5730)
- web/user: fix MFA enroll dropdown broken when password stage has no configuration flow (#5744)

## Fixed in 2023.5.3

- blueprints: fix API validation with OCI blueprint path (#5822)
- ci: build outpost binaries statically linked (#5823)
- ci: replace github bot account with github app (#5819)
- providers/ldap: fix LDAP Outpost application selection (#5812)
- web/flows: fix RedirectStage not detecting absolute URLs correctly (#5781)

## Fixed in 2023.5.4

- security: Address pen-test findings from the [2023-06 Cure53 Code audit](../../security/audits-and-certs/2023-06-cure53.mdx)

## Fixed in 2023.5.5

- \*: fix [CVE-2023-36456](../../security/cves/CVE-2023-36456.mdx), Reported by [@thijsa](https://github.com/thijsa)

## Fixed in 2023.5.6

- \*: fix [CVE-2023-39522](../../security/cves/CVE-2023-39522.mdx), Reported by [@markrassamni](https://github.com/markrassamni)

## API Changes

#### What's Changed

***

##### `GET` /crypto/certificatekeypairs/\{kp\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `managed`

  * Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PUT` /crypto/certificatekeypairs/\{kp\_uuid}/

###### Request:

Changed content type : `application/json`

- Deleted property `managed` (string)
  > Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `managed`

  * Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PATCH` /crypto/certificatekeypairs/\{kp\_uuid}/

###### Request:

Changed content type : `application/json`

- Deleted property `managed` (string)
  > Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `managed`

  * Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `POST` /crypto/certificatekeypairs/generate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `managed`

  * Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum value:

    - `authentik.enterprise`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.lib` - authentik lib
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Added enum value:

  - `authentik.enterprise`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum value:

    - `authentik.enterprise`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.lib` - authentik lib
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Added enum value:

  - `authentik.enterprise`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum value:

    - `authentik.enterprise`

##### `GET` /propertymappings/all/\{pm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/ldap/\{pm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PUT` /propertymappings/ldap/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PATCH` /propertymappings/ldap/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/saml/\{pm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PUT` /propertymappings/saml/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PATCH` /propertymappings/saml/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/scim/\{pm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PUT` /propertymappings/scim/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PATCH` /propertymappings/scim/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/scope/\{pm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PUT` /propertymappings/scope/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PATCH` /propertymappings/scope/\{pm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /providers/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PUT` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PATCH` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PUT` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PATCH` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/radius/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PUT` /providers/radius/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PATCH` /providers/radius/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `backchannel_providers_obj`

  * Added property `backchannel_providers` (array)

    Items (integer):

  * Added property `backchannel_providers_obj` (array)

    Items (object): > Provider Serializer

    - Property `pk` (integer)

    - Property `name` (string)

    - Property `authentication_flow` (string)

      > Flow used for authentication when the associated application is accessed by an un-authenticated user.

    - Property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    - Property `property_mappings` (array)

      Items (string):

    - Property `component` (string)

      > Get object component so that we know how to edit the object

    - Property `assigned_application_slug` (string)

      > Internal application name, used in URLs.

    - Property `assigned_application_name` (string)

      > Application's display Name.

    - Property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    - Property `assigned_backchannel_application_name` (string)

      > Application's display Name.

    - Property `verbose_name` (string)

      > Return object's verbose\_name

    - Property `verbose_name_plural` (string)

      > Return object's plural verbose\_name

    - Property `meta_model_name` (string)
      > Return internal model name

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

  * Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PUT` /core/applications/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `backchannel_providers` (array)

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `backchannel_providers_obj`

  * Added property `backchannel_providers` (array)

  * Added property `backchannel_providers_obj` (array)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

  * Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PATCH` /core/applications/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `backchannel_providers` (array)

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `backchannel_providers_obj`

  * Added property `backchannel_providers` (array)

  * Added property `backchannel_providers_obj` (array)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

  * Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PUT` /core/tokens/\{identifier}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `PATCH` /core/tokens/\{identifier}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `POST` /crypto/certificatekeypairs/

###### Request:

Changed content type : `application/json`

- Deleted property `managed` (string)
  > Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `managed`

  * Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /crypto/certificatekeypairs/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CertificateKeyPair Serializer

    New required properties:

    - `managed`

    * Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /flows/instances/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PUT` /flows/instances/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PATCH` /flows/instances/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `PUT` /outposts/instances/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `PATCH` /outposts/instances/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /outposts/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `application_slug` (string)
    > Prioritize backchannel slug over direct application slug

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.lib` - authentik lib
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Added enum value:

  - `authentik.enterprise`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.lib` - authentik lib
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Added enum value:

    - `authentik.enterprise`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > - `authentik.admin` - authentik Admin
      > - `authentik.api` - authentik API
      > - `authentik.crypto` - authentik Crypto
      > - `authentik.events` - authentik Events
      > - `authentik.flows` - authentik Flows
      > - `authentik.lib` - authentik lib
      > - `authentik.outposts` - authentik Outpost
      > - `authentik.policies.dummy` - authentik Policies.Dummy
      > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
      > - `authentik.policies.expiry` - authentik Policies.Expiry
      > - `authentik.policies.expression` - authentik Policies.Expression
      > - `authentik.policies.password` - authentik Policies.Password
      > - `authentik.policies.reputation` - authentik Policies.Reputation
      > - `authentik.policies` - authentik Policies
      > - `authentik.providers.ldap` - authentik Providers.LDAP
      > - `authentik.providers.oauth2` - authentik Providers.OAuth2
      > - `authentik.providers.proxy` - authentik Providers.Proxy
      > - `authentik.providers.radius` - authentik Providers.Radius
      > - `authentik.providers.saml` - authentik Providers.SAML
      > - `authentik.providers.scim` - authentik Providers.SCIM
      > - `authentik.recovery` - authentik Recovery
      > - `authentik.sources.ldap` - authentik Sources.LDAP
      > - `authentik.sources.oauth` - authentik Sources.OAuth
      > - `authentik.sources.plex` - authentik Sources.Plex
      > - `authentik.sources.saml` - authentik Sources.SAML
      > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
      > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
      > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
      > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
      > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
      > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
      > - `authentik.stages.captcha` - authentik Stages.Captcha
      > - `authentik.stages.consent` - authentik Stages.Consent
      > - `authentik.stages.deny` - authentik Stages.Deny
      > - `authentik.stages.dummy` - authentik Stages.Dummy
      > - `authentik.stages.email` - authentik Stages.Email
      > - `authentik.stages.identification` - authentik Stages.Identification
      > - `authentik.stages.invitation` - authentik Stages.User Invitation
      > - `authentik.stages.password` - authentik Stages.Password
      > - `authentik.stages.prompt` - authentik Stages.Prompt
      > - `authentik.stages.user_delete` - authentik Stages.User Delete
      > - `authentik.stages.user_login` - authentik Stages.User Login
      > - `authentik.stages.user_logout` - authentik Stages.User Logout
      > - `authentik.stages.user_write` - authentik Stages.User Write
      > - `authentik.tenants` - authentik Tenants
      > - `authentik.blueprints` - authentik Blueprints
      > - `authentik.core` - authentik Core
      > - `authentik.enterprise` - authentik Enterprise

      Added enum value:

      - `authentik.enterprise`

##### `GET` /propertymappings/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PropertyMapping Serializer

    - Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `POST` /propertymappings/ldap/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAP PropertyMapping Serializer

    - Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `POST` /propertymappings/saml/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLPropertyMapping Serializer

    - Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `POST` /propertymappings/scim/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SCIMMapping Serializer

    - Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `POST` /propertymappings/scope/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /propertymappings/scope/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ScopeMapping Serializer

    - Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /providers/all/

###### Parameters:

Added: `backchannel_only` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PUT` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PATCH` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `POST` /providers/oauth2/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `POST` /providers/proxy/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ProxyProvider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `POST` /providers/radius/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > RadiusProvider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PUT` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `PATCH` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /root/config/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `capabilities` (array)

    Changed items (string): > \_ `can_save_media` - Can Save Media > \_ `can_geo_ip` - Can Geo Ip > \_ `can_impersonate` - Can Impersonate > \_ `can_debug` - Can Debug > \* `is_enterprise` - Is Enterprise

    Added enum value:

    - `is_enterprise`

##### `GET` /sources/all/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PUT` /sources/ldap/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PATCH` /sources/ldap/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)

    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

  - Changed property `provider_type` (string)

    > - `apple` - Apple
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `openidconnect` - OpenID Connect
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

    Added enum value:

    - `patreon`

##### `PUT` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)

  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

- Changed property `provider_type` (string)

  > - `apple` - Apple
  > - `azuread` - Azure AD
  > - `discord` - Discord
  > - `facebook` - Facebook
  > - `github` - GitHub
  > - `google` - Google
  > - `mailcow` - Mailcow
  > - `openidconnect` - OpenID Connect
  > - `okta` - Okta
  > - `patreon` - Patreon
  > - `reddit` - Reddit
  > - `twitch` - Twitch
  > - `twitter` - Twitter

  Added enum value:

  - `patreon`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)

    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

  - Changed property `provider_type` (string)

    > - `apple` - Apple
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `openidconnect` - OpenID Connect
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

    Added enum value:

    - `patreon`

##### `PATCH` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)

  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

- Changed property `provider_type` (string)

  > - `apple` - Apple
  > - `azuread` - Azure AD
  > - `discord` - Discord
  > - `facebook` - Facebook
  > - `github` - GitHub
  > - `google` - Google
  > - `mailcow` - Mailcow
  > - `openidconnect` - OpenID Connect
  > - `okta` - Okta
  > - `patreon` - Patreon
  > - `reddit` - Reddit
  > - `twitch` - Twitch
  > - `twitter` - Twitter

  Added enum value:

  - `patreon`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)

    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

  - Changed property `provider_type` (string)

    > - `apple` - Apple
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `openidconnect` - OpenID Connect
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

    Added enum value:

    - `patreon`

##### `GET` /sources/plex/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PUT` /sources/plex/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PATCH` /sources/plex/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PUT` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PATCH` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /sources/user\_connections/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /sources/user\_connections/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/oauth/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /sources/user\_connections/oauth/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /sources/user\_connections/oauth/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/plex/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /sources/user\_connections/plex/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /sources/user\_connections/plex/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /sources/user\_connections/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /sources/user\_connections/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `POST` /core/applications/

###### Request:

Changed content type : `application/json`

- Added property `backchannel_providers` (array)

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `backchannel_providers_obj`

  * Added property `backchannel_providers` (array)

  * Added property `backchannel_providers_obj` (array)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

  * Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Application Serializer

    New required properties:

    - `backchannel_providers_obj`

    * Added property `backchannel_providers` (array)

    * Added property `backchannel_providers_obj` (array)

    * Changed property `provider_obj` (object)

      > Provider Serializer

      New required properties:

      - `assigned_backchannel_application_name`
      - `assigned_backchannel_application_slug`

      * Added property `assigned_backchannel_application_slug` (string)

        > Internal application name, used in URLs.

      * Added property `assigned_backchannel_application_name` (string)
        > Application's display Name.

    * Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `POST` /core/tokens/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)
    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `managed` (string)
      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `application` (object)

    > Application Serializer

    New required properties:

    - `backchannel_providers_obj`

    * Added property `backchannel_providers` (array)

    * Added property `backchannel_providers_obj` (array)

    * Changed property `provider_obj` (object)

      > Provider Serializer

      New required properties:

      - `assigned_backchannel_application_name`
      - `assigned_backchannel_application_slug`

      * Added property `assigned_backchannel_application_slug` (string)

        > Internal application name, used in URLs.

      * Added property `assigned_backchannel_application_name` (string)
        > Application's display Name.

    * Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PUT` /flows/bindings/\{fsb\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `PATCH` /flows/bindings/\{fsb\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /flows/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Flow Serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `POST` /outposts/instances/

###### Request:

Changed content type : `application/json`

- Changed property `managed` (string)
  > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Outpost Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `providers_obj` (array)

      Changed items (object): > Provider Serializer

      New required properties:

      - `assigned_backchannel_application_name`
      - `assigned_backchannel_application_slug`

      * Added property `assigned_backchannel_application_slug` (string)

        > Internal application name, used in URLs.

      * Added property `assigned_backchannel_application_name` (string)
        > Application's display Name.

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    - Changed property `application_slug` (string)
      > Prioritize backchannel slug over direct application slug

##### `POST` /providers/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `POST` /providers/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `assigned_backchannel_application_name`
  - `assigned_backchannel_application_slug`

  * Added property `assigned_backchannel_application_slug` (string)

    > Internal application name, used in URLs.

  * Added property `assigned_backchannel_application_name` (string)
    > Application's display Name.

##### `GET` /providers/saml/

###### Parameters:

Added: `backchannel_application` in `query`

Added: `is_backchannel` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    New required properties:

    - `assigned_backchannel_application_name`
    - `assigned_backchannel_application_slug`

    * Added property `assigned_backchannel_application_slug` (string)

      > Internal application name, used in URLs.

    * Added property `assigned_backchannel_application_name` (string)
      > Application's display Name.

##### `GET` /sources/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAP Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)

  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

- Changed property `provider_type` (string)

  > - `apple` - Apple
  > - `azuread` - Azure AD
  > - `discord` - Discord
  > - `facebook` - Facebook
  > - `github` - GitHub
  > - `google` - Google
  > - `mailcow` - Mailcow
  > - `openidconnect` - OpenID Connect
  > - `okta` - Okta
  > - `patreon` - Patreon
  > - `reddit` - Reddit
  > - `twitch` - Twitch
  > - `twitter` - Twitter

  Added enum value:

  - `patreon`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)

    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

  - Changed property `provider_type` (string)

    > - `apple` - Apple
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `openidconnect` - OpenID Connect
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

    Added enum value:

    - `patreon`

##### `GET` /sources/oauth/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)

      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

    - Changed property `provider_type` (string)

      > - `apple` - Apple
      > - `azuread` - Azure AD
      > - `discord` - Discord
      > - `facebook` - Facebook
      > - `github` - GitHub
      > - `google` - Google
      > - `mailcow` - Mailcow
      > - `openidconnect` - OpenID Connect
      > - `okta` - Okta
      > - `patreon` - Patreon
      > - `reddit` - Reddit
      > - `twitch` - Twitch
      > - `twitter` - Twitter

      Added enum value:

      - `patreon`

##### `POST` /sources/plex/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/plex/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Plex Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `managed` (string)

    > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /sources/saml/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLSource Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `source` (object)

      > Source Serializer

      - Changed property `managed` (string)

        > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /sources/user\_connections/oauth/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `source` (object)

      > Source Serializer

      - Changed property `managed` (string)

        > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /sources/user\_connections/plex/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Plex Source connection Serializer

    - Changed property `source` (object)

      > Source Serializer

      - Changed property `managed` (string)

        > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /sources/user\_connections/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `source` (object)

    > Source Serializer

    - Changed property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /sources/user\_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAML Source Serializer

    - Changed property `source` (object)

      > Source Serializer

      - Changed property `managed` (string)

        > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `GET` /stages/all/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/duo/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/sms/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/static/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/authenticator/static/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/authenticator/static/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/totp/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/authenticator/totp/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/authenticator/totp/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/validate/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/consent/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/consent/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/consent/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/deny/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/dummy/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/dummy/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/dummy/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/email/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/identification/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Invitation Serializer

    - Changed property `flow_obj` (object)

      > Flow Serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `GET` /stages/invitation/stages/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/invitation/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/invitation/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/password/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/prompt/stages/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/prompt/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/prompt/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_delete/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/user\_delete/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/user\_delete/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_login/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_logout/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/user\_logout/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/user\_logout/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_write/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PUT` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `PATCH` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `application` (object)

      > Application Serializer

      New required properties:

      - `backchannel_providers_obj`

      * Added property `backchannel_providers` (array)

      * Added property `backchannel_providers_obj` (array)

      * Changed property `provider_obj` (object)

        > Provider Serializer

        New required properties:

        - `assigned_backchannel_application_name`
        - `assigned_backchannel_application_slug`

        * Added property `assigned_backchannel_application_slug` (string)

          > Internal application name, used in URLs.

        * Added property `assigned_backchannel_application_name` (string)
          > Application's display Name.

      * Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /flows/bindings/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)
  > - `all` - all, all policies must pass
  > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

##### `GET` /flows/bindings/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > FlowStageBinding Serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-prompt` component:

  - Changed property `fields` (array)

    Changed items (object): > Serializer for a single Prompt field

    New required properties:

    - `initial_value`

    * Added property `initial_value` (string)

##### `POST` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-prompt` component:

  - Changed property `fields` (array)

    Changed items (object): > Serializer for a single Prompt field

    New required properties:

    - `initial_value`

    * Added property `initial_value` (string)

##### `GET` /flows/inspector/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `plans` (array)

    Changed items (object): > Serializer for an active FlowPlan

    - Changed property `current_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New required properties:

      - `assigned_backchannel_application_name`
      - `assigned_backchannel_application_slug`

      * Added property `assigned_backchannel_application_slug` (string)

        > Internal application name, used in URLs.

      * Added property `assigned_backchannel_application_name` (string)
        > Application's display Name.

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New required properties:

      - `assigned_backchannel_application_name`
      - `assigned_backchannel_application_slug`

      * Added property `assigned_backchannel_application_slug` (string)

        > Internal application name, used in URLs.

      * Added property `assigned_backchannel_application_name` (string)
        > Application's display Name.

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New required properties:

      - `assigned_backchannel_application_name`
      - `assigned_backchannel_application_slug`

      * Added property `assigned_backchannel_application_slug` (string)

        > Internal application name, used in URLs.

      * Added property `assigned_backchannel_application_name` (string)
        > Application's display Name.

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/authenticator/duo/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorDuoStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/authenticator/sms/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorSMSStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/authenticator/static/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorStaticStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/authenticator/totp/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorTOTPStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorValidateStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticateWebAuthnStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/consent/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ConsentStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/deny/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DenyStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/dummy/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DummyStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > EmailStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > IdentificationStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/invitation/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > InvitationStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PasswordStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `GET` /stages/prompt/prompts/\{prompt\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `initial_value` (string)

    > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

  - Added property `initial_value_expression` (boolean)

  - Changed property `placeholder` (string)

    > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `PUT` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `initial_value` (string)

  > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

- Added property `initial_value_expression` (boolean)

- Changed property `placeholder` (string)

  > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `initial_value` (string)

    > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

  - Added property `initial_value_expression` (boolean)

  - Changed property `placeholder` (string)

    > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `PATCH` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `initial_value` (string)

  > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

- Added property `initial_value_expression` (boolean)

- Changed property `placeholder` (string)

  > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `initial_value` (string)

    > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

  - Added property `initial_value_expression` (boolean)

  - Changed property `placeholder` (string)

    > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/prompt/prompts/preview/

###### Request:

Changed content type : `application/json`

- Added property `initial_value` (string)

  > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

- Added property `initial_value_expression` (boolean)

- Changed property `placeholder` (string)

  > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `fields` (array)

    Changed items (object): > Serializer for a single Prompt field

    New required properties:

    - `initial_value`

    * Added property `initial_value` (string)

##### `POST` /stages/prompt/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PromptStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/user\_delete/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserDeleteStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/user\_login/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_login/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLoginStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/user\_logout/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLogoutStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/user\_write/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `policy_engine_mode` (string)
    > - `all` - all, all policies must pass
    > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

##### `GET` /stages/user\_write/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserWriteStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

- Added property `initial_value` (string)

  > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

- Added property `initial_value_expression` (boolean)

- Changed property `placeholder` (string)

  > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `policy_engine_mode` (string)
      > - `all` - all, all policies must pass
      > - `any` - any, any policy must pass

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `initial_value` (string)

    > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

  - Added property `initial_value_expression` (boolean)

  - Changed property `placeholder` (string)

    > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `policy_engine_mode` (string)
        > - `all` - all, all policies must pass
        > - `any` - any, any policy must pass

##### `GET` /stages/prompt/prompts/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Prompt Serializer

    - Added property `initial_value` (string)

      > Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.

    - Added property `initial_value_expression` (boolean)

    - Changed property `placeholder` (string)

      > Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.

    - Changed property `promptstage_set` (array)

      Changed items (object): > Stage Serializer

      - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        - Changed property `policy_engine_mode` (string)
          > - `all` - all, all policies must pass
          > - `any` - any, any policy must pass

---

## Release 2023.6

<!-- ## Breaking changes -->

## New features

- LDAP StartTLS support

    authentik's [LDAP Provider](../../add-secure-apps/providers/ldap/index.mdx) now supports StartTLS in addition to supporting SSL. The StartTLS is a more modern method of encrypting LDAP traffic. With this added support, the LDAP [Outpost](../../add-secure-apps/outposts/index.mdx) can now support multiple certificates.

- LDAP Schema improvements

    In addition to the StartTLS support, the schema support in the LDAP provider has been drastically overhauled. This will improve support with applications and clients relying on the schema to parse data received. Additionally, the base DN is no longer required to be set when binding, as the outpost now finds the correct provider based on the bind DN.

- Event matcher policy can now match on individual models

    Previously the _Event matcher policy_ was only able to match on event actions, client IPs and apps, which made it a requirement to use expression policies to match only on certain model actions.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2023.6/docker-compose.yml
docker-compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2023.6
```

## Minor changes/fixes

- \*: use dataclass slots wherever applicable (#6005)
- blueprints: allow setting user's passwords from blueprints (#5797)
- blueprints: fix API validation with OCI blueprint path (#5822)
- blueprints: fix check for file path not being run on worker (#5703)
- blueprints: support custom ports for OCI blueprints (#5727)
- core: make groups field for user optional (#5702)
- core: prevent selecting a group as a parent of itself (#6016)
- events: fix ak_create_event using wrong request for event creation (#5731)
- lifecycle: Add depends_on for worker and server container (#5634)
- outposts/ldap: fix race condition when refreshing the provider
- outposts: fix missing radius outpost controller (#5730)
- policies/event_matcher: add model filter (#5802)
- policies/event_matcher: change empty values to null (#6032)
- providers/ldap: add StartTLS support (#5861)
- providers/ldap: fix LDAP Outpost application selection (#5812)
- providers/ldap: fix Outpost provider listing excluding backchannel providers (#5933)
- providers/ldap: improve password totp detection (#6006)
- providers/ldap: rework Schema and DSE (#5838)
- providers/oauth2: correctly advertise code_challenge_methods_supported (#6007)
- providers/oauth2: launch url: if URL parsing fails, return no launch URL (#5918)
- providers/proxy: add support for traefik.io API and CRD (#5801)
- security: cure53 fix (#6039)
- sources/ldap: add support for cert based auth (#5850)
- sources/ldap: fix duplicate bind when authenticating user directly to… (#5927)
- sources/ldap: include UnwillingToPerformError as possible exception (#6031)
- sources/saml: separate verification cert (#5699)
- web/admin: fix codemirror not working on safari (#5943)
- web/admin: theme adjustments (#5944)
- web/flows: fix RedirectStage not detecting absolute URLs correctly (#5781)
- web/user: fix MFA enroll dropdown broken when password stage has no configuration flow (#5744)
- web/user: fix broken search on application library (#5743)
- web/user: fix search input styling (#5745)
- web/user: refactor LibraryPage for testing, add CTA (#5665)
- web: Replace lingui.js with lit-localize (#5761)

## Fixed in 2023.6.1

- core: fix UUID filter field for users api (#6203)
- outposts/ldap: revert attribute filtering (#6188)
- outposts/ldap: add test for attribute filtering (#6189)
- sources/ldap: fix more errors (#6191)
- sources/ldap: fix page size (#6187)

## Fixed in 2023.6.2

- \*: fix [CVE-2023-39522](../../security/cves/CVE-2023-39522.mdx), Reported by [@markrassamni](https://github.com/markrassamni)

## API Changes

#### What's New

---

##### `GET` /admin/models/

#### What's Changed

---

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `model` (object)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
        >
        > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
        > - `authentik_events.event` - Event
        > - `authentik_events.notificationtransport` - Notification Transport
        > - `authentik_events.notification` - Notification
        > - `authentik_events.notificationrule` - Notification Rule
        > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
        > - `authentik_flows.flow` - Flow
        > - `authentik_flows.flowstagebinding` - Flow Stage Binding
        > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
        > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
        > - `authentik_outposts.outpost` - outpost
        > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
        > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
        > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
        > - `authentik_policies_expression.expressionpolicy` - Expression Policy
        > - `authentik_policies_password.passwordpolicy` - Password Policy
        > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
        > - `authentik_policies_reputation.reputation` - reputation
        > - `authentik_policies.policybinding` - Policy Binding
        > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
        > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
        > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
        > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
        > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
        > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
        > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
        > - `authentik_providers_radius.radiusprovider` - Radius Provider
        > - `authentik_providers_saml.samlprovider` - SAML Provider
        > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
        > - `authentik_providers_scim.scimprovider` - SCIM Provider
        > - `authentik_providers_scim.scimmapping` - SCIM Mapping
        > - `authentik_sources_ldap.ldapsource` - LDAP Source
        > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
        > - `authentik_sources_oauth.oauthsource` - OAuth Source
        > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
        > - `authentik_sources_plex.plexsource` - Plex Source
        > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
        > - `authentik_sources_saml.samlsource` - SAML Source
        > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
        > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
        > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
        > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
        > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
        > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
        > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
        > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
        > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
        > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
        > - `authentik_stages_captcha.captchastage` - Captcha Stage
        > - `authentik_stages_consent.consentstage` - Consent Stage
        > - `authentik_stages_consent.userconsent` - User Consent
        > - `authentik_stages_deny.denystage` - Deny Stage
        > - `authentik_stages_dummy.dummystage` - Dummy Stage
        > - `authentik_stages_email.emailstage` - Email Stage
        > - `authentik_stages_identification.identificationstage` - Identification Stage
        > - `authentik_stages_invitation.invitationstage` - Invitation Stage
        > - `authentik_stages_invitation.invitation` - Invitation
        > - `authentik_stages_password.passwordstage` - Password Stage
        > - `authentik_stages_prompt.prompt` - Prompt
        > - `authentik_stages_prompt.promptstage` - Prompt Stage
        > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
        > - `authentik_stages_user_login.userloginstage` - User Login Stage
        > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
        > - `authentik_stages_user_write.userwritestage` - User Write Stage
        > - `authentik_tenants.tenant` - Tenant
        > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
        > - `authentik_core.group` - group
        > - `authentik_core.user` - User
        > - `authentik_core.application` - Application
        > - `authentik_core.token` - Token

        Enum values:
        - `authentik_crypto.certificatekeypair`
        - `authentik_events.event`
        - `authentik_events.notificationtransport`
        - `authentik_events.notification`
        - `authentik_events.notificationrule`
        - `authentik_events.notificationwebhookmapping`
        - `authentik_flows.flow`
        - `authentik_flows.flowstagebinding`
        - `authentik_outposts.dockerserviceconnection`
        - `authentik_outposts.kubernetesserviceconnection`
        - `authentik_outposts.outpost`
        - `authentik_policies_dummy.dummypolicy`
        - `authentik_policies_event_matcher.eventmatcherpolicy`
        - `authentik_policies_expiry.passwordexpirypolicy`
        - `authentik_policies_expression.expressionpolicy`
        - `authentik_policies_password.passwordpolicy`
        - `authentik_policies_reputation.reputationpolicy`
        - `authentik_policies_reputation.reputation`
        - `authentik_policies.policybinding`
        - `authentik_providers_ldap.ldapprovider`
        - `authentik_providers_oauth2.scopemapping`
        - `authentik_providers_oauth2.oauth2provider`
        - `authentik_providers_oauth2.authorizationcode`
        - `authentik_providers_oauth2.accesstoken`
        - `authentik_providers_oauth2.refreshtoken`
        - `authentik_providers_proxy.proxyprovider`
        - `authentik_providers_radius.radiusprovider`
        - `authentik_providers_saml.samlprovider`
        - `authentik_providers_saml.samlpropertymapping`
        - `authentik_providers_scim.scimprovider`
        - `authentik_providers_scim.scimmapping`
        - `authentik_sources_ldap.ldapsource`
        - `authentik_sources_ldap.ldappropertymapping`
        - `authentik_sources_oauth.oauthsource`
        - `authentik_sources_oauth.useroauthsourceconnection`
        - `authentik_sources_plex.plexsource`
        - `authentik_sources_plex.plexsourceconnection`
        - `authentik_sources_saml.samlsource`
        - `authentik_sources_saml.usersamlsourceconnection`
        - `authentik_stages_authenticator_duo.authenticatorduostage`
        - `authentik_stages_authenticator_duo.duodevice`
        - `authentik_stages_authenticator_sms.authenticatorsmsstage`
        - `authentik_stages_authenticator_sms.smsdevice`
        - `authentik_stages_authenticator_static.authenticatorstaticstage`
        - `authentik_stages_authenticator_totp.authenticatortotpstage`
        - `authentik_stages_authenticator_validate.authenticatorvalidatestage`
        - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`
        - `authentik_stages_authenticator_webauthn.webauthndevice`
        - `authentik_stages_captcha.captchastage`
        - `authentik_stages_consent.consentstage`
        - `authentik_stages_consent.userconsent`
        - `authentik_stages_deny.denystage`
        - `authentik_stages_dummy.dummystage`
        - `authentik_stages_email.emailstage`
        - `authentik_stages_identification.identificationstage`
        - `authentik_stages_invitation.invitationstage`
        - `authentik_stages_invitation.invitation`
        - `authentik_stages_password.passwordstage`
        - `authentik_stages_prompt.prompt`
        - `authentik_stages_prompt.promptstage`
        - `authentik_stages_user_delete.userdeletestage`
        - `authentik_stages_user_login.userloginstage`
        - `authentik_stages_user_logout.userlogoutstage`
        - `authentik_stages_user_write.userwritestage`
        - `authentik_tenants.tenant`
        - `authentik_blueprints.blueprintinstance`
        - `authentik_core.group`
        - `authentik_core.user`
        - `authentik_core.application`
        - `authentik_core.token`

##### `PUT` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `model` (object)
    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
    >
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - reputation
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `model` (object)
        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
        >
        > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
        > - `authentik_events.event` - Event
        > - `authentik_events.notificationtransport` - Notification Transport
        > - `authentik_events.notification` - Notification
        > - `authentik_events.notificationrule` - Notification Rule
        > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
        > - `authentik_flows.flow` - Flow
        > - `authentik_flows.flowstagebinding` - Flow Stage Binding
        > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
        > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
        > - `authentik_outposts.outpost` - outpost
        > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
        > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
        > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
        > - `authentik_policies_expression.expressionpolicy` - Expression Policy
        > - `authentik_policies_password.passwordpolicy` - Password Policy
        > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
        > - `authentik_policies_reputation.reputation` - reputation
        > - `authentik_policies.policybinding` - Policy Binding
        > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
        > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
        > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
        > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
        > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
        > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
        > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
        > - `authentik_providers_radius.radiusprovider` - Radius Provider
        > - `authentik_providers_saml.samlprovider` - SAML Provider
        > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
        > - `authentik_providers_scim.scimprovider` - SCIM Provider
        > - `authentik_providers_scim.scimmapping` - SCIM Mapping
        > - `authentik_sources_ldap.ldapsource` - LDAP Source
        > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
        > - `authentik_sources_oauth.oauthsource` - OAuth Source
        > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
        > - `authentik_sources_plex.plexsource` - Plex Source
        > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
        > - `authentik_sources_saml.samlsource` - SAML Source
        > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
        > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
        > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
        > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
        > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
        > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
        > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
        > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
        > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
        > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
        > - `authentik_stages_captcha.captchastage` - Captcha Stage
        > - `authentik_stages_consent.consentstage` - Consent Stage
        > - `authentik_stages_consent.userconsent` - User Consent
        > - `authentik_stages_deny.denystage` - Deny Stage
        > - `authentik_stages_dummy.dummystage` - Dummy Stage
        > - `authentik_stages_email.emailstage` - Email Stage
        > - `authentik_stages_identification.identificationstage` - Identification Stage
        > - `authentik_stages_invitation.invitationstage` - Invitation Stage
        > - `authentik_stages_invitation.invitation` - Invitation
        > - `authentik_stages_password.passwordstage` - Password Stage
        > - `authentik_stages_prompt.prompt` - Prompt
        > - `authentik_stages_prompt.promptstage` - Prompt Stage
        > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
        > - `authentik_stages_user_login.userloginstage` - User Login Stage
        > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
        > - `authentik_stages_user_write.userwritestage` - User Write Stage
        > - `authentik_tenants.tenant` - Tenant
        > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
        > - `authentik_core.group` - group
        > - `authentik_core.user` - User
        > - `authentik_core.application` - Application
        > - `authentik_core.token` - Token

##### `PATCH` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `model` (object)
    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
    >
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - reputation
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `model` (object)
        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
        >
        > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
        > - `authentik_events.event` - Event
        > - `authentik_events.notificationtransport` - Notification Transport
        > - `authentik_events.notification` - Notification
        > - `authentik_events.notificationrule` - Notification Rule
        > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
        > - `authentik_flows.flow` - Flow
        > - `authentik_flows.flowstagebinding` - Flow Stage Binding
        > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
        > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
        > - `authentik_outposts.outpost` - outpost
        > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
        > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
        > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
        > - `authentik_policies_expression.expressionpolicy` - Expression Policy
        > - `authentik_policies_password.passwordpolicy` - Password Policy
        > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
        > - `authentik_policies_reputation.reputation` - reputation
        > - `authentik_policies.policybinding` - Policy Binding
        > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
        > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
        > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
        > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
        > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
        > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
        > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
        > - `authentik_providers_radius.radiusprovider` - Radius Provider
        > - `authentik_providers_saml.samlprovider` - SAML Provider
        > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
        > - `authentik_providers_scim.scimprovider` - SCIM Provider
        > - `authentik_providers_scim.scimmapping` - SCIM Mapping
        > - `authentik_sources_ldap.ldapsource` - LDAP Source
        > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
        > - `authentik_sources_oauth.oauthsource` - OAuth Source
        > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
        > - `authentik_sources_plex.plexsource` - Plex Source
        > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
        > - `authentik_sources_saml.samlsource` - SAML Source
        > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
        > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
        > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
        > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
        > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
        > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
        > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
        > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
        > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
        > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
        > - `authentik_stages_captcha.captchastage` - Captcha Stage
        > - `authentik_stages_consent.consentstage` - Consent Stage
        > - `authentik_stages_consent.userconsent` - User Consent
        > - `authentik_stages_deny.denystage` - Deny Stage
        > - `authentik_stages_dummy.dummystage` - Dummy Stage
        > - `authentik_stages_email.emailstage` - Email Stage
        > - `authentik_stages_identification.identificationstage` - Identification Stage
        > - `authentik_stages_invitation.invitationstage` - Invitation Stage
        > - `authentik_stages_invitation.invitation` - Invitation
        > - `authentik_stages_password.passwordstage` - Password Stage
        > - `authentik_stages_prompt.prompt` - Prompt
        > - `authentik_stages_prompt.promptstage` - Prompt Stage
        > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
        > - `authentik_stages_user_login.userloginstage` - User Login Stage
        > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
        > - `authentik_stages_user_write.userwritestage` - User Write Stage
        > - `authentik_tenants.tenant` - Tenant
        > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
        > - `authentik_core.group` - group
        > - `authentik_core.user` - User
        > - `authentik_core.application` - Application
        > - `authentik_core.token` - Token

##### `GET` /outposts/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `mfa_support` (boolean)

        > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

    - Changed property `uid_start_number` (integer)

        > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

    - Changed property `gid_start_number` (integer)
        > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Added property `model` (object)
    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
    >
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies_reputation.reputation` - reputation
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
    > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
    > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_tenants.tenant` - Tenant
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `model` (object)
        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
        >
        > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
        > - `authentik_events.event` - Event
        > - `authentik_events.notificationtransport` - Notification Transport
        > - `authentik_events.notification` - Notification
        > - `authentik_events.notificationrule` - Notification Rule
        > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
        > - `authentik_flows.flow` - Flow
        > - `authentik_flows.flowstagebinding` - Flow Stage Binding
        > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
        > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
        > - `authentik_outposts.outpost` - outpost
        > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
        > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
        > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
        > - `authentik_policies_expression.expressionpolicy` - Expression Policy
        > - `authentik_policies_password.passwordpolicy` - Password Policy
        > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
        > - `authentik_policies_reputation.reputation` - reputation
        > - `authentik_policies.policybinding` - Policy Binding
        > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
        > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
        > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
        > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
        > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
        > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
        > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
        > - `authentik_providers_radius.radiusprovider` - Radius Provider
        > - `authentik_providers_saml.samlprovider` - SAML Provider
        > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
        > - `authentik_providers_scim.scimprovider` - SCIM Provider
        > - `authentik_providers_scim.scimmapping` - SCIM Mapping
        > - `authentik_sources_ldap.ldapsource` - LDAP Source
        > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
        > - `authentik_sources_oauth.oauthsource` - OAuth Source
        > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
        > - `authentik_sources_plex.plexsource` - Plex Source
        > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
        > - `authentik_sources_saml.samlsource` - SAML Source
        > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
        > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
        > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
        > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
        > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
        > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
        > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
        > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
        > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
        > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
        > - `authentik_stages_captcha.captchastage` - Captcha Stage
        > - `authentik_stages_consent.consentstage` - Consent Stage
        > - `authentik_stages_consent.userconsent` - User Consent
        > - `authentik_stages_deny.denystage` - Deny Stage
        > - `authentik_stages_dummy.dummystage` - Dummy Stage
        > - `authentik_stages_email.emailstage` - Email Stage
        > - `authentik_stages_identification.identificationstage` - Identification Stage
        > - `authentik_stages_invitation.invitationstage` - Invitation Stage
        > - `authentik_stages_invitation.invitation` - Invitation
        > - `authentik_stages_password.passwordstage` - Password Stage
        > - `authentik_stages_prompt.prompt` - Prompt
        > - `authentik_stages_prompt.promptstage` - Prompt Stage
        > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
        > - `authentik_stages_user_login.userloginstage` - User Login Stage
        > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
        > - `authentik_stages_user_write.userwritestage` - User Write Stage
        > - `authentik_tenants.tenant` - Tenant
        > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
        > - `authentik_core.group` - group
        > - `authentik_core.user` - User
        > - `authentik_core.application` - Application
        > - `authentik_core.token` - Token

##### `GET` /policies/event_matcher/

###### Parameters:

Added: `model` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Added property `model` (object)
            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
            >
            > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
            > - `authentik_events.event` - Event
            > - `authentik_events.notificationtransport` - Notification Transport
            > - `authentik_events.notification` - Notification
            > - `authentik_events.notificationrule` - Notification Rule
            > - `authentik_events.notificationwebhookmapping` - Webhook Mapping
            > - `authentik_flows.flow` - Flow
            > - `authentik_flows.flowstagebinding` - Flow Stage Binding
            > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
            > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
            > - `authentik_outposts.outpost` - outpost
            > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
            > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
            > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
            > - `authentik_policies_expression.expressionpolicy` - Expression Policy
            > - `authentik_policies_password.passwordpolicy` - Password Policy
            > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
            > - `authentik_policies_reputation.reputation` - reputation
            > - `authentik_policies.policybinding` - Policy Binding
            > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
            > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
            > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
            > - `authentik_providers_oauth2.authorizationcode` - Authorization Code
            > - `authentik_providers_oauth2.accesstoken` - OAuth2 Access Token
            > - `authentik_providers_oauth2.refreshtoken` - OAuth2 Refresh Token
            > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
            > - `authentik_providers_radius.radiusprovider` - Radius Provider
            > - `authentik_providers_saml.samlprovider` - SAML Provider
            > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
            > - `authentik_providers_scim.scimprovider` - SCIM Provider
            > - `authentik_providers_scim.scimmapping` - SCIM Mapping
            > - `authentik_sources_ldap.ldapsource` - LDAP Source
            > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
            > - `authentik_sources_oauth.oauthsource` - OAuth Source
            > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
            > - `authentik_sources_plex.plexsource` - Plex Source
            > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
            > - `authentik_sources_saml.samlsource` - SAML Source
            > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
            > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
            > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
            > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
            > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
            > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Stage
            > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
            > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
            > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
            > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
            > - `authentik_stages_captcha.captchastage` - Captcha Stage
            > - `authentik_stages_consent.consentstage` - Consent Stage
            > - `authentik_stages_consent.userconsent` - User Consent
            > - `authentik_stages_deny.denystage` - Deny Stage
            > - `authentik_stages_dummy.dummystage` - Dummy Stage
            > - `authentik_stages_email.emailstage` - Email Stage
            > - `authentik_stages_identification.identificationstage` - Identification Stage
            > - `authentik_stages_invitation.invitationstage` - Invitation Stage
            > - `authentik_stages_invitation.invitation` - Invitation
            > - `authentik_stages_password.passwordstage` - Password Stage
            > - `authentik_stages_prompt.prompt` - Prompt
            > - `authentik_stages_prompt.promptstage` - Prompt Stage
            > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
            > - `authentik_stages_user_login.userloginstage` - User Login Stage
            > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
            > - `authentik_stages_user_write.userwritestage` - User Write Stage
            > - `authentik_tenants.tenant` - Tenant
            > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
            > - `authentik_core.group` - group
            > - `authentik_core.user` - User
            > - `authentik_core.application` - Application
            > - `authentik_core.token` - Token

##### `GET` /providers/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `mfa_support` (boolean)

        > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

    - Changed property `uid_start_number` (integer)

        > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

    - Changed property `gid_start_number` (integer)
        > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `PUT` /providers/ldap/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `mfa_support` (boolean)

    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

- Changed property `uid_start_number` (integer)

    > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

- Changed property `gid_start_number` (integer)
    > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `mfa_support` (boolean)

        > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

    - Changed property `uid_start_number` (integer)

        > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

    - Changed property `gid_start_number` (integer)
        > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `PATCH` /providers/ldap/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `mfa_support` (boolean)

    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

- Changed property `uid_start_number` (integer)

    > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

- Changed property `gid_start_number` (integer)
    > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `mfa_support` (boolean)

        > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

    - Changed property `uid_start_number` (integer)

        > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

    - Changed property `gid_start_number` (integer)
        > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `GET` /sources/ldap/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `client_certificate` (string)

        > Client certificate to authenticate against the LDAP Server's Certificate.

    - Added property `sni` (boolean)

##### `PUT` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `client_certificate` (string)

    > Client certificate to authenticate against the LDAP Server's Certificate.

- Added property `sni` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `client_certificate` (string)

        > Client certificate to authenticate against the LDAP Server's Certificate.

    - Added property `sni` (boolean)

##### `PATCH` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `client_certificate` (string)

    > Client certificate to authenticate against the LDAP Server's Certificate.

- Added property `sni` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `client_certificate` (string)

        > Client certificate to authenticate against the LDAP Server's Certificate.

    - Added property `sni` (boolean)

##### `GET` /sources/saml/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `verification_kp` (string)

        > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

    - Changed property `signing_kp` (string)
        > Keypair used to sign outgoing Responses going to the Identity Provider.

##### `PUT` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `verification_kp` (string)

    > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

- Changed property `signing_kp` (string)
    > Keypair used to sign outgoing Responses going to the Identity Provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `verification_kp` (string)

        > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

    - Changed property `signing_kp` (string)
        > Keypair used to sign outgoing Responses going to the Identity Provider.

##### `PATCH` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `verification_kp` (string)

    > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

- Changed property `signing_kp` (string)
    > Keypair used to sign outgoing Responses going to the Identity Provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `verification_kp` (string)

        > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

    - Changed property `signing_kp` (string)
        > Keypair used to sign outgoing Responses going to the Identity Provider.

##### `GET` /core/tokens/

###### Parameters:

Changed: `intent` in `query`

> - `verification` - Intent Verification
> - `api` - Intent Api
> - `recovery` - Intent Recovery
> - `app_password` - Intent App Password

##### `GET` /events/transports/

###### Parameters:

Changed: `mode` in `query`

> - `local` - authentik inbuilt notifications
> - `webhook` - Generic Webhook
> - `webhook_slack` - Slack Webhook (Slack/Discord)
> - `email` - Email

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAPProvider Serializer
        - Added property `mfa_support` (boolean)

            > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

        - Changed property `uid_start_number` (integer)

            > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

        - Changed property `gid_start_number` (integer)
            > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `POST` /providers/ldap/

###### Request:

Changed content type : `application/json`

- Added property `mfa_support` (boolean)

    > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

- Changed property `uid_start_number` (integer)

    > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

- Changed property `gid_start_number` (integer)
    > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `mfa_support` (boolean)

        > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

    - Changed property `uid_start_number` (integer)

        > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

    - Changed property `gid_start_number` (integer)
        > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAPProvider Serializer
        - Added property `mfa_support` (boolean)

            > When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

        - Changed property `uid_start_number` (integer)

            > The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

        - Changed property `gid_start_number` (integer)
            > The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

##### `GET` /providers/saml/

###### Parameters:

Changed: `digest_algorithm` in `query`

> - `http://www.w3.org/2000/09/xmldsig#sha1` - SHA1
> - `http://www.w3.org/2001/04/xmlenc#sha256` - SHA256
> - `http://www.w3.org/2001/04/xmldsig-more#sha384` - SHA384
> - `http://www.w3.org/2001/04/xmlenc#sha512` - SHA512

Changed: `signature_algorithm` in `query`

> - `http://www.w3.org/2000/09/xmldsig#rsa-sha1` - RSA-SHA1
> - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha256` - RSA-SHA256
> - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha384` - RSA-SHA384
> - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha512` - RSA-SHA512
> - `http://www.w3.org/2000/09/xmldsig#dsa-sha1` - DSA-SHA1

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `client_certificate` (string)

    > Client certificate to authenticate against the LDAP Server's Certificate.

- Added property `sni` (boolean)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `client_certificate` (string)

        > Client certificate to authenticate against the LDAP Server's Certificate.

    - Added property `sni` (boolean)

##### `GET` /sources/ldap/

###### Parameters:

Added: `client_certificate` in `query`

Added: `sni` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAP Source Serializer
        - Added property `client_certificate` (string)

            > Client certificate to authenticate against the LDAP Server's Certificate.

        - Added property `sni` (boolean)

##### `GET` /sources/oauth/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

##### `GET` /sources/plex/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Added property `verification_kp` (string)

    > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

- Changed property `signing_kp` (string)
    > Keypair used to sign outgoing Responses going to the Identity Provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `verification_kp` (string)

        > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

    - Changed property `signing_kp` (string)
        > Keypair used to sign outgoing Responses going to the Identity Provider.

##### `GET` /sources/saml/

###### Parameters:

Added: `verification_kp` in `query`

Changed: `binding_type` in `query`

> - `REDIRECT` - Redirect Binding
> - `POST` - POST Binding
> - `POST_AUTO` - POST Binding with auto-confirmation

Changed: `digest_algorithm` in `query`

> - `http://www.w3.org/2000/09/xmldsig#sha1` - SHA1
> - `http://www.w3.org/2001/04/xmlenc#sha256` - SHA256
> - `http://www.w3.org/2001/04/xmldsig-more#sha384` - SHA384
> - `http://www.w3.org/2001/04/xmlenc#sha512` - SHA512

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

Changed: `signature_algorithm` in `query`

> - `http://www.w3.org/2000/09/xmldsig#rsa-sha1` - RSA-SHA1
> - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha256` - RSA-SHA256
> - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha384` - RSA-SHA384
> - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha512` - RSA-SHA512
> - `http://www.w3.org/2000/09/xmldsig#dsa-sha1` - DSA-SHA1

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLSource Serializer
        - Added property `verification_kp` (string)

            > When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

        - Changed property `signing_kp` (string)
            > Keypair used to sign outgoing Responses going to the Identity Provider.

##### `GET` /events/notifications/

###### Parameters:

Changed: `severity` in `query`

> - `notice` - Notice
> - `warning` - Warning
> - `alert` - Alert

##### `GET` /flows/bindings/

###### Parameters:

Changed: `policy_engine_mode` in `query`

> - `all` - all, all policies must pass
> - `any` - any, any policy must pass

##### `GET` /stages/authenticator/sms/

###### Parameters:

Changed: `auth_type` in `query`

> - `basic` - Basic
> - `bearer` - Bearer

Changed: `provider` in `query`

> - `twilio` - Twilio
> - `generic` - Generic

##### `GET` /stages/authenticator/totp/

###### Parameters:

Changed: `digits` in `query`

> - `6` - 6 digits, widely compatible
> - `8` - 8 digits, not compatible with apps like Google Authenticator

##### `GET` /stages/authenticator/validate/

###### Parameters:

Changed: `not_configured_action` in `query`

> - `skip` - Skip
> - `deny` - Deny
> - `configure` - Configure

##### `GET` /stages/authenticator/webauthn/

###### Parameters:

Changed: `authenticator_attachment` in `query`

> - `platform` - Platform
> - `cross-platform` - Cross Platform

Changed: `resident_key_requirement` in `query`

> - `discouraged` - Discouraged
> - `preferred` - Preferred
> - `required` - Required

Changed: `user_verification` in `query`

> - `required` - Required
> - `preferred` - Preferred
> - `discouraged` - Discouraged

##### `GET` /stages/consent/

###### Parameters:

Changed: `mode` in `query`

> - `always_require` - Always Require
> - `permanent` - Permanent
> - `expiring` - Expiring

##### `GET` /stages/user_write/

###### Parameters:

Changed: `user_creation_mode` in `query`

> - `never_create` - Never Create
> - `create_when_required` - Create When Required
> - `always_create` - Always Create

##### `GET` /stages/prompt/prompts/

###### Parameters:

Changed: `type` in `query`

> - `text` - Text: Simple Text input
> - `text_area` - Text area: Multiline Text Input.
> - `text_read_only` - Text (read-only): Simple Text input, but cannot be edited.
> - `text_area_read_only` - Text area (read-only): Multiline Text input, but cannot be edited.
> - `username` - Username: Same as Text input, but checks for and prevents duplicate usernames.
> - `email` - Email: Text field with Email type.
> - `password` - Password: Masked input, multiple inputs of this type on the same prompt need to be identical.
> - `number` - Number
> - `checkbox` - Checkbox
> - `radio-button-group` - Fixed choice field rendered as a group of radio buttons.
> - `dropdown` - Fixed choice field rendered as a dropdown.
> - `date` - Date
> - `date-time` - Date Time
> - `file` - File: File upload for arbitrary files. File content will be available in flow context as data-URI
> - `separator` - Separator: Static Separator Line
> - `hidden` - Hidden: Hidden field, can be used to insert data into form.
> - `static` - Static: Static value, displayed as-is.
> - `ak-locale` - authentik: Selection of locales authentik supports

---

## Release 2023.8

## Breaking changes

- Removal of PostgreSQL 11 support

  As announced in the [2023.5](./v2023.5.mdx) release notes (and postponed by a release), this release requires PostgreSQL 12 or newer. This is due to a changed requirement in a framework we use, Django.

  This does not affect docker-compose installations (as these already ship with PostgreSQL 12), however it is still recommended to upgrade to a newer version when convenient.

  For Kubernetes install, a manual one-time migration has to be done: [Upgrading PostgreSQL on Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.mdx)

- Changed nested Group membership behavior

  In previous versions, nested groups were handled very inconsistently. Binding a group to an application/etc would check the membership recursively, however when using `user.ak_groups.all()` would only return direct memberships. Additionally, using `user.group_attributes()` would do the same and only merge all group attributes for direct memberships.

  This has been changed to always use the same logic as when checking for access, which means dealing with complex group structures is a lot more consistent.

  Policies that do use `user.ak_groups.all()` will retain the current behavior, to use the new behavior replace the call with `user.all_groups()`.

## New features

- Enterprise (preview)

  This is the first release to include the *Enterprise* section, where you can acquire a license in our Customer Portal and get enterprise licenses for your authentik instance. See more info [here](../../enterprise/index.mdx)

- Config reloading

  For better security and to better support running in a cloud-native environment, authentik now supports dynamic PostgreSQL and Email credentials. In previous versions, both the authentik server and worker containers required restarting to detect the new credentials. In 2023.8, these credentials are automatically refreshed just before they are used. This means you can use something like [Hashicorp Vault](https://vaultproject.io) to manage short-term credentials that are rotated once a day or even more frequently without needing to restart authentik.

## Upgrading

This release changes the PostgreSQL dependency to require Version 12 or later, which only affects Kubernetes installs. See [here](../../troubleshooting/postgres/upgrade_kubernetes.mdx) for more info on upgrading.

### docker-compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2023.8/docker-compose.yml
docker-compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Update your values to use the new images:

```yaml
image:
    repository: ghcr.io/goauthentik/server
    tag: 2023.8.0
```

## Minor changes/fixes

- \*: fix api errors raised in general validate() to specify a field (#6663)
- api: optimize pagination in API schema (#6478)
- blueprints: fix blueprint importer logging potentially sensitive data (#6567)
- blueprints: fix tag values not resolved correctly (#6653)
- blueprints: prevent duplicate password stage in default flow when using combined identification stage (#6432)
- core: bump django from 4.1.7 to 4.2 (#5238)
- core: fix UUID filter field for users api (#6203)
- core: fix filtering users by type attribute (#6638)
- core: rework recursive group membership (#6017)
- enterprise: add more info to enterprise forecast (#6292)
- enterprise: initial enterprise (#5721)
- events: fix authentik\_system\_tasks metric status label (#6252)
- events: fix monitored task not removing state (#6386)
- outposts/ldap: add more tests (#6188)
- outposts/ldap: add test for attribute filtering (#6189)
- outposts: Fix infinite self-recursion in traefik reconciler (#6336)
- outposts: fix Kubernetes patch processing (#6338)
- outposts: make metrics compliant with Prometheus best-practices (#6398)
- outposts: support json patch for Kubernetes (#6319)
- providers/oauth2: fix aud (Audience) field type which can be a list of… (#6447)
- providers/oauth2: fix grant\_type password raising an exception (#6333)
- providers/oauth2: fix id\_token being saved incorrectly leading to lost claims (#6645)
- providers/proxy: fix JWKS URL in embedded outpost (#6644)
- providers/proxy: only intercept auth header when a value is set (#6488)
- providers/proxy: set outpost session cookie to httponly and secure wh… (#6482)
- root: always use persistent database connections (#6560)
- root: config: config discovery parity between Go and Python
- root: config: remove redundant default configs
- root: migrate bootstrap to blueprints (#6433)
- root: partial Live-updating config (#5959)
- root: replace builtin psycopg libpq binary implementation with distro… (#6448)
- root: set csrf cookie's secure flag same as session (#6350)
- sources/ldap: check nsaccountlock for FreeIPA/389-ds (#6270)
- sources/ldap: fix ldap\_sync cli command not running in foreground (#6325)
- sources/ldap: fix syncing large LDAP directories (#6384)
- stages/authenticator\_static: make static token size adjustable (#6565)
- web/admin: adjust style of page header (#6355)
- web/admin: fix EventMatcherPolicyForm empty values (#6539)
- web/admin: fix admin overview layout (#6220)
- web/admin: fix user sorting by active field (#6485)
- web/admin: hide pagination when no data is loaded yet (#6353)
- web/admin: make version clickable for stable releases (#6626)
- web/admin: only show token expiry when token is set to expire (#6643)
- web/admin: set required flag to false for user attributes (#6418)
- web/common: make API errors more prominent in developer tools (#6637)
- web/elements: improve table error handling, prevent infinite loading … (#6636)
- web/flows: fix identification stage band color (#6489)
- web/flows: update flow background (#6579)
- web/user: fix alignment between image icons and fallback text icons (#6416)
- web/user: fix app icon size for user interface
- web/user: fix background alignment (#6383)
- web/user: fix user settings colors on dark theme (#6499)
- web/user: fix user settings elements not being in cards (#6608)
- web/user: only render expand element when required (#6641)
- web: fix app icon rendering, style refinements (#6409)
- web: refactor locale handler into top-level context handler (#6022)
- web: replace deprecated terser rollup plugin, remove unused plugin (#6615)
- web: rework and expand tooltips (#6435)

## Fixed in 2023.8.1

- blueprints: fix policy exception causing password stage to be skipped after upgrade (#6674)
- root: revert persistent connections causing postgres out of connections errors (#6677)
- web: fix notification drawer scrolling (#6675)
- web/admin: fix version link to release notes (#6676)

## Fixed in 2023.8.2

- core: make groups' parent\_name nullable as it might not be set (#6700)
- crypto: fix certificate has\_key filter (#6727)
- events: fix missing application names from most used applications (#6689)
- policies/reputation: fix reputation not expiring (#6714)
- providers/oauth2: fix incorrect scope permissions shown (#6696)
- providers/saml: fix SAML metadata import API requiring flow slug inst… (#6729)
- root: expand exception logging (#6690)
- web/admin: clear other options depending on what the binding targets (#6703)
- web/admin: fix ak-toggle-group for policy and blueprint uses (#6687)

## Fixed in 2023.8.3

- core: bump celery from 5.3.1 to 5.3.4
- core: bump django from 4.2.4 to 4.2.5 (#6751)
- core: remove celery's duplicate max\_tasks\_per\_child (#6840)
- policies/reputation: require either check to be enabled (#6764)
- providers/scim: check that a provider exists before starting scim task (#6841)
- root: fix broken celery dependency (#6744)
- root: lock node to 20.5 (#6776)
- sources/ldap: don't prefetch useless items (#6812)
- sources/ldap: fix FreeIPA nsaccountlock sync (#6745)
- sources/ldap: fix task timeout for ldap\_sync\_all and ldap\_sync\_single (#6809)
- stages/password: fix failed\_attempts\_before\_cancel allowing one too m… (#6763)
- web/admin: fix application icon size (#6738)
- web/admin: fix not being able to unset flows (#6838)
- web/admin: fix not being able to unset certificates (#6767)
- web: don't import entire SourceViewPage in flow and user interface (#6761)
- web: replace ampersand (#6737)

## Fixed in 2023.8.4

- security: fix [CVE-2023-46249](../../security/cves/CVE-2023-46249.mdx), Reported by [@devSparkle](https://github.com/devSparkle)

## Fixed in 2023.8.5

- security: fix [CVE-2023-48228](../../security/cves/CVE-2023-48228.mdx), Reported by [@Sapd](https://github.com/Sapd) (#7666)

## Fixed in 2023.8.6

- providers/oauth2: fix [CVE-2024-21637](../../security/cves/CVE-2024-21637.mdx), Reported by [@lauritzh](https://github.com/lauritzh) (#8104)

## Fixed in 2023.8.7

- providers/oauth2: fix [CVE-2024-23647](../../security/cves/CVE-2024-23647.mdx) (cherry-pick #8345) (#8347)

## API Changes

#### What's New

***

##### `GET` /enterprise/license/

##### `POST` /enterprise/license/

##### `GET` /enterprise/license/\{license\_uuid}/

##### `PUT` /enterprise/license/\{license\_uuid}/

##### `DELETE` /enterprise/license/\{license\_uuid}/

##### `PATCH` /enterprise/license/\{license\_uuid}/

##### `GET` /enterprise/license/\{license\_uuid}/used\_by/

##### `GET` /enterprise/license/forecast/

##### `GET` /enterprise/license/get\_install\_id/

##### `GET` /enterprise/license/summary/

#### What's Changed

***

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Removed enum value:

    - `authentik.lib`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Removed enum value:

  - `authentik.lib`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Removed enum value:

    - `authentik.lib`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Removed enum value:

  - `authentik.lib`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Removed enum value:

    - `authentik.lib`

##### `GET` /schema/

###### Parameters:

Changed: `lang` in `query`

##### `GET` /core/tenants/

###### Parameters:

Changed: `branding_favicon` in `query`

Changed: `branding_logo` in `query`

Changed: `branding_title` in `query`

Changed: `default` in `query`

Changed: `domain` in `query`

Changed: `event_retention` in `query`

Changed: `flow_authentication` in `query`

Changed: `flow_device_code` in `query`

Changed: `flow_invalidation` in `query`

Changed: `flow_recovery` in `query`

Changed: `flow_unenrollment` in `query`

Changed: `flow_user_settings` in `query`

Changed: `tenant_uuid` in `query`

Changed: `web_certificate` in `query`

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)

      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

      Enum values:

      - `internal`
      - `external`
      - `service_account`
      - `internal_service_account`

##### `PUT` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `PATCH` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `type` (string)
    > - `internal` - Internal
    > - `external` - External
    > - `service_account` - Service Account
    > - `internal_service_account` - Internal Service Account

##### `PUT` /core/users/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `type` (string)
  > - `internal` - Internal
  > - `external` - External
  > - `service_account` - Service Account
  > - `internal_service_account` - Internal Service Account

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `type` (string)
    > - `internal` - Internal
    > - `external` - External
    > - `service_account` - Service Account
    > - `internal_service_account` - Internal Service Account

##### `PATCH` /core/users/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `type` (string)
  > - `internal` - Internal
  > - `external` - External
  > - `service_account` - Service Account
  > - `internal_service_account` - Internal Service Account

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `type` (string)
    > - `internal` - Internal
    > - `external` - External
    > - `service_account` - Service Account
    > - `internal_service_account` - Internal Service Account

##### `GET` /crypto/certificatekeypairs/

###### Parameters:

Changed: `managed` in `query`

Changed: `name` in `query`

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.events` - authentik Events
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.tenants` - authentik Tenants
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise

  Removed enum value:

  - `authentik.lib`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.events` - authentik Events
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.tenants` - authentik Tenants
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise

    Removed enum value:

    - `authentik.lib`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > - `authentik.admin` - authentik Admin
      > - `authentik.api` - authentik API
      > - `authentik.crypto` - authentik Crypto
      > - `authentik.events` - authentik Events
      > - `authentik.flows` - authentik Flows
      > - `authentik.outposts` - authentik Outpost
      > - `authentik.policies.dummy` - authentik Policies.Dummy
      > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
      > - `authentik.policies.expiry` - authentik Policies.Expiry
      > - `authentik.policies.expression` - authentik Policies.Expression
      > - `authentik.policies.password` - authentik Policies.Password
      > - `authentik.policies.reputation` - authentik Policies.Reputation
      > - `authentik.policies` - authentik Policies
      > - `authentik.providers.ldap` - authentik Providers.LDAP
      > - `authentik.providers.oauth2` - authentik Providers.OAuth2
      > - `authentik.providers.proxy` - authentik Providers.Proxy
      > - `authentik.providers.radius` - authentik Providers.Radius
      > - `authentik.providers.saml` - authentik Providers.SAML
      > - `authentik.providers.scim` - authentik Providers.SCIM
      > - `authentik.recovery` - authentik Recovery
      > - `authentik.sources.ldap` - authentik Sources.LDAP
      > - `authentik.sources.oauth` - authentik Sources.OAuth
      > - `authentik.sources.plex` - authentik Sources.Plex
      > - `authentik.sources.saml` - authentik Sources.SAML
      > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
      > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
      > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
      > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
      > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
      > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
      > - `authentik.stages.captcha` - authentik Stages.Captcha
      > - `authentik.stages.consent` - authentik Stages.Consent
      > - `authentik.stages.deny` - authentik Stages.Deny
      > - `authentik.stages.dummy` - authentik Stages.Dummy
      > - `authentik.stages.email` - authentik Stages.Email
      > - `authentik.stages.identification` - authentik Stages.Identification
      > - `authentik.stages.invitation` - authentik Stages.User Invitation
      > - `authentik.stages.password` - authentik Stages.Password
      > - `authentik.stages.prompt` - authentik Stages.Prompt
      > - `authentik.stages.user_delete` - authentik Stages.User Delete
      > - `authentik.stages.user_login` - authentik Stages.User Login
      > - `authentik.stages.user_logout` - authentik Stages.User Logout
      > - `authentik.stages.user_write` - authentik Stages.User Write
      > - `authentik.tenants` - authentik Tenants
      > - `authentik.blueprints` - authentik Blueprints
      > - `authentik.core` - authentik Core
      > - `authentik.enterprise` - authentik Enterprise

      Removed enum value:

      - `authentik.lib`

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      - Added property `type` (string)
        > - `internal` - Internal
        > - `external` - External
        > - `service_account` - Service Account
        > - `internal_service_account` - Internal Service Account

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `POST` /core/users/

###### Request:

Changed content type : `application/json`

- Added property `type` (string)
  > - `internal` - Internal
  > - `external` - External
  > - `service_account` - Service Account
  > - `internal_service_account` - Internal Service Account

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `type` (string)
    > - `internal` - Internal
    > - `external` - External
    > - `service_account` - Service Account
    > - `internal_service_account` - Internal Service Account

##### `GET` /core/users/

###### Parameters:

Added: `type` in `query`

> - `internal` - Internal
> - `external` - External
> - `service_account` - Service Account
> - `internal_service_account` - Internal Service Account

Changed: `uuid` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /core/users/me/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer for information a user can retrieve about themselves

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Added property `type` (string)
      > - `internal` - Internal
      > - `external` - External
      > - `service_account` - Service Account
      > - `internal_service_account` - Internal Service Account

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      - Added property `type` (string)
        > - `internal` - Internal
        > - `external` - External
        > - `service_account` - Service Account
        > - `internal_service_account` - Internal Service Account

##### `GET` /stages/authenticator/static/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `token_length` (integer)

  - Changed property `token_count` (integer)

##### `PUT` /stages/authenticator/static/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `token_length` (integer)

- Changed property `token_count` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `token_length` (integer)

  - Changed property `token_count` (integer)

##### `PATCH` /stages/authenticator/static/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `token_length` (integer)

- Changed property `token_count` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `token_length` (integer)

  - Changed property `token_count` (integer)

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `user` (object)

      > User Serializer

      - Added property `type` (string)
        > - `internal` - Internal
        > - `external` - External
        > - `service_account` - Service Account
        > - `internal_service_account` - Internal Service Account

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      - Added property `type` (string)
        > - `internal` - Internal
        > - `external` - External
        > - `service_account` - Service Account
        > - `internal_service_account` - Internal Service Account

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `user` (object)

      > User Serializer

      - Added property `type` (string)
        > - `internal` - Internal
        > - `external` - External
        > - `service_account` - Service Account
        > - `internal_service_account` - Internal Service Account

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      - Added property `type` (string)
        > - `internal` - Internal
        > - `external` - External
        > - `service_account` - Service Account
        > - `internal_service_account` - Internal Service Account

##### `POST` /stages/authenticator/static/

###### Request:

Changed content type : `application/json`

- Added property `token_length` (integer)

- Changed property `token_count` (integer)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `token_length` (integer)

  - Changed property `token_count` (integer)

##### `GET` /stages/authenticator/static/

###### Parameters:

Added: `token_length` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorStaticStage Serializer

    - Added property `token_length` (integer)

    - Changed property `token_count` (integer)

---

## Release 2024.10

## Highlights

- **Chrome Device Trust**   : Verify that your users are logging in from managed devices and validate the devices' compliance with company policies.
- **FIPS/FAL3 for FedRAMP "very high" compliance**  : with support for SAML encryption and now JWE (JSON Web Encryption) support, authentik can now be configured for FIPS compliance at Federation Assurance Level (FAL) 3.
- **Captcha on Identification stage**: Run a CAPTCHA process in the background while the user is entering their identification.
- **Kerberos source**: authentik can now integrate with existing Kerberos environments by allowing users to log in with their Kerberos credentials, SPNEGO, or syncing users into authentik.

## Breaking changes

We have no breaking changes this release!

## New features

- **Chrome Device Trust** &#x20;

  This is a new stage for Enterprise clients that verifies the user through the Chrome Verified Access API. This stage only works with Google Chrome. You'll need to bring your own [Verified Access API instance](https://developers.google.com/chrome/verified-access/overview) via Google Cloud.

- **JWE support for OAuth**

  You can now configure JSON Web Encryption with the OAuth 2.0 Provider, which will encrypt all the tokens created by authentik, using the configured encryption key.

- **Captcha on identification stage**

  We've added an optional Captcha stage baked into an Identification stage to run in the background while the user inputs their information. Using this will hopefully result in lower total time per flow for the end user.

- **Invalidation flows for providers**

  The sign-out experience when the session in an application ends can be configured now. Previously where this was always a static page, any flow can be used now. This can be used for additional validation, or redirecting the user to a custom URL.

- **Autoselect 2FA device**

  Users who configure multiple 2FA devices will now land on their last used device's prompt, skipping the device picker. This should result in lower total average time per flow for the end user.

- **New structure for authentik's technical documentation**

  We've restructured the documentation in authentik to be more task-based, with sections, titles, and headings that follow the workflow of installing, configuring, and using the product. Previously, our docs were organized by components. This new focus on tasks increases findability within the Table of Contents, and provide a high-level guide of the typical workflows with authentik.

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2024.10/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.10
```

## Minor changes/fixes

- \*: fix deprecated calls to sentry start\_span (#11655)
- admin: refactor update check (#11272)
- admin: store version history (#11520)
- blueprints: fix validation error when using internal storage (#11654)
- core: ensure all providers have correct priority (#11280)
- core: ensure proxy provider is correctly looked up (#11267)
- core: extract object matching from flow manager (#11458)
- core: fix change\_user\_type always requiring usernames (#11177)
- core: fix missing argument name escaping for property mapping (#11231)
- core: fix permission check for scoped impersonation (#11315)
- core: fix permission check for scoped impersonation (#11603)
- enterprise: fix API mixin license validity check (#11331)
- enterprise: fix incorrect comparison for latest validity date (#11109)
- enterprise: show specific error if Install ID is invalid in license (#11317)
- events: always use expiry from current tenant for events, not only when creating from HTTP request (#11415)
- events: optimize marking events as seen (#11297)
- fix: proxy provider - docker traefik label (#11460)
- flows: include Outpost instance in flow context and save in login event (#11318)
- flows: provider invalidation (#5048)
- internal: fix go paginator not setting page correctly (#11253)
- internal: restore /ping behavior for embedded outpost (#11568)
- policies/event\_matcher: fix inconsistent behavior (#11724)
- providers/ldap: fix incorrect permission check for search access (#11217)
- providers/ldap: fix migration assuming search group is set (#11170)
- providers/ldap: rework search\_group migration to work with read replicas (#11228)
- providers/oauth2: add indexes on tokens (#11524)
- providers/oauth2: add initial JWE support (#11344)
- providers/oauth2: audit\_ignore last\_login change for generated service account (#11085)
- providers/oauth2: don't overwrite attributes when updating service account (#11709)
- providers/oauth2: improve indexes on tokens (#11543)
- providers/proxy: fix URL path getting lost when partial URL is given to rd= (#11354)
- providers/proxy: fix panic, keep session storages open (#11439)
- providers/saml: fix incorrect ds URI (#11699)
- providers/scim: add option to ignore SCIM server cert (#11437)
- root: fix ensure \`outpost\_connection\_discovery runs on worker startup (#11260)
- schemas: fix XML Schema loading...for some reason?
- security: fix CVE-2024-47070 (#11536)
- security: fix CVE-2024-47077 (#11535)
- sources/ldap: fix mapping check, fix debug endpoint (#11442)
- sources/ldap: fix missing search attribute (#11125)
- sources/ldap: fix ms\_ad userAccountControl not checking for lockout (#11532)
- sources/saml: fix NameIDFormat descriptor in metadata generation (#11614)
- stages/authenticator: use RBAC for devices API (#11482)
- stages/identification: dynamically find login challenges (#11571)
- stages/password: add error message when exceeding maximum tries (#11679)
- tests/e2e: add forward auth e2e test (#11374)
- web/admin: display webauthn device type (#11481)
- web/admin: fix Authentication flow being required (#11496)
- web/admin: fix duplicate flow labels (#11689)
- web/admin: fix error in Outpost creation form (#11173)
- web/admin: fix invalid create date shown for MFA registered before date was saved (#11728)
- web/admin: fix misc dual select on different forms (#11203)
- web/admin: fix missing Sync object button SCIM Provider (#11211)
- web/admin: fix notification property mapping forms (#11298)
- web/admin: fix sync single button throwing error (#11727)
- web/admin: improve error handling (#11212)
- web/users: show - if device was registered before we started saving the time (#11256)
- web: Adjust Wdio MaxInstances, add Knip (#11089)
- web: Fix css loading in unit tests, remove unneeded dot paths (#11629)
- web: add missing id attribute for button in ak-flow-input-password (#11413)
- web: audit and update package.json and associated test harness, with upgrade to WebdriverIO 9 (#11596)
- web: fix dual-select with dynamic selection (#11133)
- web: fix e2e tests to work with latest WebdriverIO and authentik 2024.8 (#11105)
- web: fix readonly fields appearing white in dark theme (#11271)
- web: provide simple tables for API-less displays (#11028)
- web: provide storybook demos and docs for existing tests (#11651)
- web: revert lockfile lint, re-add integrity (#11380)
- web: small fixes for elements and forms (#11546)

## Fixed in 2024.10.1

- core: add `None` check to a device's `extra_description` (cherry-pick #11904) (#11906)
- enterprise/rac: fix API Schema for invalidation\_flow (cherry-pick #11907) (#11908)
- providers/oauth2: fix size limited index for tokens (cherry-pick #11879) (#11905)
- web: fix missing status code on failed build (#11903)

## Fixed in 2024.10.2

- blueprints: add default Password policy (cherry-pick #11793) (#11993)
- core: use versioned\_script for path only (cherry-pick #12003) (#12023)
- crypto: validate that generated certificate's name is unique (cherry-pick #12015) (#12016)
- providers/oauth2: fix manual device code entry (cherry-pick #12017) (#12019)
- providers/proxy: fix Issuer when AUTHENTIK\_HOST\_BROWSER is set (cherry-pick #11968) (#12005)
- stages/captcha: Run interactive captcha in Frame (cherry-pick #11857) (#11991)
- stages/password: use recovery flow from brand (cherry-pick #11953) (#11969)
- web: bump API Client version (#11992)

## Fixed in 2024.10.3

- core: fix source\_flow\_manager throwing error when authenticated user attempts to re-authenticate with existing link (cherry-pick #12080) (#12081)
- internal: add CSP header to files in `/media` (cherry-pick #12092) (#12108)
- providers/ldap: fix global search\_full\_directory permission not being sufficient (cherry-pick #12028) (#12030)
- providers/scim: accept string and int for SCIM IDs (cherry-pick #12093) (#12095)
- rbac: fix incorrect object\_description for object-level permissions (cherry-pick #12029) (#12043)
- root: check remote IP for proxy protocol same as HTTP/etc (cherry-pick #12094) (#12097)
- root: fix activation of locale not being scoped (cherry-pick #12091) (#12096)
- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.mdx), reported by [@matt1097](https://github.com/matt1097) (#12117)
- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.mdx), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113)
- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.mdx), reported by [@mgerstner](https://github.com/mgerstner) (#12115)
- web/admin: better footer links (#12004)
- web/flows: fix invisible captcha call (cherry-pick #12048) (#12049)
- website/docs: add CSP to hardening (cherry-pick #11970) (#12116)

## Fixed in 2024.10.4

- providers/oauth2: fix migration (cherry-pick #12138) (#12139)
- providers/oauth2: fix migration dependencies (cherry-pick #12123) (#12132)
- providers/oauth2: fix redirect uri input (cherry-pick #12122) (#12127)
- providers/proxy: fix redirect\_uri (cherry-pick #12121) (#12125)

## Fixed in 2024.10.5

- enterprise: allow deletion/modification of users when in read-only mode (#12289)
- enterprise/stages/authenticator\_endpoint\_gdtc: don't set frame options globally (cherry-pick #12311) (#12315)
- flows: better test stage's challenge responses (cherry-pick #12316) (#12317)
- root: fix database ssl options not set correctly (cherry-pick #12180) (#12183)
- stages/identification: fix invalid challenge warning when no captcha stage is set (cherry-pick #12312) (#12314)
- web: backport fix impersonate api (#12184)
- web/flows: resize captcha iframes (cherry-pick #12260) (#12304)

## API Changes

### API Changes in 2024.10.0

#### What's New

***

##### `GET` /admin/version/history/

##### `GET` /admin/version/history/\{id}/

##### `GET` /authenticators/admin/endpoint/

##### `POST` /authenticators/admin/endpoint/

##### `GET` /authenticators/admin/endpoint/\{uuid}/

##### `PUT` /authenticators/admin/endpoint/\{uuid}/

##### `DELETE` /authenticators/admin/endpoint/\{uuid}/

##### `PATCH` /authenticators/admin/endpoint/\{uuid}/

##### `GET` /authenticators/endpoint/

##### `GET` /authenticators/endpoint/\{uuid}/

##### `GET` /authenticators/endpoint/\{uuid}/used\_by/

##### `GET` /propertymappings/source/kerberos/

##### `POST` /propertymappings/source/kerberos/

##### `GET` /propertymappings/source/kerberos/\{pm\_uuid}/

##### `PUT` /propertymappings/source/kerberos/\{pm\_uuid}/

##### `DELETE` /propertymappings/source/kerberos/\{pm\_uuid}/

##### `PATCH` /propertymappings/source/kerberos/\{pm\_uuid}/

##### `GET` /propertymappings/source/kerberos/\{pm\_uuid}/used\_by/

##### `GET` /sources/group\_connections/kerberos/

##### `GET` /sources/group\_connections/kerberos/\{id}/

##### `PUT` /sources/group\_connections/kerberos/\{id}/

##### `DELETE` /sources/group\_connections/kerberos/\{id}/

##### `PATCH` /sources/group\_connections/kerberos/\{id}/

##### `GET` /sources/group\_connections/kerberos/\{id}/used\_by/

##### `GET` /sources/kerberos/

##### `POST` /sources/kerberos/

##### `GET` /sources/kerberos/\{slug}/

##### `PUT` /sources/kerberos/\{slug}/

##### `DELETE` /sources/kerberos/\{slug}/

##### `PATCH` /sources/kerberos/\{slug}/

##### `GET` /sources/kerberos/\{slug}/sync/status/

##### `GET` /sources/kerberos/\{slug}/used\_by/

##### `GET` /sources/user\_connections/kerberos/

##### `POST` /sources/user\_connections/kerberos/

##### `GET` /sources/user\_connections/kerberos/\{id}/

##### `PUT` /sources/user\_connections/kerberos/\{id}/

##### `DELETE` /sources/user\_connections/kerberos/\{id}/

##### `PATCH` /sources/user\_connections/kerberos/\{id}/

##### `GET` /sources/user\_connections/kerberos/\{id}/used\_by/

##### `GET` /stages/authenticator/endpoint\_gdtc/

##### `POST` /stages/authenticator/endpoint\_gdtc/

##### `GET` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

##### `PUT` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

##### `DELETE` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

##### `PATCH` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

##### `GET` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/used\_by/

#### What's Changed

***

##### `GET` /authenticators/admin/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serializer for Duo authenticator devices

  New required properties:

  - `extra_description`

  * Added property `extra_description` (string)

    > Get extra description

  * Changed property `pk` (integer -> string)

##### `GET` /authenticators/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serializer for Duo authenticator devices

  New required properties:

  - `extra_description`

  * Added property `extra_description` (string)

    > Get extra description

  * Changed property `pk` (integer -> string)

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.sources.kerberos`
    - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_sources_kerberos.kerberossource`
    - `authentik_sources_kerberos.kerberossourcepropertymapping`
    - `authentik_sources_kerberos.userkerberossourceconnection`
    - `authentik_sources_kerberos.groupkerberossourceconnection`
    - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.sources.kerberos`
  - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.sources.kerberos`
    - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_sources_kerberos.kerberossource`
    - `authentik_sources_kerberos.kerberossourcepropertymapping`
    - `authentik_sources_kerberos.userkerberossourceconnection`
    - `authentik_sources_kerberos.groupkerberossourceconnection`
    - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.sources.kerberos`
  - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.sources.kerberos`
    - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_sources_kerberos.kerberossource`
    - `authentik_sources_kerberos.kerberossourcepropertymapping`
    - `authentik_sources_kerberos.userkerberossourceconnection`
    - `authentik_sources_kerberos.groupkerberossourceconnection`
    - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `GET` /providers/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)

    > Flow used ending the session from a provider.

  * Added property `encryption_key` (string)

    > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

  * Changed property `signing_key` (string)
    > Key used to sign the tokens.

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)

  > Flow used ending the session from a provider.

* Added property `encryption_key` (string)

  > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

* Changed property `signing_key` (string)
  > Key used to sign the tokens.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)

    > Flow used ending the session from a provider.

  * Added property `encryption_key` (string)

    > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

  * Changed property `signing_key` (string)
    > Key used to sign the tokens.

##### `PATCH` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `invalidation_flow` (string)

  > Flow used ending the session from a provider.

- Added property `encryption_key` (string)

  > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

- Changed property `signing_key` (string)
  > Key used to sign the tokens.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)

    > Flow used ending the session from a provider.

  * Added property `encryption_key` (string)

    > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

  * Changed property `signing_key` (string)
    > Key used to sign the tokens.

##### `GET` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PUT` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PATCH` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/rac/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PUT` /providers/rac/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PATCH` /providers/rac/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/radius/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PUT` /providers/radius/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PATCH` /providers/radius/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `POST` /providers/saml/import\_metadata/

###### Request:

Changed content type : `multipart/form-data`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)

##### `GET` /providers/scim/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `verify_certificates` (boolean)

##### `PUT` /providers/scim/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `verify_certificates` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `verify_certificates` (boolean)

##### `PATCH` /providers/scim/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `verify_certificates` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `verify_certificates` (boolean)

##### `GET` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.sources.kerberos`
  - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.sources.kerberos`
    - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_sources_kerberos.kerberossource`
    - `authentik_sources_kerberos.kerberossourcepropertymapping`
    - `authentik_sources_kerberos.userkerberossourceconnection`
    - `authentik_sources_kerberos.groupkerberossourceconnection`
    - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum values:

      - `authentik.sources.kerberos`
      - `authentik.enterprise.stages.authenticator_endpoint_gdtc`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum values:

      - `authentik_sources_kerberos.kerberossource`
      - `authentik_sources_kerberos.kerberossourcepropertymapping`
      - `authentik_sources_kerberos.userkerberossourceconnection`
      - `authentik_sources_kerberos.groupkerberossourceconnection`
      - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `GET` /providers/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /providers/ldap/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PUT` /providers/ldap/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PATCH` /providers/ldap/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)

  > Flow used ending the session from a provider.

* Added property `encryption_key` (string)

  > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

* Changed property `signing_key` (string)
  > Key used to sign the tokens.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)

    > Flow used ending the session from a provider.

  * Added property `encryption_key` (string)

    > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

  * Changed property `signing_key` (string)
    > Key used to sign the tokens.

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)

      > Flow used ending the session from a provider.

    * Added property `encryption_key` (string)

      > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

    * Changed property `signing_key` (string)
      > Key used to sign the tokens.

##### `POST` /providers/proxy/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ProxyProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /providers/rac/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/rac/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /providers/radius/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > RadiusProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PUT` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PATCH` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Added property `verify_certificates` (boolean)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `verify_certificates` (boolean)

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SCIMProvider Serializer

    - Added property `verify_certificates` (boolean)

##### `GET` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `PUT` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `PATCH` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_sources_kerberos.kerberossource`
  - `authentik_sources_kerberos.kerberossourcepropertymapping`
  - `authentik_sources_kerberos.userkerberossourceconnection`
  - `authentik_sources_kerberos.groupkerberossourceconnection`
  - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`

##### `GET` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
      Removed enum value:

    - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

##### `PUT` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `name_id_policy` (string)

  > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

  Added enum value:

  - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
    Removed enum value:

  - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
      Removed enum value:

    - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

##### `PATCH` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `name_id_policy` (string)

  > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

  Added enum value:

  - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
    Removed enum value:

  - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
      Removed enum value:

    - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

##### `POST` /core/applications/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Application Serializer

    - Changed property `provider_obj` (object)

      > Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

    - Changed property `backchannel_providers_obj` (array)

      Changed items (object): > Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `application` (object)

    > Application Serializer

    - Changed property `provider_obj` (object)

      > Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

    - Changed property `backchannel_providers_obj` (array)

      Changed items (object): > Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)

      > Flow used ending the session from a provider.

    * Added property `encryption_key` (string)

      > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

    * Changed property `signing_key` (string)
      > Key used to sign the tokens.

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)

      > Flow used ending the session from a provider.

    * Added property `encryption_key` (string)

      > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

    * Changed property `signing_key` (string)
      > Key used to sign the tokens.

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)

      > Flow used ending the session from a provider.

    * Added property `encryption_key` (string)

      > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

    * Changed property `signing_key` (string)
      > Key used to sign the tokens.

##### `POST` /outposts/instances/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Outpost Serializer

    - Changed property `providers_obj` (array)

      Changed items (object): > Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    New required properties:

    - `unbind_flow_slug`

    * Added property `unbind_flow_slug` (string)
      > Get slug for unbind flow, defaulting to brand's default flow.

##### `POST` /providers/ldap/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

New required properties:

- `invalidation_flow`

* Added property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/saml/

###### Parameters:

Added: `invalidation_flow` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /rac/connection\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ConnectionToken Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

    - Changed property `endpoint_obj` (object)

      > Endpoint Serializer

      - Changed property `provider_obj` (object)

        > RACProvider Serializer

        New required properties:

        - `invalidation_flow`

        * Added property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

##### `POST` /rac/endpoints/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New required properties:

    - `invalidation_flow`

    * Added property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /rac/endpoints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Changed property `name_id_policy` (string)

  > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

  Added enum value:

  - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
    Removed enum value:

  - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
      Removed enum value:

    - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

##### `GET` /sources/saml/

###### Parameters:

Changed: `name_id_policy` in `query`

> NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLSource Serializer

    - Changed property `name_id_policy` (string)

      > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

      Added enum value:

      - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
        Removed enum value:

      - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`

##### `GET` /stages/identification/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `captcha_stage` (string)
    > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

##### `PUT` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `captcha_stage` (string)
  > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `captcha_stage` (string)
    > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

##### `PATCH` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `captcha_stage` (string)
  > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `captcha_stage` (string)
    > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

##### `GET` /stages/password/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

    Added enum value:

    - `authentik.sources.kerberos.auth.KerberosBackend`

##### `PUT` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `backends` (array)

  > Selection of backends to test the password against.

  Changed items (string):

  Added enum value:

  - `authentik.sources.kerberos.auth.KerberosBackend`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

    Added enum value:

    - `authentik.sources.kerberos.auth.KerberosBackend`

##### `PATCH` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `backends` (array)

  > Selection of backends to test the password against.

  Changed items (string):

  Added enum value:

  - `authentik.sources.kerberos.auth.KerberosBackend`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

    Added enum value:

    - `authentik.sources.kerberos.auth.KerberosBackend`

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

  Updated `authentik_providers_oauth2.oauth2provider` provider\_model:
  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)

    > Flow used ending the session from a provider.

  * Added property `encryption_key` (string)

    > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

  * Changed property `signing_key` (string)
    > Key used to sign the tokens.

  Updated `authentik_providers_radius.radiusprovider` provider\_model:
  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

  Updated `authentik_providers_scim.scimprovider` provider\_model:

  - Added property `verify_certificates` (boolean)

  Updated `authentik_providers_proxy.proxyprovider` provider\_model:
  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

  Updated `authentik_providers_rac.racprovider` provider\_model:
  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

  Updated `authentik_providers_saml.samlprovider` provider\_model:
  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

  Updated `authentik_providers_ldap.ldapprovider` provider\_model:
  New required properties:

  - `invalidation_flow`

  * Added property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `application` (object)

      > Application Serializer

      - Changed property `provider_obj` (object)

        > Provider Serializer

        New required properties:

        - `invalidation_flow`

        * Added property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

      - Changed property `backchannel_providers_obj` (array)

        Changed items (object): > Provider Serializer

        New required properties:

        - `invalidation_flow`

        * Added property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'ak-stage-session-end' component:

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

    - Property `title` (string)

    - Property `background` (string)

    - Property `cancel_url` (string)

    - Property `layout` (string)

      Enum values:

      - `stacked`
      - `content_left`
      - `content_right`
      - `sidebar_left`
      - `sidebar_right`

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `pending_user` (string)

  - Property `pending_user_avatar` (string)

  - Property `application_name` (string)

  - Property `application_launch_url` (string)

  - Property `invalidation_flow_url` (string)

  - Property `brand_name` (string)

  Added 'xak-flow-frame' component:

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `url` (string)

  - Property `loading_overlay` (boolean)

  - Property `loading_text` (string)

  Updated `ak-stage-authenticator-validate` component:

  - Changed property `device_challenges` (array)

    Changed items (object): > Single device challenge

    New required properties:

    - `last_used`

    * Added property `last_used` (string)

  Updated `ak-stage-identification` component:

  - Added property `captcha_stage` (object)

    > Site public key

    - Property `flow_info` (object)

      > Contextual flow information for a challenge

    - Property `component` (string)

    - Property `response_errors` (object)

    - Property `pending_user` (string)

    - Property `pending_user_avatar` (string)

    - Property `site_key` (string)

    - Property `js_url` (string)

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Added 'xak-flow-frame' component:

- Property `component` (string)

Updated `ak-stage-identification` component:

- Added property `captcha_token` (string)

Updated `ak-stage-authenticator-validate` component:

- Changed property `selected_challenge` (object)

  > Single device challenge

  New required properties:

  - `last_used`

  * Added property `last_used` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'ak-stage-session-end' component:
  Added 'xak-flow-frame' component:
  Updated `ak-stage-authenticator-validate` component:

  - Changed property `device_challenges` (array)

    Changed items (object): > Single device challenge

    New required properties:

    - `last_used`

    * Added property `last_used` (string)

  Updated `ak-stage-identification` component:

  - Added property `captcha_stage` (object)
    > Site public key

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)

        > Flow used ending the session from a provider.

      * Added property `encryption_key` (string)

        > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

      * Changed property `signing_key` (string)
        > Key used to sign the tokens.

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)

        > Flow used ending the session from a provider.

      * Added property `encryption_key` (string)

        > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

      * Changed property `signing_key` (string)
        > Key used to sign the tokens.

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      New required properties:

      - `invalidation_flow`

      * Added property `invalidation_flow` (string)

        > Flow used ending the session from a provider.

      * Added property `encryption_key` (string)

        > Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

      * Changed property `signing_key` (string)
        > Key used to sign the tokens.

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Added property `captcha_stage` (string)
  > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `captcha_stage` (string)
    > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

##### `GET` /stages/identification/

###### Parameters:

Added: `captcha_stage` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > IdentificationStage Serializer

    - Added property `captcha_stage` (string)
      > When set, adds functionality exactly like a Captcha stage, but baked into the Identification stage.

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Changed property `backends` (array)

  > Selection of backends to test the password against.

  Changed items (string):

  Added enum value:

  - `authentik.sources.kerberos.auth.KerberosBackend`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

    Added enum value:

    - `authentik.sources.kerberos.auth.KerberosBackend`

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PasswordStage Serializer

    - Changed property `backends` (array)

      > Selection of backends to test the password against.

      Changed items (string):

      Added enum value:

      - `authentik.sources.kerberos.auth.KerberosBackend`

### API Changes in 2024.10.1

#### What's Changed

***

##### `GET` /providers/rac/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `invalidation_flow`

  * Deleted property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PUT` /providers/rac/\{id}/

###### Request:

Changed content type : `application/json`

New optional properties:

- `invalidation_flow`

* Deleted property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `invalidation_flow`

  * Deleted property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `PATCH` /providers/rac/\{id}/

###### Request:

Changed content type : `application/json`

- Deleted property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `invalidation_flow`

  * Deleted property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `POST` /providers/rac/

###### Request:

Changed content type : `application/json`

New optional properties:

- `invalidation_flow`

* Deleted property `invalidation_flow` (string)
  > Flow used ending the session from a provider.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New optional properties:

  - `invalidation_flow`

  * Deleted property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/rac/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New optional properties:

      - `invalidation_flow`

      * Deleted property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `PUT` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New optional properties:

      - `invalidation_flow`

      * Deleted property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `PATCH` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New optional properties:

      - `invalidation_flow`

      * Deleted property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /sources/kerberos/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `spnego_server_name` (string)
    > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

##### `PUT` /sources/kerberos/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `spnego_server_name` (string)
  > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `spnego_server_name` (string)
    > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

##### `PATCH` /sources/kerberos/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `spnego_server_name` (string)
  > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `spnego_server_name` (string)
    > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

##### `GET` /rac/connection\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ConnectionToken Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New optional properties:

      - `invalidation_flow`

      * Deleted property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

    - Changed property `endpoint_obj` (object)

      > Endpoint Serializer

      - Changed property `provider_obj` (object)

        > RACProvider Serializer

        New optional properties:

        - `invalidation_flow`

        * Deleted property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

##### `POST` /rac/endpoints/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    New optional properties:

    - `invalidation_flow`

    * Deleted property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /rac/endpoints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      New optional properties:

      - `invalidation_flow`

      * Deleted property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `POST` /sources/kerberos/

###### Request:

Changed content type : `application/json`

- Changed property `spnego_server_name` (string)
  > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `spnego_server_name` (string)
    > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

##### `GET` /sources/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Kerberos Source Serializer

    - Changed property `spnego_server_name` (string)
      > Force the use of a specific server name for SPNEGO. Must be in the form HTTP\@hostname

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

  Updated `authentik_providers_rac.racprovider` provider\_model:
  New optional properties:

  - `invalidation_flow`

  * Deleted property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

### API Changes in 2024.10.2

#### What's Changed

***

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `interactive` (boolean)

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `interactive` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `interactive` (boolean)

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `interactive` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `interactive` (boolean)

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-captcha` component:
  New required properties:

  - `interactive`

  * Added property `interactive` (boolean)

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Updated `ak-provider-oauth2-device-code` component:

- Changed property `code` (integer -> string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-captcha` component:
  New required properties:

  - `interactive`

  * Added property `interactive` (boolean)

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Added property `interactive` (boolean)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `interactive` (boolean)

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Added property `interactive` (boolean)

---

## Release 2024.12

## Highlights

- **Redirect stage** Conditionally redirect users to other flows and URLs.
- **Application entitlements**  Additional granular permission configuration on an application-level basis.
- **CloudFormation**  One-click deploy on AWS.
- **Policies in the application wizard** Configure access restriction while creating an application.

## Breaking changes

- **Impersonation now requires providing a reason**

  You can disable this behavior in the **Admin interface** under **System** > **Settings**.

- **Deprecated PostgreSQL `USE_PGBOUNCER` and `USE_PGPOOL` settings**

  With this release, the `AUTHENTIK_POSTGRESQL__USE_PGBOUNCER` and `AUTHENTIK_POSTGRESQL__USE_PGPOOL` settings have been deprecated in favor of exposing the underlying database settings: `AUTHENTIK_POSTGRESQL__CONN_MAX_AGE` and `AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS`.

  If you are using PgBouncer or PgPool as connection poolers and wish to maintain the same behavior as previous versions, `AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS` must be set to `true`. Moreover, if you are using PgBouncer `AUTHENTIK_POSTGRESQL__CONN_MAX_AGE` must be set to `null`.

  The newly exposed settings allow supporting a wider set of connection pooler configurations. For details on how these settings interact with different configurations of connection poolers, please refer to the [PostgreSQL documentation](../../install-config/configuration/configuration.mdx#postgresql-settings).

  These settings will be removed in a future version.

## New features

- **Redirect stage**

  This new stage allows redirecting a user to another flow or external URL. This allows for dynamically choosing which flow runs depending on user attributes or other factors, or redirection to another URL.

- **Application entitlements**&#x20;

  Centrally configure permissions by granting entitlements to groups and users on an application-level basis.

- **Policies in the application wizard**

  In the application creation wizard, administrators can now configure policy bindings along with the other application settings.

- **CloudFormation**&#x20;

  Deploy authentik in your own AWS environment with one click using our new [AWS CloudFormation template](../../install-config/install/aws.mdx).

- **OAuth2 provider federation**

  Configure [OAuth2 provider federation](../../add-secure-apps/providers/oauth2/machine_to_machine.mdx#authentik-issued-jwts) to allow exchanging authentication tokens between multiple providers.

- **Silent authorization flow**

  When authorization flows don't require user interaction, authentik redirects the user directly back to the application, improving user experience.

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2024.12/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.12
```

## Minor changes/fixes

- blueprints: add AtIndex tag (#12386)
- blueprints: add default Password policy (#11793)
- core: add `None` check to a device's `extra_description` (#11904)
- core: add ability to provide reason for impersonation (#11951)
- core: add support to set policy bindings in transactional endpoint (#10399)
- core: app entitlements (#12090)
- core: fix source\_flow\_manager throwing error when authenticated user attempts to re-authenticate with existing link (#12080)
- core: use versioned\_script for path only (#12003)
- crypto: validate that generated certificate's name is unique (#12015)
- enterprise/rac: fix API Schema for invalidation\_flow (#11907)
- enterprise/stages/authenticator\_endpoint\_gdtc: don't set frame options globally (#12311)
- enterprise: allow deletion/modification of users when in read-only mode (#12289)
- events: notification\_cleanup: avoid unnecessary loop (cherry-pick #12417) (#12418)
- flows: better test stage's challenge responses (#12316)
- flows: silent authz flow (#12213)
- internal: add CSP header to files in `/media` (#12092)
- lifecycle: fix ak exit status not being passed (#12024)
- lifecycle: fix kdc5-config missing (#11826)
- lifecycle: fix missing krb5 deps for full testing in image (#11815)
- providers/ldap: fix global search\_full\_directory permission not being sufficient (#12028)
- providers/oauth2: Add provider federation between OAuth2 Providers (#12083)
- providers/oauth2: allow m2m for JWKS without alg in keys (#12196)
- providers/oauth2: fix manual device code entry (#12017)
- providers/oauth2: fix migration (#12138)
- providers/oauth2: fix migration dependencies (#12123)
- providers/oauth2: fix redirect uri input (#12122)
- providers/oauth2: fix size limited index for tokens (#11879)
- providers/oauth2: make session deletion cascade to tokens (#12343)
- providers/proxy: fix Issuer when AUTHENTIK\_HOST\_BROWSER is set (#11968)
- providers/proxy: fix redirect\_uri (#12121)
- providers/scim: accept string and int for SCIM IDs (#12093)
- rbac: fix incorrect object\_description for object-level permissions (#12029)
- root: check remote IP for proxy protocol same as HTTP/etc (#12094)
- root: expose CONN\_MAX\_AGE, CONN\_HEALTH\_CHECKS and DISABLE\_SERVER\_SIDE\_CURSORS for PostgreSQL config (cherry-pick #10159) (#12419)
- root: fix activation of locale not being scoped (#12091)
- root: fix database ssl options not set correctly (#12180)
- root: fix health status code (#12255)
- root: fix missing entries in codeowners (#12369)
- root: fix override locale only if it is not empty (#12283)
- root: fix ssl settings for read replicas not being applied (#12341)
- root: lock setuptools to prevent docker install issue
- root: support running authentik in subpath (#8675)
- root: use healthcheck in depends\_on for postgres and redis (#12301)
- security: fix CVE 2024 52287 (#12114)
- security: fix CVE 2024 52289 (#12113)
- security: fix CVE 2024 52307 (#12115)
- sources/kerberos: add kadmin type setting, provide additional context to property mappings (#12286)
- sources/kerberos: add kiprop to ignored system principals (#11852)
- sources/kerberos: use new python-kadmin implementation (#11932)
- sources/oauth: allow creation of user connection objects with parameters (#12195)
- sources/saml: fix redirect not kept through SAML Source (#12372)
- stages/captcha: Run interactive captcha in Frame (#11857)
- stages/identification: fix invalid challenge warning when no captcha stage is set (#12312)
- stages/password: use recovery flow from brand (#11953)
- stages/redirect: create redirect stage (#12275)
- web/admin: add application bindings to the application wizard (#11462)
- web/admin: auto-prefill user path for new users based on selected path (#12070)
- web/admin: better footer links (#12004)
- web/admin: bugfix: dual select initialization revision (#12051)
- web/admin: fix brand title not respected in application list (#12068)
- web/admin: fix code-based MFA toggle not working in wizard (#11854)
- web/admin: fix prompt stage wording (#12384)
- web/admin: provide default invalidation flows for LDAP and Radius (#11861)
- web/flows: fix invisible captcha call (#12048)
- web/flows: resize captcha iframes (#12260)
- web/flows: update flow background (#12339)
- web: add italian locale (#11958)
- web: backport fix impersonate api (#12184)
- web: fix bug that prevented error reporting in current wizard. (#12033)
- web: fix missing status code on failed build (#11903)
- web: simplify `?inline` handler for Storybook (#12246)
- web: update tests for Chromedriver 131 (#12199)

## Fixed in 2024.12.1

- internal: fix URL generation for websocket connection (cherry-pick #12439) (#12440)
- website/docs: add content about bindings (cherry-pick #11787) (#12428)
- website/docs: add new section about impersonation (cherry-pick #12328) (#12424)

## Fixed in 2024.12.2

- core: fix error when creating new user with default path (cherry-pick #12609) (#12612)
- internal: fix missing trailing slash in outpost websocket (cherry-pick #12470) (#12471)
- providers/saml: fix invalid SAML Response when assertion and response are signed (cherry-pick #12611) (#12613)
- rbac: permissions endpoint: allow authenticated users (cherry-pick #12608) (#12610)
- sources/kerberos: authenticate with the user's username instead of the first username in authentik (cherry-pick #12497) (#12579)
- web: fix source selection and outpost integration health (#12530)

## Fixed in 2024.12.3

- core: fix application entitlements not creatable with blueprints (cherry-pick #12673) (#12784)
- core: fix permissions for admin device listing (cherry-pick #12787) (#12791)
- enterprise/rac: Improve client connection status & bugfixes (cherry-pick #12684) (#12727)
- flows: clear flow state before redirecting to final URL (cherry-pick #12788) (#12801)
- lifecycle: better pre release test (cherry-pick #12806) (#12808)
- lifecycle: build binary dependencies which link against SSL directly (#12724)
- lifecycle: fix cryptography's OpenSSL path (cherry-pick #12753) (#12759)
- lifecycle: update python to 3.12.8 (cherry-pick #12783) (#12786)
- rbac: exclude permissions for internal models (cherry-pick #12803) (#12807)
- sources: allow uuid or slug to be used for retrieving a source (#12772)
- stages/redirect: fix query parameter when redirecting to flow (cherry-pick #12750) (#12752)

## Fixed in 2024.12.4

- core: fix generic sources not being fetchable by pk (#12896)
- core: fix non-exploitable open redirect (#13696)
- flows: fix inspector permission check (#12907)
- security: fix CVE-2025-29928 (cherry-pick #13695) (#13701)

## Fixed in 2024.12.5

- Revert "core: fix non-exploitable open redirect (#13696)" (#13827)

## API Changes

#### What's New

***

##### `GET` /core/application\_entitlements/

##### `POST` /core/application\_entitlements/

##### `GET` /core/application\_entitlements/\{pbm\_uuid}/

##### `PUT` /core/application\_entitlements/\{pbm\_uuid}/

##### `DELETE` /core/application\_entitlements/\{pbm\_uuid}/

##### `PATCH` /core/application\_entitlements/\{pbm\_uuid}/

##### `GET` /core/application\_entitlements/\{pbm\_uuid}/used\_by/

##### `GET` /stages/redirect/

##### `POST` /stages/redirect/

##### `GET` /stages/redirect/\{stage\_uuid}/

##### `PUT` /stages/redirect/\{stage\_uuid}/

##### `DELETE` /stages/redirect/\{stage\_uuid}/

##### `PATCH` /stages/redirect/\{stage\_uuid}/

##### `GET` /stages/redirect/\{stage\_uuid}/used\_by/

#### What's Changed

***

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `impersonation_require_reason` (boolean)
    > Require administrators to provide a reason for impersonating a user.

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `impersonation_require_reason` (boolean)
  > Require administrators to provide a reason for impersonating a user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `impersonation_require_reason` (boolean)
    > Require administrators to provide a reason for impersonating a user.

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `impersonation_require_reason` (boolean)
  > Require administrators to provide a reason for impersonating a user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `impersonation_require_reason` (boolean)
    > Require administrators to provide a reason for impersonating a user.

##### `POST` /core/users/\{id}/impersonate/

###### Request:

New content type : `application/json`

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.stages.redirect`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_redirect.redirectstage`
    - `authentik_core.applicationentitlement`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.stages.redirect`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.stages.redirect`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_redirect.redirectstage`
    - `authentik_core.applicationentitlement`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.stages.redirect`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.stages.redirect`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_redirect.redirectstage`
    - `authentik_core.applicationentitlement`

##### `GET` /sources/group\_connections/kerberos/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)
    - Property `pk` (string)

    - Property `name` (string)

      > Source's display Name.

    - Property `slug` (string)

      > Internal source name, used in URLs.

    - Property `enabled` (boolean)

    - Property `authentication_flow` (string)

      > Flow to use when authenticating existing users.

    - Property `enrollment_flow` (string)

      > Flow to use when enrolling new users.

    - Property `user_property_mappings` (array)

      Items (string):

    - Property `group_property_mappings` (array)

    - Property `component` (string)

      > Get object component so that we know how to edit the object

    - Property `verbose_name` (string)

      > Return object's verbose\_name

    - Property `verbose_name_plural` (string)

      > Return object's plural verbose\_name

    - Property `meta_model_name` (string)

      > Return internal model name

    - Property `policy_engine_mode` (string)

      Enum values:

      - `all`
      - `any`

    - Property `user_matching_mode` (string)

      > How the source determines if an existing user should be authenticated or a new user enrolled.

      Enum values:

      - `identifier`
      - `email_link`
      - `email_deny`
      - `username_link`
      - `username_deny`

    - Property `managed` (string)

      > Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

    - Property `user_path_template` (string)

    - Property `icon` (string)
      > Get the URL to the Icon. If the name is /static or
      > starts with http it is returned as-is

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PUT` /sources/group\_connections/kerberos/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PATCH` /sources/group\_connections/kerberos/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `GET` /sources/group\_connections/oauth/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PUT` /sources/group\_connections/oauth/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PATCH` /sources/group\_connections/oauth/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `GET` /sources/group\_connections/plex/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PUT` /sources/group\_connections/plex/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PATCH` /sources/group\_connections/plex/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `GET` /sources/group\_connections/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PUT` /sources/group\_connections/saml/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `PATCH` /sources/group\_connections/saml/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `GET` /sources/user\_connections/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PUT` /sources/user\_connections/all/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PATCH` /sources/user\_connections/all/\{id}/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/kerberos/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `source` (object -> string)

##### `PUT` /sources/user\_connections/kerberos/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`

* Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `source` (object -> string)

##### `PATCH` /sources/user\_connections/kerberos/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/oauth/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PUT` /sources/user\_connections/oauth/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`
- `user`

* Added property `user` (integer)

* Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PATCH` /sources/user\_connections/oauth/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `user` (integer)

- Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/plex/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PUT` /sources/user\_connections/plex/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`
- `user`

* Added property `user` (integer)

* Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PATCH` /sources/user\_connections/plex/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `user` (integer)

- Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PUT` /sources/user\_connections/saml/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`
- `user`

* Added property `user` (integer)

* Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `PATCH` /sources/user\_connections/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `user` (integer)

- Added property `source` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /flows/instances/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:

    - `require_redirect`

##### `PUT` /flows/instances/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

  > Required level of authentication and authorization to access a flow.

  Added enum value:

  - `require_redirect`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:

    - `require_redirect`

##### `PATCH` /flows/instances/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

  > Required level of authentication and authorization to access a flow.

  Added enum value:

  - `require_redirect`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:

    - `require_redirect`

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.stages.redirect`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.stages.redirect`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_redirect.redirectstage`
    - `authentik_core.applicationentitlement`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum value:

      - `authentik.stages.redirect`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum values:

      - `authentik_stages_redirect.redirectstage`
      - `authentik_core.applicationentitlement`

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_redirect.redirectstage`
  - `authentik_core.applicationentitlement`

##### `GET` /sources/group\_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Group-Source connection Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `group` (string)

    * Changed property `source` (object -> string)

    * Changed property `identifier` (string)

##### `POST` /sources/group\_connections/oauth/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `GET` /sources/group\_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Group-Source connection Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `group` (string)

    * Changed property `source` (object -> string)

    * Changed property `identifier` (string)

##### `POST` /sources/group\_connections/plex/

###### Request:

New content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `group` (string)

  * Changed property `source` (object -> string)

  * Changed property `identifier` (string)

##### `GET` /sources/group\_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Plex Group-Source connection Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `group` (string)

    * Changed property `source` (object -> string)

    * Changed property `identifier` (string)

##### `GET` /sources/group\_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Group-Source connection Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `group` (string)

    * Changed property `source` (object -> string)

    * Changed property `identifier` (string)

##### `GET` /sources/kerberos/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `kadmin_type` (object)

    > KAdmin server type

    Enum values:

    - `MIT`
    - `Heimdal`
    - `other`

##### `PUT` /sources/kerberos/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `kadmin_type` (object)
  > KAdmin server type

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `kadmin_type` (object)
    > KAdmin server type

##### `PATCH` /sources/kerberos/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `kadmin_type` (object)
  > KAdmin server type

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `kadmin_type` (object)
    > KAdmin server type

##### `GET` /sources/user\_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > User source connection

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `user` (integer)

    * Changed property `source` (object -> string)

##### `POST` /sources/user\_connections/kerberos/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`

* Added property `source` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Kerberos Source Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `source` (object -> string)

##### `POST` /sources/user\_connections/oauth/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`
- `user`

* Added property `user` (integer)

* Added property `source` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `user` (integer)

    * Changed property `source` (object -> string)

##### `POST` /sources/user\_connections/plex/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`
- `user`

* Added property `user` (integer)

* Added property `source` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Plex Source connection Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `user` (integer)

    * Changed property `source` (object -> string)

##### `POST` /sources/user\_connections/saml/

###### Request:

Changed content type : `application/json`

New required properties:

- `source`
- `user`

* Added property `user` (integer)

* Added property `source` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `source_obj`

  * Added property `source_obj` (object)

  * Changed property `user` (integer)

  * Changed property `source` (object -> string)

##### `GET` /sources/user\_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAML Source Serializer

    New required properties:

    - `source_obj`

    * Added property `source_obj` (object)

    * Changed property `user` (integer)

    * Changed property `source` (object -> string)

##### `GET` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > Required level of authentication and authorization to access a flow.

      Added enum value:

      - `require_redirect`

##### `PUT` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > Required level of authentication and authorization to access a flow.

      Added enum value:

      - `require_redirect`

##### `PATCH` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > Required level of authentication and authorization to access a flow.

      Added enum value:

      - `require_redirect`

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

  > Required level of authentication and authorization to access a flow.

  Added enum value:

  - `require_redirect`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:

    - `require_redirect`

##### `GET` /flows/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Flow Serializer

    - Changed property `authentication` (string)

      > Required level of authentication and authorization to access a flow.

      Added enum value:

      - `require_redirect`

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

    Items (string):

  - Added property `jwt_federation_providers` (array)

    Items (integer):

  - Deleted property `jwks_sources` (array)

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `jwt_federation_sources` (array)

- Added property `jwt_federation_providers` (array)

- Deleted property `jwks_sources` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `PATCH` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `jwt_federation_sources` (array)

- Added property `jwt_federation_providers` (array)

- Deleted property `jwks_sources` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `GET` /providers/proxy/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `PUT` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `jwt_federation_sources` (array)

- Added property `jwt_federation_providers` (array)

- Deleted property `jwks_sources` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `PATCH` /providers/proxy/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `jwt_federation_sources` (array)

- Added property `jwt_federation_providers` (array)

- Deleted property `jwks_sources` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

##### `POST` /sources/kerberos/

###### Request:

Changed content type : `application/json`

- Added property `kadmin_type` (object)
  > KAdmin server type

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `kadmin_type` (object)
    > KAdmin server type

##### `GET` /sources/kerberos/

###### Parameters:

Added: `kadmin_type` in `query`

> KAdmin server type

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Kerberos Source Serializer

    - Added property `kadmin_type` (object)
      > KAdmin server type

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > Required level of authentication and authorization to access a flow.

      Added enum value:

      - `require_redirect`

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Invitation Serializer

    - Changed property `flow_obj` (object)

      > Flow Serializer

      - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

        Added enum value:

        - `require_redirect`

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-identification` component:

  - Changed property `captcha_stage` (object -> object)
    > Site public key

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Added 'xak-flow-redirect' component:

- Property `component` (string)

- Property `to` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-identification` component:

  - Changed property `captcha_stage` (object -> object)
    > Site public key

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `jwt_federation_sources` (array)

    - Added property `jwt_federation_providers` (array)

    - Deleted property `jwks_sources` (array)

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `jwt_federation_sources` (array)

    - Added property `jwt_federation_providers` (array)

    - Deleted property `jwks_sources` (array)

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `jwt_federation_sources` (array)

    - Added property `jwt_federation_providers` (array)

    - Deleted property `jwks_sources` (array)

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Added property `jwt_federation_sources` (array)

- Added property `jwt_federation_providers` (array)

- Deleted property `jwks_sources` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    - Added property `jwt_federation_sources` (array)

    - Added property `jwt_federation_providers` (array)

    - Deleted property `jwks_sources` (array)

##### `POST` /providers/proxy/

###### Request:

Changed content type : `application/json`

- Added property `jwt_federation_sources` (array)

- Added property `jwt_federation_providers` (array)

- Deleted property `jwks_sources` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ProxyProvider Serializer

    - Added property `jwt_federation_sources` (array)

    - Added property `jwt_federation_providers` (array)

    - Deleted property `jwks_sources` (array)

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Added property `policy_bindings` (array)

  Items (object): > PolicyBindingSerializer which does not require target as target is set implicitly

  - Property `policy` (string)

  - Property `group` (string)

  - Property `user` (integer)

  - Property `negate` (boolean)

    > Negates the outcome of the policy. Messages are unaffected.

  - Property `enabled` (boolean)

  - Property `order` (integer)

  - Property `timeout` (integer)

    > Timeout after which Policy execution is terminated.

  - Property `failure_result` (boolean)
    > Result if the Policy execution fails.

- Changed property `provider` (object)

  Updated `authentik_providers_proxy.proxyprovider` provider\_model:

  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

  Updated `authentik_providers_oauth2.oauth2provider` provider\_model:

  - Added property `jwt_federation_sources` (array)

  - Added property `jwt_federation_providers` (array)

  - Deleted property `jwks_sources` (array)

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `jwt_federation_sources` (array)

      - Added property `jwt_federation_providers` (array)

      - Deleted property `jwks_sources` (array)

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `jwt_federation_sources` (array)

      - Added property `jwt_federation_providers` (array)

      - Deleted property `jwks_sources` (array)

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `jwt_federation_sources` (array)

      - Added property `jwt_federation_providers` (array)

      - Deleted property `jwks_sources` (array)

---

## Release 2024.2

## Highlights

- **Remote Access Control**  Access machines over RDP, SSH, and VNC from authentik

- **Audit logging**  See what fields were changed when objects are updated

- **Session location and network binding** Increase security by preventing session theft

- **Wizard to simplify creating applications and providers**

## Breaking changes

### Manual action is required

- **Tenants have been renamed to brands**

  Tenants, which were previously used to change branding configuration, default flows, and several other settings, have been renamed to *brands*. The term "Brands" more accurately reflects their usage for configuring branding, logos, colors, and overall login flow behavior.

  Existing *tenant* objects will automatically be renamed to *brand* objects. The API endpoints associated with *brands* have also been renamed.

  Blueprints using `authentik_tenants.tenant` will need to be changed to use `authentik_brands.brand`.

  For more information, refer to the [documentation for *brands*](../../customize/branding/index.mdx).

  Also, **the event retention settings configured in brands (previously tenants, see above) have been removed and are now a system setting**, managed in the Admin interface or via the API (see below).

  **There is no built-in migration path for this change.** If you set something other than the default (`days=365`), you will need to update the setting in the admin interface.

- **Helm chart breaking changes**

  The Helm Chart has a number of breaking changes. Find out more in the [chart release notes](https://github.com/goauthentik/helm/releases/tag/authentik-2024.2.0).

### Manual action may be required

- **Required `offline_access` scope for Refresh tokens**

  The OAuth2 provider ships with a new default scope called `offline_access`, which must be requested by applications that need a refresh token. Previously, authentik would always issue a refresh token for the *Authorization code* and *Device code* OAuth grants.

  Applications that require a refresh token will need their configuration to be updated to include the `offline_access` scope mapping.

- **Database requirement changes**

  authentik now uses PostgreSQL schemas other than `public`.

  If you have a custom PostgreSQL deployment, please ensure that the authentik user is allowed to create schemas. Usually, if the authentik user is owner of the database, it already can.

- **Redis and cache configuration options have been improved**

  Thank you @PKizzle for this contribution!

  Cache settings have been moved from the `redis` top-level config key to their own `cache` top-level config key.

  Settings have also been added to configure the Redis instance/database used for tasks and websockets separately from cache. See [here](../../install-config/configuration/configuration.mdx).

  Typically, *no changes to the configuration are required*.

- **Configuration options migrated to the Admin interface**

  The following config options have been moved from the config file and can now be set using the Admin interface (under **System** -> **Settings**) or the API:

  - `AUTHENTIK_AVATARS`
  - `AUTHENTIK_DEFAULT_USER_CHANGE_NAME`
  - `AUTHENTIK_DEFAULT_USER_CHANGE_EMAIL`
  - `AUTHENTIK_DEFAULT_USER_CHANGE_USERNAME`
  - `AUTHENTIK_GDPR_COMPLIANCE`
  - `AUTHENTIK_IMPERSONATION`
  - `AUTHENTIK_FOOTER_LINKS`
  - `AUTHENTIK_REPUTATION__EXPIRY`

  When upgrading to 2024.2, the currently configured options will be automatically migrated to the database, and can be removed from the `.env` or helm values file afterwards.

- **Icons are now in a `public/` subfolder**

  If your media folder is `/media`, icons are now stored in `/media/public`. authentik will automatically migrate the icons upon upgrading.

  Note that even though that folder is named `public`, the files stored here are not automatically public. This is due to the naming of the default PostgreSQL schema.

- **User sessions will be invalidated after this upgrade.**

  As such, users will need to log back in. Immediately after the upgrade completes, users are logged out automatically and are then prompted to log in again. This only occurs once.

- **Removal of deprecated metrics**

  These metrics were renamed because they did not adhere to Prometheus best practices. The old metrics were kept for backwards compatibility and have now been removed.

  - `authentik_outpost_flow_timing_get` -> `authentik_outpost_flow_timing_get_seconds`
  - `authentik_outpost_flow_timing_post` -> `authentik_outpost_flow_timing_post_seconds`
  - `authentik_outpost_ldap_requests` -> `authentik_outpost_ldap_request_duration_seconds`
  - `authentik_outpost_ldap_requests_rejected` -> `authentik_outpost_ldap_requests_rejected_total`
  - `authentik_outpost_proxy_requests` -> `authentik_outpost_proxy_request_duration_seconds`
  - `authentik_outpost_proxy_upstream_time` -> `authentik_outpost_proxy_upstream_response_duration_seconds`
  - `authentik_outpost_radius_requests` -> `authentik_outpost_radius_request_duration_seconds`
  - `authentik_outpost_radius_requests_rejected` -> `authentik_outpost_radius_requests_rejected_total`
  - `authentik_main_requests` -> `authentik_main_request_duration_seconds`

- The shorthand parameter for `--stage`, `-s` for the `ak test_email` command has been changed to `-S`

## New features

- **New provider: Remote Access Control**&#x20;

  The Remote Access Control provider allows you to remotely connect to remote machines over RDP, SSH and VNC through authentik. As such, you can use the same policy engine and customization options that are possible with other providers using the same user and admin interface.

- **Audit logging**&#x20;

  authentik instances that have a valid enterprise license installed will log any changes made to models, including which fields were changed with previous and new values of the fields. The values are censored if they are sensitive (for example a password hash), however a hash of the changed value will still be logged.

- **Session location and network binding**

  Sessions for any users can now be bound to a specific geolocation (Continent, Country, City) or network (Autonomous System, subnet, IP address). If the session is accessed from a location/network that is different than that from which it was initially created, the session will be terminated.

  Configuration steps are available [here](../../add-secure-apps/flows-stages/stages/user_login/index.mdx#configuration-options).

- **S3 file storage**

  Media files can be stored on S3. Follow the [setup guide](../../sys-mgmt/ops/storage-s3/index.mdx) to get started.

- ***Pretend user exists* option for Identification stage**

  Previously the Identification stage would only continue if a user matching the user identifier exists. While this was the intended functionality, this release adds an option to continue to the next stage even if no matching user was found. "Pretend" users cannot authenticate nor receive emails, and don't exist in the database.

  **This feature is enabled by default.**

### UX features

- **Simplified workflow for creating applications and providers**

  Applications and providers can now be created at the same time using the **Application Wizard**, found on the **Applications** -> **Applications** page of the Admin interface. The new wizard removes the previous requirement of first creating the provider, then the application, and then manually linking the two together.

- **Ability to select more than 20 providers in an outpost**

  We have introduced a new way of selecting providers in the outpost configuration form, which allows for more than 20 providers to be selected for a single outpost.

  This dual-list multiselect prompt is only available for outposts for now, but we plan on extending it to other forms.

- **Attribute preview per user**

  You can now preview attributes transmitted to SAML and OAuth applications for a specific user.

- **Display applications a user has access to**

  An administrator can now see all applications a user has access to on the user's page in the Admin interface.

### Other noteworthy features

- **New graph for event volume**

  In the **Events** -> **Log** page in the Admin interface, you can see a graph of the event volume matching the search query over the last 7 days.

- **Flows can now be restricted to outposts**

  You can now restrict a flow to be used only by an outpost using the **Require Outpost** setting on the flow. This would mainly be used for LDAP flows.

- **System tasks improvements**

  You can now search through system tasks. We have also improved the task duration calculation and display.

- **LDAP provider: allow overriding gidNumber**

  Previously, the `gidNumber` attribute on a user was set to the same as `uidNumber`. You can now override this behavior.

- **LDAP source: new command to check connectivity**

  Examples on how to use are available [here](../../troubleshooting/ldap_source.mdx).

***

## Upgrading

This release does not introduce any new requirements, but contains some breaking changes, see above.

### docker-compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2024.2/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.2
```

## Minor changes/fixes

- blueprints: improve file change handler (#7813)
- blueprints: only watch for fs events we're interested in (#7810)
- core: fix PropertyMapping context not being available in request context
- core: fix pagination in applications list being ignored (#8512)
- core: fix worker beat toggle inverted (#7508)
- core: optimize user list endpoint (#8353)
- core: show all applications a user can access in admin interface (#8343)
- core: use correct .evaluate implementation for testing PropertyMappings (#8459)
- core: use correct .evaluate implementation for testing PropertyMappings (#8459)
- enterprise/providers/rac: add alert that enterprise is required for RAC (#8057)
- enterprise/providers/rac: add option to limit concurrent connections to endpoint (#8053)
- enterprise/providers/rac: connection token management (#8467)
- enterprise/providers/rac: create authorize\_application event when creating token (#8050)
- enterprise/providers/rac: fix maximum\_connections set to -1 not being effective (#8456)
- enterprise/providers/rac: fix maximum\_connections set to -1 not being effective (#8456)
- enterprise/providers: Add RAC (#7291)
- enterprise: add full audit log (#8177)
- enterprise: fix system task missing set\_status (#8455)
- enterprise: rework license summary caching (#8501)
- enterrpise: exclude inactive users from license (#8294)
- events: add ASN Database reader (#7793)
- events: add better fallback for sanitize\_item to ensure everything can be saved as JSON (#7694)
- events: add graph for event volume (#7639)
- events: fix SystemTask timestamps and scheduling (#8435)
- events: include user agent in events (#7693)
- events: migrate SystemTasks to DB (#8159)
- flows: add "require outpost" authentication\_requirement (#7921)
- internal: remove deprecated metrics (#7540)
- internal: remove special route for /outpost.goauthentik.io (#7539)
- outposts/ldap: allow overriding gidNumber for a user (#8003)
- outposts/ldap: avoid nil ptr deref in MemorySearcher (#7767)
- outposts/proxy: better Redis error message (#8044)
- outposts: disable deployment and secret reconciler for embedded outpost in code instead of in config (#8021)(#8024)
- outposts: fix Outpost reconcile not re-assigning managed attribute (#8014)
- providers/oauth2: fix CVE-2024-21637 (#8104)
- providers/oauth2: fix missing nonce in id\_token (#8072)
- providers/oauth2: fix missing nonce in token endpoint not being saved (#8073)
- providers/oauth2: offline access (#8026)
- providers/oauth2: remember session\_id from initial token (#7976)
- providers/oauth2: set auth\_via for token and other endpoints (#7417)
- providers/proxy: Fix duplicate cookies when using file system store. (#7541)
- providers/proxy: fix closed redis client (#7385)
- providers/proxy: use access token (#8022)
- providers/rac: fix property mapping without enterprise (#8144)
- providers/scim: change familyName default (#7904)
- providers/scim: fix missing schemas attribute for User and Group (#7477)
- providers/scim: set timeout based on page and page count (#7941)
- providers/scim: use lock for sync (#7948)
- providers: allow previewing mappings for other users (#8297)
- rbac: fix error when looking up permissions for now uninstalled apps (#8068)
- rbac: fix invitations listing with restricted permissions (#8227)
- root: Multi-tenancy (#7590)
- root: Restructure broker / cache / channel / result configuration (#7097)
- root: bump python deps (django 5) (#7862)
- root: fix listen trusted\_proxy\_cidrs config loading from environment (#8075)
- root: fix redis config not being updated to match previous change
- root: fix system check warnings (#8277)
- root: include ca-certificates in container (#7763)
- root: make test database name configurable (#7591)
- root: simplify task signal imports (#8454)
- security: fix CVE-2023-48228 (#7666)
- security: fix CVE-2024-23647 (#8345)
- sources/ldap: add check command to verify ldap connectivity (#7263)
- sources/ldap: clean-up certs written from db (#7617)
- sources/ldap: fix Issue with changing passwords with eDirectory (#7997)
- sources/oauth: fix OAuth source type serializer (#8140)
- sources/oauth: fix URLs being overwritten by OIDC urls (#8147)
- sources/oauth: fix azure\_ad user\_id and add test and fallback (#8146)
- sources/oauth: fix missing get\_user\_id for OIDC-like sources (Azure AD) (#7970)
- sources/oauth: fix patreon (#7454)
- sources/oauth: revert azure\_ad profile URL change (#8139)
- stages/authenticator\_totp: fix API validation error due to choices (#7608)
- stages/authenticator\_validate: fix error when using pretend\_user (#8447)
- stages/authenticator\_validate: fix error when using pretend\_user (#8447)
- stages/authenticator\_validate: use friendly\_name for stage selector when enrolling (#8255)
- stages/email: fix duplicate querystring encoding (#7386)
- stages/email: improve error handling for incorrect template syntax (#7758)
- stages/email: prevent authentik emails from being marked as spam (also add text template support) (#7949)
- stages/email: use uuid for email confirmation token instead of username (#7581)
- stages/identification: add option to pretend user exists (#7610)
- stages/user\_login: only set last\_ip in session if a binding is given (#8074)
- stages/user\_login: session binding (#7881)
- web/admin: add RAC Provider to the list of providers understood by the wizard (#8149)
- web/admin: always show oidc well-known URL fields when they're set (#7560)
- web/admin: contextually add user to group when creating user from group page (#7586)
- web/admin: fix admins not able to delete MFA devices (#7660)
- web/admin: fix chart label on dashboard user page (#7434)
- web/admin: fix footer links not being parsed on settings page (#8289)
- web/admin: fix html error on oauth2 provider page (#7384)
- web/admin: fix incorrectly encoded chars in translation (#7580)
- web/admin: hide expiry time if item is set to not expire (#8457)
- web/admin: hide expiry time if item is set to not expire (#8457)
- web/admin: revamped rbac and user settings tabs (#8299)
- web/admin: revise wizard form handling (#7331)
- web/admin: show connected services on user view page, fix styling (#8416)
- web/components: improve error handling in ak-search-select (#8228)
- web/elements: keep selected elements in table when fetching (#7519)
- web/flows: attempt to fix bitwareden android compatibility (#7455)
- web/flows: don't auto-redirect to first source when passwordless is configured (#7579)
- web/flows: fix device picker incorrect foreground color (#8067)
- web/flows: fix icon for generic oauth source with dark theme (#8148)
- web/flows: fix logo height (#7834)
- web/flows: show logo in card (#7824)
- web/flows: use aria-invalid attribute to better show invalid input fields (#7661)
- web/user: fix search not updating selected app in user interface (#7825)
- web: clear "blanked" placeholder when present (#15) (#5948)
- web: clear out selecteds list after an API event to ensure a fresh copy of the policies-to-delete list (#8125)
- web: dark/light theme fixes (#7872)
- web: fix broken backchannel selector (#7480)
- web: fix labels on group view page (#7677)
- web: fix overflow glitch on ak-page-header (#7883)
- web: provide dual-list multiselect with pagination (#8004)

## Fixed in 2024.2.1

- brands: fix context processor when request doesn't have a tenant (cherry-pick #8643) (#8646)
- ci: fix missing tags from release (cherry-pick #8645) (#8647)
- core: bump cbor2 from 5.5.1 to 5.6.2 (#8607)
- core: bump cryptography from 42.0.0 to 42.0.2 (#8553)
- core: bump cryptography from 42.0.2 to 42.0.4 (#8629)
- events: sanitize args and kwargs saved in system tasks (cherry-pick #8644) (#8648)
- stages/authenticator\_validate: fix error with get\_webauthn\_challenge\_without\_user (cherry-pick #8625) (#8626)

## Fixed in 2024.2.2

- core: fix blueprint export (cherry-pick #8695) (#8696)
- enterprise: fix read\_only activating when no license is installed (cherry-pick #8697) (#8698)
- enterprise: force license usage update after change to license (cherry-pick #8723) (#8725)
- flows: fix mismatched redirect behavior for invalid and valid flows (cherry-pick #8794) (#8796)
- providers/oauth2: fix inconsistent `sub` value when setting via mapping (cherry-pick #8677) (#8682)
- providers/oauth2: fix offline\_access requests when prompt doesn't include consent (cherry-pick #8731) (#8732)
- providers/oauth2: fix validation ordering (cherry-pick #8793) (#8795)
- root: ensure consistent install\_id (cherry-pick #8775) (#8776)
- root: fix container build (cherry-pick #8727) (#8728)
- stages/authenticator\_webauthn: fix error when enrolling new device (cherry-pick #8738) (#8740)
- web/admin: don't mark property mappings as required anywhere (cherry-pick #8752) (#8755)
- web/admin: don't mark remaining property mappings as required (cherry-pick #8772) (#8773)

## Fixed in 2024.2.3

- api: capabilities: properly set can\_save\_media when s3 is enabled (cherry-pick #8896) (#8897)
- enterprise: only check for valid license existing for creating Enterprise objects (cherry-pick #8813) (#8822)
- enterprise/rac: fix connection token management (cherry-pick #8909) (#8912)
- events: discard notification if user has empty email (cherry-pick #8938) (#8951)
- events: fix incorrect user logged when using API token authentication (#9302)
- lifecycle: migrate: ensure template schema exists before migrating (cherry-pick #8952) (#9022)
- stages/email: Disable autoescape for text templates (cherry-pick #8812) (#8824)
- stages/email: fix issue when sending emails to users with same display as email (cherry-pick #8850) (#8852)
- stages/user\_write: ensure user data is json-serializable (cherry-pick #8926) (#8928)
- tenants: really ensure default tenant cannot be deleted (cherry-pick #8875) (#8876)

## Fixed in 2024.2.4

- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10238)
- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.mdx), reported by Stefan Zwanenburg (cherry-pick #10229) (#10235)

## API Changes

#### What's New

***

##### `GET` /admin/settings/

##### `PUT` /admin/settings/

##### `PATCH` /admin/settings/

##### `GET` /core/brands/

##### `POST` /core/brands/

##### `GET` /core/brands/\{brand\_uuid}/

##### `PUT` /core/brands/\{brand\_uuid}/

##### `DELETE` /core/brands/\{brand\_uuid}/

##### `PATCH` /core/brands/\{brand\_uuid}/

##### `GET` /core/brands/\{brand\_uuid}/used\_by/

##### `GET` /core/brands/current/

##### `GET` /events/events/volume/

##### `GET` /events/system\_tasks/

##### `GET` /events/system\_tasks/\{uuid}/

##### `POST` /events/system\_tasks/\{uuid}/run/

##### `GET` /propertymappings/rac/

##### `POST` /propertymappings/rac/

##### `GET` /propertymappings/rac/\{pm\_uuid}/

##### `PUT` /propertymappings/rac/\{pm\_uuid}/

##### `DELETE` /propertymappings/rac/\{pm\_uuid}/

##### `PATCH` /propertymappings/rac/\{pm\_uuid}/

##### `GET` /propertymappings/rac/\{pm\_uuid}/used\_by/

##### `GET` /providers/rac/

##### `POST` /providers/rac/

##### `GET` /providers/rac/\{id}/

##### `PUT` /providers/rac/\{id}/

##### `DELETE` /providers/rac/\{id}/

##### `PATCH` /providers/rac/\{id}/

##### `GET` /providers/rac/\{id}/used\_by/

##### `GET` /rac/connection\_tokens/

##### `GET` /rac/connection\_tokens/\{connection\_token\_uuid}/

##### `PUT` /rac/connection\_tokens/\{connection\_token\_uuid}/

##### `DELETE` /rac/connection\_tokens/\{connection\_token\_uuid}/

##### `PATCH` /rac/connection\_tokens/\{connection\_token\_uuid}/

##### `GET` /rac/connection\_tokens/\{connection\_token\_uuid}/used\_by/

##### `GET` /rac/endpoints/

##### `POST` /rac/endpoints/

##### `GET` /rac/endpoints/\{pbm\_uuid}/

##### `PUT` /rac/endpoints/\{pbm\_uuid}/

##### `DELETE` /rac/endpoints/\{pbm\_uuid}/

##### `PATCH` /rac/endpoints/\{pbm\_uuid}/

##### `GET` /rac/endpoints/\{pbm\_uuid}/used\_by/

#### What's Deleted

***

##### `GET` /admin/system\_tasks/

##### `GET` /admin/system\_tasks/\{id}/

##### `POST` /admin/system\_tasks/\{id}/retry/

#### What's Changed

***

##### `GET` /admin/system/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `brand`
  - `embedded_outpost_disabled`

  New optional properties:

  - `tenant`

  * Added property `brand` (string)

    > Currently active brand

  * Added property `embedded_outpost_disabled` (boolean)

    > Whether the embedded outpost is disabled

  * Deleted property `tenant` (string)
    > Currently active tenant

##### `POST` /admin/system/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `brand`
  - `embedded_outpost_disabled`

  New optional properties:

  - `tenant`

  * Added property `brand` (string)

    > Currently active brand

  * Added property `embedded_outpost_disabled` (boolean)

    > Whether the embedded outpost is disabled

  * Deleted property `tenant` (string)
    > Currently active tenant

##### `GET` /core/applications/\{slug}/check\_access/

###### Return Type:

Deleted response : **404 Not Found**

> for\_user user not found

##### `GET` /core/authenticated\_sessions/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `asn`

  * Added property `asn` (object)

    > Get ASN Data

    - Property `asn` (integer)

    - Property `as_org` (string)

    - Property `network` (string)

  * Changed property `geo_ip` (object)
    > Get GeoIP Data

##### `GET` /events/events/actions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /managed/blueprints/\{instance\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `PUT` /managed/blueprints/\{instance\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `PATCH` /managed/blueprints/\{instance\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `POST` /managed/blueprints/\{instance\_uuid}/apply/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `GET` /outposts/service\_connections/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /outposts/service\_connections/kubernetes/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `PUT` /outposts/service\_connections/kubernetes/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `kubeconfig` (object -> object)
  > Paste your kubeconfig here. authentik will automatically use the currently selected context.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `PATCH` /outposts/service\_connections/kubernetes/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `kubeconfig` (object -> object)
  > Paste your kubeconfig here. authentik will automatically use the currently selected context.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `GET` /policies/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.tenants` - authentik Tenants
    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.brands` - authentik Brands
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise
    > - `authentik.enterprise.audit` - authentik Enterprise.Audit
    > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
    > - `authentik.events` - authentik Events

    Added enum values:

    - `authentik.brands`
    - `authentik.enterprise.audit`
    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > - `authentik_tenants.domain` - Domain
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_brands.brand` - Brand
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License
    > - `authentik_providers_rac.racprovider` - RAC Provider
    > - `authentik_providers_rac.endpoint` - RAC Endpoint
    > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

    Added enum values:

    - `authentik_tenants.domain`

    - `authentik_brands.brand`

    - `authentik_providers_rac.racprovider`

    - `authentik_providers_rac.endpoint`

    - `authentik_providers_rac.racpropertymapping`
      Removed enum values:

    - `authentik_policies_reputation.reputation`

    - `authentik_providers_oauth2.authorizationcode`

    - `authentik_providers_oauth2.accesstoken`

    - `authentik_providers_oauth2.refreshtoken`

    - `authentik_tenants.tenant`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.tenants` - authentik Tenants
  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.rbac` - authentik RBAC
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator` - authentik Stages.Authenticator
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.brands` - authentik Brands
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise
  > - `authentik.enterprise.audit` - authentik Enterprise.Audit
  > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
  > - `authentik.events` - authentik Events

  Added enum values:

  - `authentik.brands`
  - `authentik.enterprise.audit`
  - `authentik.enterprise.providers.rac`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.tenants` - authentik Tenants
    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.brands` - authentik Brands
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise
    > - `authentik.enterprise.audit` - authentik Enterprise.Audit
    > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
    > - `authentik.events` - authentik Events

    Added enum values:

    - `authentik.brands`
    - `authentik.enterprise.audit`
    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > - `authentik_tenants.domain` - Domain
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_brands.brand` - Brand
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License
    > - `authentik_providers_rac.racprovider` - RAC Provider
    > - `authentik_providers_rac.endpoint` - RAC Endpoint
    > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

    Added enum values:

    - `authentik_tenants.domain`

    - `authentik_brands.brand`

    - `authentik_providers_rac.racprovider`

    - `authentik_providers_rac.endpoint`

    - `authentik_providers_rac.racpropertymapping`
      Removed enum values:

    - `authentik_policies_reputation.reputation`

    - `authentik_providers_oauth2.authorizationcode`

    - `authentik_providers_oauth2.accesstoken`

    - `authentik_providers_oauth2.refreshtoken`

    - `authentik_tenants.tenant`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.tenants` - authentik Tenants
  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.rbac` - authentik RBAC
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator` - authentik Stages.Authenticator
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.brands` - authentik Brands
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise
  > - `authentik.enterprise.audit` - authentik Enterprise.Audit
  > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
  > - `authentik.events` - authentik Events

  Added enum values:

  - `authentik.brands`
  - `authentik.enterprise.audit`
  - `authentik.enterprise.providers.rac`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.tenants` - authentik Tenants
    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.brands` - authentik Brands
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise
    > - `authentik.enterprise.audit` - authentik Enterprise.Audit
    > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
    > - `authentik.events` - authentik Events

    Added enum values:

    - `authentik.brands`
    - `authentik.enterprise.audit`
    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > - `authentik_tenants.domain` - Domain
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_brands.brand` - Brand
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License
    > - `authentik_providers_rac.racprovider` - RAC Provider
    > - `authentik_providers_rac.endpoint` - RAC Endpoint
    > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

    Added enum values:

    - `authentik_tenants.domain`

    - `authentik_brands.brand`

    - `authentik_providers_rac.racprovider`

    - `authentik_providers_rac.endpoint`

    - `authentik_providers_rac.racpropertymapping`
      Removed enum values:

    - `authentik_policies_reputation.reputation`

    - `authentik_providers_oauth2.authorizationcode`

    - `authentik_providers_oauth2.accesstoken`

    - `authentik_providers_oauth2.refreshtoken`

    - `authentik_tenants.tenant`

##### `GET` /policies/reputation/scores/\{reputation\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `ip_asn_data` (object)

  - Changed property `ip_geo_data` (object -> object)

##### `GET` /propertymappings/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /providers/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /providers/oauth2/\{id}/preview\_user/

###### Parameters:

Added: `for_user` in `query`

##### `GET` /providers/saml/\{id}/preview\_user/

###### Parameters:

Added: `for_user` in `query`

##### `GET` /providers/scim/\{id}/sync\_status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `is_running`
  - `tasks`

  New optional properties:

  - `messages`
  - `status`
  - `task_description`
  - `task_duration`
  - `task_finish_timestamp`
  - `task_name`

  * Added property `is_running` (boolean)

  * Added property `tasks` (array)

    Items (object): > Serialize TaskInfo and TaskResult

    - Property `uuid` (string)

    - Property `name` (string)

    - Property `full_name` (string)

      > Get full name with UID

    - Property `uid` (string)

    - Property `description` (string)

    - Property `start_timestamp` (string)

    - Property `finish_timestamp` (string)

    - Property `duration` (number)

    - Property `status` (string)

      > - `unknown` - UNKNOWN
      > - `successful` - SUCCESSFUL
      > - `warning` - WARNING
      > - `error` - ERROR

      Enum values:

      - `unknown`
      - `successful`
      - `warning`
      - `error`

    - Property `messages` (array)

      Items (string):

  * Deleted property `task_name` (string)

  * Deleted property `task_description` (string)

  * Deleted property `task_finish_timestamp` (string)

  * Deleted property `task_duration` (integer)

    > Get the duration a task took to run

  * Deleted property `status` (object)

  * Deleted property `messages` (array)

##### `GET` /schema/

###### Parameters:

Changed: `lang` in `query`

##### `GET` /sources/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /sources/ldap/\{slug}/sync\_status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

##### `GET` /sources/oauth/source\_types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serializer for SourceType

  New required properties:

  - `verbose_name`

  New optional properties:

  - `slug`

  * Added property `verbose_name` (string)

  * Deleted property `slug` (string)

##### `GET` /stages/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /stages/email/templates/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `requires_enterprise` (boolean)

##### `GET` /authenticators/duo/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /authenticators/sms/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /authenticators/static/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /authenticators/totp/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /authenticators/webauthn/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/applications/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/authenticated\_sessions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatedSession Serializer

    New required properties:

    - `asn`

    * Added property `asn` (object)

      > Get ASN Data

    * Changed property `geo_ip` (object)
      > Get GeoIP Data

##### `GET` /core/authenticated\_sessions/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/groups/\{group\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `PUT` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `PATCH` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /core/tokens/\{identifier}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/user\_consent/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `avatar` (string)
    > User's avatar, either a http/https URL or a data URI

##### `PUT` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `avatar` (string)
    > User's avatar, either a http/https URL or a data URI

##### `PATCH` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `avatar` (string)
    > User's avatar, either a http/https URL or a data URI

##### `GET` /core/users/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /crypto/certificatekeypairs/\{kp\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /enterprise/license/\{license\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /events/events/\{event\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `brand` (object)

  - Deleted property `tenant` (object)

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

##### `PUT` /events/events/\{event\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `brand` (object)

- Deleted property `tenant` (object)

- Changed property `user` (object -> object)

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `brand` (object)

  - Deleted property `tenant` (object)

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

##### `PATCH` /events/events/\{event\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `brand` (object)

- Deleted property `tenant` (object)

- Changed property `user` (object -> object)

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `brand` (object)

  - Deleted property `tenant` (object)

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

##### `GET` /events/notifications/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /events/rules/\{pbm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /events/transports/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /flows/bindings/\{fsb\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /flows/instances/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > - `none` - None
    > - `require_authenticated` - Require Authenticated
    > - `require_unauthenticated` - Require Unauthenticated
    > - `require_superuser` - Require Superuser
    > - `require_outpost` - Require Outpost

    Added enum value:

    - `require_outpost`

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

##### `PUT` /flows/instances/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

  > - `none` - None
  > - `require_authenticated` - Require Authenticated
  > - `require_unauthenticated` - Require Unauthenticated
  > - `require_superuser` - Require Superuser
  > - `require_outpost` - Require Outpost

  Added enum value:

  - `require_outpost`

- Changed property `layout` (string)
  > - `stacked` - Stacked
  > - `content_left` - Content Left
  > - `content_right` - Content Right
  > - `sidebar_left` - Sidebar Left
  > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > - `none` - None
    > - `require_authenticated` - Require Authenticated
    > - `require_unauthenticated` - Require Unauthenticated
    > - `require_superuser` - Require Superuser
    > - `require_outpost` - Require Outpost

    Added enum value:

    - `require_outpost`

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

##### `PATCH` /flows/instances/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

  > - `none` - None
  > - `require_authenticated` - Require Authenticated
  > - `require_unauthenticated` - Require Unauthenticated
  > - `require_superuser` - Require Superuser
  > - `require_outpost` - Require Outpost

  Added enum value:

  - `require_outpost`

- Changed property `layout` (string)
  > - `stacked` - Stacked
  > - `content_left` - Content Left
  > - `content_right` - Content Right
  > - `sidebar_left` - Sidebar Left
  > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > - `none` - None
    > - `require_authenticated` - Require Authenticated
    > - `require_unauthenticated` - Require Unauthenticated
    > - `require_superuser` - Require Superuser
    > - `require_outpost` - Require Outpost

    Added enum value:

    - `require_outpost`

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

##### `GET` /flows/instances/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `POST` /managed/blueprints/

###### Request:

Changed content type : `application/json`

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `GET` /managed/blueprints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Info about a single blueprint instance file

    - Changed property `context` (object -> object)

    - Changed property `metadata` (object -> object)

##### `GET` /managed/blueprints/\{instance\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /oauth2/access\_tokens/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /oauth2/authorization\_codes/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /oauth2/refresh\_tokens/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius
    > - `rac` - Rac

    Added enum value:

    - `rac`

##### `PUT` /outposts/instances/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

  > - `proxy` - Proxy
  > - `ldap` - Ldap
  > - `radius` - Radius
  > - `rac` - Rac

  Added enum value:

  - `rac`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius
    > - `rac` - Rac

    Added enum value:

    - `rac`

##### `PATCH` /outposts/instances/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

  > - `proxy` - Proxy
  > - `ldap` - Ldap
  > - `radius` - Radius
  > - `rac` - Rac

  Added enum value:

  - `rac`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius
    > - `rac` - Rac

    Added enum value:

    - `rac`

##### `GET` /outposts/instances/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /outposts/service\_connections/all/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /outposts/service\_connections/docker/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `POST` /outposts/service\_connections/kubernetes/

###### Request:

Changed content type : `application/json`

- Changed property `kubeconfig` (object -> object)
  > Paste your kubeconfig here. authentik will automatically use the currently selected context.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `GET` /outposts/service\_connections/kubernetes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > KubernetesServiceConnection Serializer

    - Changed property `kubeconfig` (object -> object)
      > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `GET` /outposts/service\_connections/kubernetes/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/all/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/dummy/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > - `authentik.tenants` - authentik Tenants
  > - `authentik.admin` - authentik Admin
  > - `authentik.api` - authentik API
  > - `authentik.crypto` - authentik Crypto
  > - `authentik.flows` - authentik Flows
  > - `authentik.outposts` - authentik Outpost
  > - `authentik.policies.dummy` - authentik Policies.Dummy
  > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
  > - `authentik.policies.expiry` - authentik Policies.Expiry
  > - `authentik.policies.expression` - authentik Policies.Expression
  > - `authentik.policies.password` - authentik Policies.Password
  > - `authentik.policies.reputation` - authentik Policies.Reputation
  > - `authentik.policies` - authentik Policies
  > - `authentik.providers.ldap` - authentik Providers.LDAP
  > - `authentik.providers.oauth2` - authentik Providers.OAuth2
  > - `authentik.providers.proxy` - authentik Providers.Proxy
  > - `authentik.providers.radius` - authentik Providers.Radius
  > - `authentik.providers.saml` - authentik Providers.SAML
  > - `authentik.providers.scim` - authentik Providers.SCIM
  > - `authentik.rbac` - authentik RBAC
  > - `authentik.recovery` - authentik Recovery
  > - `authentik.sources.ldap` - authentik Sources.LDAP
  > - `authentik.sources.oauth` - authentik Sources.OAuth
  > - `authentik.sources.plex` - authentik Sources.Plex
  > - `authentik.sources.saml` - authentik Sources.SAML
  > - `authentik.stages.authenticator` - authentik Stages.Authenticator
  > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
  > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
  > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
  > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
  > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
  > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
  > - `authentik.stages.captcha` - authentik Stages.Captcha
  > - `authentik.stages.consent` - authentik Stages.Consent
  > - `authentik.stages.deny` - authentik Stages.Deny
  > - `authentik.stages.dummy` - authentik Stages.Dummy
  > - `authentik.stages.email` - authentik Stages.Email
  > - `authentik.stages.identification` - authentik Stages.Identification
  > - `authentik.stages.invitation` - authentik Stages.User Invitation
  > - `authentik.stages.password` - authentik Stages.Password
  > - `authentik.stages.prompt` - authentik Stages.Prompt
  > - `authentik.stages.user_delete` - authentik Stages.User Delete
  > - `authentik.stages.user_login` - authentik Stages.User Login
  > - `authentik.stages.user_logout` - authentik Stages.User Logout
  > - `authentik.stages.user_write` - authentik Stages.User Write
  > - `authentik.brands` - authentik Brands
  > - `authentik.blueprints` - authentik Blueprints
  > - `authentik.core` - authentik Core
  > - `authentik.enterprise` - authentik Enterprise
  > - `authentik.enterprise.audit` - authentik Enterprise.Audit
  > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
  > - `authentik.events` - authentik Events

  Added enum values:

  - `authentik.brands`
  - `authentik.enterprise.audit`
  - `authentik.enterprise.providers.rac`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > - `authentik.tenants` - authentik Tenants
    > - `authentik.admin` - authentik Admin
    > - `authentik.api` - authentik API
    > - `authentik.crypto` - authentik Crypto
    > - `authentik.flows` - authentik Flows
    > - `authentik.outposts` - authentik Outpost
    > - `authentik.policies.dummy` - authentik Policies.Dummy
    > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
    > - `authentik.policies.expiry` - authentik Policies.Expiry
    > - `authentik.policies.expression` - authentik Policies.Expression
    > - `authentik.policies.password` - authentik Policies.Password
    > - `authentik.policies.reputation` - authentik Policies.Reputation
    > - `authentik.policies` - authentik Policies
    > - `authentik.providers.ldap` - authentik Providers.LDAP
    > - `authentik.providers.oauth2` - authentik Providers.OAuth2
    > - `authentik.providers.proxy` - authentik Providers.Proxy
    > - `authentik.providers.radius` - authentik Providers.Radius
    > - `authentik.providers.saml` - authentik Providers.SAML
    > - `authentik.providers.scim` - authentik Providers.SCIM
    > - `authentik.rbac` - authentik RBAC
    > - `authentik.recovery` - authentik Recovery
    > - `authentik.sources.ldap` - authentik Sources.LDAP
    > - `authentik.sources.oauth` - authentik Sources.OAuth
    > - `authentik.sources.plex` - authentik Sources.Plex
    > - `authentik.sources.saml` - authentik Sources.SAML
    > - `authentik.stages.authenticator` - authentik Stages.Authenticator
    > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
    > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
    > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
    > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
    > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
    > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
    > - `authentik.stages.captcha` - authentik Stages.Captcha
    > - `authentik.stages.consent` - authentik Stages.Consent
    > - `authentik.stages.deny` - authentik Stages.Deny
    > - `authentik.stages.dummy` - authentik Stages.Dummy
    > - `authentik.stages.email` - authentik Stages.Email
    > - `authentik.stages.identification` - authentik Stages.Identification
    > - `authentik.stages.invitation` - authentik Stages.User Invitation
    > - `authentik.stages.password` - authentik Stages.Password
    > - `authentik.stages.prompt` - authentik Stages.Prompt
    > - `authentik.stages.user_delete` - authentik Stages.User Delete
    > - `authentik.stages.user_login` - authentik Stages.User Login
    > - `authentik.stages.user_logout` - authentik Stages.User Logout
    > - `authentik.stages.user_write` - authentik Stages.User Write
    > - `authentik.brands` - authentik Brands
    > - `authentik.blueprints` - authentik Blueprints
    > - `authentik.core` - authentik Core
    > - `authentik.enterprise` - authentik Enterprise
    > - `authentik.enterprise.audit` - authentik Enterprise.Audit
    > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
    > - `authentik.events` - authentik Events

    Added enum values:

    - `authentik.brands`
    - `authentik.enterprise.audit`
    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > - `authentik_tenants.domain` - Domain
    > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
    > - `authentik_flows.flow` - Flow
    > - `authentik_flows.flowstagebinding` - Flow Stage Binding
    > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
    > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
    > - `authentik_outposts.outpost` - Outpost
    > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
    > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
    > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
    > - `authentik_policies_expression.expressionpolicy` - Expression Policy
    > - `authentik_policies_password.passwordpolicy` - Password Policy
    > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
    > - `authentik_policies.policybinding` - Policy Binding
    > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
    > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
    > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
    > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
    > - `authentik_providers_radius.radiusprovider` - Radius Provider
    > - `authentik_providers_saml.samlprovider` - SAML Provider
    > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
    > - `authentik_providers_scim.scimprovider` - SCIM Provider
    > - `authentik_providers_scim.scimmapping` - SCIM Mapping
    > - `authentik_rbac.role` - Role
    > - `authentik_sources_ldap.ldapsource` - LDAP Source
    > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
    > - `authentik_sources_oauth.oauthsource` - OAuth Source
    > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
    > - `authentik_sources_plex.plexsource` - Plex Source
    > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
    > - `authentik_sources_saml.samlsource` - SAML Source
    > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
    > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
    > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
    > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
    > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
    > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
    > - `authentik_stages_authenticator_static.staticdevice` - Static Device
    > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
    > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
    > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
    > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
    > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
    > - `authentik_stages_captcha.captchastage` - Captcha Stage
    > - `authentik_stages_consent.consentstage` - Consent Stage
    > - `authentik_stages_consent.userconsent` - User Consent
    > - `authentik_stages_deny.denystage` - Deny Stage
    > - `authentik_stages_dummy.dummystage` - Dummy Stage
    > - `authentik_stages_email.emailstage` - Email Stage
    > - `authentik_stages_identification.identificationstage` - Identification Stage
    > - `authentik_stages_invitation.invitationstage` - Invitation Stage
    > - `authentik_stages_invitation.invitation` - Invitation
    > - `authentik_stages_password.passwordstage` - Password Stage
    > - `authentik_stages_prompt.prompt` - Prompt
    > - `authentik_stages_prompt.promptstage` - Prompt Stage
    > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
    > - `authentik_stages_user_login.userloginstage` - User Login Stage
    > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
    > - `authentik_stages_user_write.userwritestage` - User Write Stage
    > - `authentik_brands.brand` - Brand
    > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
    > - `authentik_core.group` - Group
    > - `authentik_core.user` - User
    > - `authentik_core.application` - Application
    > - `authentik_core.token` - Token
    > - `authentik_enterprise.license` - License
    > - `authentik_providers_rac.racprovider` - RAC Provider
    > - `authentik_providers_rac.endpoint` - RAC Endpoint
    > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
    > - `authentik_events.event` - Event
    > - `authentik_events.notificationtransport` - Notification Transport
    > - `authentik_events.notification` - Notification
    > - `authentik_events.notificationrule` - Notification Rule
    > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

    Added enum values:

    - `authentik_tenants.domain`

    - `authentik_brands.brand`

    - `authentik_providers_rac.racprovider`

    - `authentik_providers_rac.endpoint`

    - `authentik_providers_rac.racpropertymapping`
      Removed enum values:

    - `authentik_policies_reputation.reputation`

    - `authentik_providers_oauth2.authorizationcode`

    - `authentik_providers_oauth2.accesstoken`

    - `authentik_providers_oauth2.refreshtoken`

    - `authentik_tenants.tenant`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > - `authentik.tenants` - authentik Tenants
      > - `authentik.admin` - authentik Admin
      > - `authentik.api` - authentik API
      > - `authentik.crypto` - authentik Crypto
      > - `authentik.flows` - authentik Flows
      > - `authentik.outposts` - authentik Outpost
      > - `authentik.policies.dummy` - authentik Policies.Dummy
      > - `authentik.policies.event_matcher` - authentik Policies.Event Matcher
      > - `authentik.policies.expiry` - authentik Policies.Expiry
      > - `authentik.policies.expression` - authentik Policies.Expression
      > - `authentik.policies.password` - authentik Policies.Password
      > - `authentik.policies.reputation` - authentik Policies.Reputation
      > - `authentik.policies` - authentik Policies
      > - `authentik.providers.ldap` - authentik Providers.LDAP
      > - `authentik.providers.oauth2` - authentik Providers.OAuth2
      > - `authentik.providers.proxy` - authentik Providers.Proxy
      > - `authentik.providers.radius` - authentik Providers.Radius
      > - `authentik.providers.saml` - authentik Providers.SAML
      > - `authentik.providers.scim` - authentik Providers.SCIM
      > - `authentik.rbac` - authentik RBAC
      > - `authentik.recovery` - authentik Recovery
      > - `authentik.sources.ldap` - authentik Sources.LDAP
      > - `authentik.sources.oauth` - authentik Sources.OAuth
      > - `authentik.sources.plex` - authentik Sources.Plex
      > - `authentik.sources.saml` - authentik Sources.SAML
      > - `authentik.stages.authenticator` - authentik Stages.Authenticator
      > - `authentik.stages.authenticator_duo` - authentik Stages.Authenticator.Duo
      > - `authentik.stages.authenticator_sms` - authentik Stages.Authenticator.SMS
      > - `authentik.stages.authenticator_static` - authentik Stages.Authenticator.Static
      > - `authentik.stages.authenticator_totp` - authentik Stages.Authenticator.TOTP
      > - `authentik.stages.authenticator_validate` - authentik Stages.Authenticator.Validate
      > - `authentik.stages.authenticator_webauthn` - authentik Stages.Authenticator.WebAuthn
      > - `authentik.stages.captcha` - authentik Stages.Captcha
      > - `authentik.stages.consent` - authentik Stages.Consent
      > - `authentik.stages.deny` - authentik Stages.Deny
      > - `authentik.stages.dummy` - authentik Stages.Dummy
      > - `authentik.stages.email` - authentik Stages.Email
      > - `authentik.stages.identification` - authentik Stages.Identification
      > - `authentik.stages.invitation` - authentik Stages.User Invitation
      > - `authentik.stages.password` - authentik Stages.Password
      > - `authentik.stages.prompt` - authentik Stages.Prompt
      > - `authentik.stages.user_delete` - authentik Stages.User Delete
      > - `authentik.stages.user_login` - authentik Stages.User Login
      > - `authentik.stages.user_logout` - authentik Stages.User Logout
      > - `authentik.stages.user_write` - authentik Stages.User Write
      > - `authentik.brands` - authentik Brands
      > - `authentik.blueprints` - authentik Blueprints
      > - `authentik.core` - authentik Core
      > - `authentik.enterprise` - authentik Enterprise
      > - `authentik.enterprise.audit` - authentik Enterprise.Audit
      > - `authentik.enterprise.providers.rac` - authentik Enterprise.Providers.RAC
      > - `authentik.events` - authentik Events

      Added enum values:

      - `authentik.brands`
      - `authentik.enterprise.audit`
      - `authentik.enterprise.providers.rac`

    - Changed property `model` (string)

      > - `authentik_tenants.domain` - Domain
      > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
      > - `authentik_flows.flow` - Flow
      > - `authentik_flows.flowstagebinding` - Flow Stage Binding
      > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
      > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
      > - `authentik_outposts.outpost` - Outpost
      > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
      > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
      > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
      > - `authentik_policies_expression.expressionpolicy` - Expression Policy
      > - `authentik_policies_password.passwordpolicy` - Password Policy
      > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
      > - `authentik_policies.policybinding` - Policy Binding
      > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
      > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
      > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
      > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
      > - `authentik_providers_radius.radiusprovider` - Radius Provider
      > - `authentik_providers_saml.samlprovider` - SAML Provider
      > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
      > - `authentik_providers_scim.scimprovider` - SCIM Provider
      > - `authentik_providers_scim.scimmapping` - SCIM Mapping
      > - `authentik_rbac.role` - Role
      > - `authentik_sources_ldap.ldapsource` - LDAP Source
      > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
      > - `authentik_sources_oauth.oauthsource` - OAuth Source
      > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
      > - `authentik_sources_plex.plexsource` - Plex Source
      > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
      > - `authentik_sources_saml.samlsource` - SAML Source
      > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
      > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
      > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
      > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
      > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
      > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
      > - `authentik_stages_authenticator_static.staticdevice` - Static Device
      > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
      > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
      > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
      > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
      > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
      > - `authentik_stages_captcha.captchastage` - Captcha Stage
      > - `authentik_stages_consent.consentstage` - Consent Stage
      > - `authentik_stages_consent.userconsent` - User Consent
      > - `authentik_stages_deny.denystage` - Deny Stage
      > - `authentik_stages_dummy.dummystage` - Dummy Stage
      > - `authentik_stages_email.emailstage` - Email Stage
      > - `authentik_stages_identification.identificationstage` - Identification Stage
      > - `authentik_stages_invitation.invitationstage` - Invitation Stage
      > - `authentik_stages_invitation.invitation` - Invitation
      > - `authentik_stages_password.passwordstage` - Password Stage
      > - `authentik_stages_prompt.prompt` - Prompt
      > - `authentik_stages_prompt.promptstage` - Prompt Stage
      > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
      > - `authentik_stages_user_login.userloginstage` - User Login Stage
      > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
      > - `authentik_stages_user_write.userwritestage` - User Write Stage
      > - `authentik_brands.brand` - Brand
      > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
      > - `authentik_core.group` - Group
      > - `authentik_core.user` - User
      > - `authentik_core.application` - Application
      > - `authentik_core.token` - Token
      > - `authentik_enterprise.license` - License
      > - `authentik_providers_rac.racprovider` - RAC Provider
      > - `authentik_providers_rac.endpoint` - RAC Endpoint
      > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
      > - `authentik_events.event` - Event
      > - `authentik_events.notificationtransport` - Notification Transport
      > - `authentik_events.notification` - Notification
      > - `authentik_events.notificationrule` - Notification Rule
      > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

      Added enum values:

      - `authentik_tenants.domain`

      - `authentik_brands.brand`

      - `authentik_providers_rac.racprovider`

      - `authentik_providers_rac.endpoint`

      - `authentik_providers_rac.racpropertymapping`
        Removed enum values:

      - `authentik_policies_reputation.reputation`

      - `authentik_providers_oauth2.authorizationcode`

      - `authentik_providers_oauth2.accesstoken`

      - `authentik_providers_oauth2.refreshtoken`

      - `authentik_tenants.tenant`

##### `GET` /policies/event\_matcher/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/expression/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/password/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/password\_expiry/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/reputation/\{policy\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /policies/reputation/scores/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Reputation Serializer

    - Added property `ip_asn_data` (object)

    - Changed property `ip_geo_data` (object -> object)

##### `GET` /policies/reputation/scores/\{reputation\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /propertymappings/all/\{pm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /propertymappings/ldap/\{pm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /propertymappings/notification/\{pm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /propertymappings/saml/\{pm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /propertymappings/scim/\{pm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /propertymappings/scope/\{pm\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/all/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/ldap/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/oauth2/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/proxy/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/radius/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/saml/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /providers/scim/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  > - `authentik_tenants.domain` - Domain
  > - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
  > - `authentik_flows.flow` - Flow
  > - `authentik_flows.flowstagebinding` - Flow Stage Binding
  > - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
  > - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
  > - `authentik_outposts.outpost` - Outpost
  > - `authentik_policies_dummy.dummypolicy` - Dummy Policy
  > - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
  > - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
  > - `authentik_policies_expression.expressionpolicy` - Expression Policy
  > - `authentik_policies_password.passwordpolicy` - Password Policy
  > - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
  > - `authentik_policies.policybinding` - Policy Binding
  > - `authentik_providers_ldap.ldapprovider` - LDAP Provider
  > - `authentik_providers_oauth2.scopemapping` - Scope Mapping
  > - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
  > - `authentik_providers_proxy.proxyprovider` - Proxy Provider
  > - `authentik_providers_radius.radiusprovider` - Radius Provider
  > - `authentik_providers_saml.samlprovider` - SAML Provider
  > - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
  > - `authentik_providers_scim.scimprovider` - SCIM Provider
  > - `authentik_providers_scim.scimmapping` - SCIM Mapping
  > - `authentik_rbac.role` - Role
  > - `authentik_sources_ldap.ldapsource` - LDAP Source
  > - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
  > - `authentik_sources_oauth.oauthsource` - OAuth Source
  > - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
  > - `authentik_sources_plex.plexsource` - Plex Source
  > - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
  > - `authentik_sources_saml.samlsource` - SAML Source
  > - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
  > - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
  > - `authentik_stages_authenticator_duo.duodevice` - Duo Device
  > - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
  > - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
  > - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
  > - `authentik_stages_authenticator_static.staticdevice` - Static Device
  > - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
  > - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
  > - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
  > - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
  > - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
  > - `authentik_stages_captcha.captchastage` - Captcha Stage
  > - `authentik_stages_consent.consentstage` - Consent Stage
  > - `authentik_stages_consent.userconsent` - User Consent
  > - `authentik_stages_deny.denystage` - Deny Stage
  > - `authentik_stages_dummy.dummystage` - Dummy Stage
  > - `authentik_stages_email.emailstage` - Email Stage
  > - `authentik_stages_identification.identificationstage` - Identification Stage
  > - `authentik_stages_invitation.invitationstage` - Invitation Stage
  > - `authentik_stages_invitation.invitation` - Invitation
  > - `authentik_stages_password.passwordstage` - Password Stage
  > - `authentik_stages_prompt.prompt` - Prompt
  > - `authentik_stages_prompt.promptstage` - Prompt Stage
  > - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
  > - `authentik_stages_user_login.userloginstage` - User Login Stage
  > - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
  > - `authentik_stages_user_write.userwritestage` - User Write Stage
  > - `authentik_brands.brand` - Brand
  > - `authentik_blueprints.blueprintinstance` - Blueprint Instance
  > - `authentik_core.group` - Group
  > - `authentik_core.user` - User
  > - `authentik_core.application` - Application
  > - `authentik_core.token` - Token
  > - `authentik_enterprise.license` - License
  > - `authentik_providers_rac.racprovider` - RAC Provider
  > - `authentik_providers_rac.endpoint` - RAC Endpoint
  > - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
  > - `authentik_events.event` - Event
  > - `authentik_events.notificationtransport` - Notification Transport
  > - `authentik_events.notification` - Notification
  > - `authentik_events.notificationrule` - Notification Rule
  > - `authentik_events.notificationwebhookmapping` - Webhook Mapping

  Added enum values:

  - `authentik_tenants.domain`

  - `authentik_brands.brand`

  - `authentik_providers_rac.racprovider`

  - `authentik_providers_rac.endpoint`

  - `authentik_providers_rac.racpropertymapping`
    Removed enum values:

  - `authentik_policies_reputation.reputation`

  - `authentik_providers_oauth2.authorizationcode`

  - `authentik_providers_oauth2.accesstoken`

  - `authentik_providers_oauth2.refreshtoken`

  - `authentik_tenants.tenant`

##### `GET` /rbac/roles/\{uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /root/config/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `capabilities` (array)

    Changed items (string): > \_ `can_save_media` - Can Save Media > \_ `can_geo_ip` - Can Geo Ip > \_ `can_asn` - Can Asn > \_ `can_impersonate` - Can Impersonate > \_ `can_debug` - Can Debug > \_ `is_enterprise` - Is Enterprise

    Added enum value:

    - `can_asn`

##### `GET` /sources/all/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `connectivity`

  * Added property `connectivity` (object)
    > Get cached source connectivity

##### `PUT` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `connectivity`

  * Added property `connectivity` (object)
    > Get cached source connectivity

##### `PATCH` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `connectivity`

  * Added property `connectivity` (object)
    > Get cached source connectivity

##### `GET` /sources/ldap/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `verbose_name`

    New optional properties:

    - `slug`

    * Added property `verbose_name` (string)

    * Deleted property `slug` (string)

  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)
    > - `apple` - Apple
    > - `openidconnect` - OpenID Connect
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

##### `PUT` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `oidc_jwks` (object -> object)

- Changed property `provider_type` (string)
  > - `apple` - Apple
  > - `openidconnect` - OpenID Connect
  > - `azuread` - Azure AD
  > - `discord` - Discord
  > - `facebook` - Facebook
  > - `github` - GitHub
  > - `google` - Google
  > - `mailcow` - Mailcow
  > - `okta` - Okta
  > - `patreon` - Patreon
  > - `reddit` - Reddit
  > - `twitch` - Twitch
  > - `twitter` - Twitter

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `verbose_name`

    New optional properties:

    - `slug`

    * Added property `verbose_name` (string)

    * Deleted property `slug` (string)

  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)
    > - `apple` - Apple
    > - `openidconnect` - OpenID Connect
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

##### `PATCH` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `oidc_jwks` (object -> object)

- Changed property `provider_type` (string)
  > - `apple` - Apple
  > - `openidconnect` - OpenID Connect
  > - `azuread` - Azure AD
  > - `discord` - Discord
  > - `facebook` - Facebook
  > - `github` - GitHub
  > - `google` - Google
  > - `mailcow` - Mailcow
  > - `okta` - Okta
  > - `patreon` - Patreon
  > - `reddit` - Reddit
  > - `twitch` - Twitch
  > - `twitter` - Twitter

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `verbose_name`

    New optional properties:

    - `slug`

    * Added property `verbose_name` (string)

    * Deleted property `slug` (string)

  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)
    > - `apple` - Apple
    > - `openidconnect` - OpenID Connect
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

##### `GET` /sources/oauth/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/plex/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/saml/\{slug}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/user\_connections/all/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/user\_connections/oauth/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/user\_connections/plex/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /sources/user\_connections/saml/\{id}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/all/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/authenticator/duo/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/authenticator/sms/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/authenticator/static/\{stage\_uuid}/used\_by/

###### Parameters:

Changed: `stage_uuid` in `path`

> A UUID string identifying this Static Authenticator Setup Stage.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/authenticator/totp/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/authenticator/validate/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/authenticator/webauthn/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/captcha/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/consent/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/deny/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/dummy/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/email/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/identification/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > - `none` - None
      > - `require_authenticated` - Require Authenticated
      > - `require_unauthenticated` - Require Unauthenticated
      > - `require_superuser` - Require Superuser
      > - `require_outpost` - Require Outpost

      Added enum value:

      - `require_outpost`

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > - `none` - None
      > - `require_authenticated` - Require Authenticated
      > - `require_unauthenticated` - Require Unauthenticated
      > - `require_superuser` - Require Superuser
      > - `require_outpost` - Require Outpost

      Added enum value:

      - `require_outpost`

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/invitation/invitations/\{invite\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > - `none` - None
      > - `require_authenticated` - Require Authenticated
      > - `require_unauthenticated` - Require Unauthenticated
      > - `require_superuser` - Require Superuser
      > - `require_outpost` - Require Outpost

      Added enum value:

      - `require_outpost`

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/invitation/invitations/\{invite\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/invitation/stages/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/password/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/prompt/prompts/\{prompt\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/prompt/stages/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/user\_delete/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/user\_login/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/user\_logout/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /stages/user\_write/\{stage\_uuid}/used\_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > A list of all objects referencing the queried object

  - Changed property `action` (string)

    > - `cascade` - CASCADE
    > - `cascade_many` - CASCADE\_MANY
    > - `set_null` - SET\_NULL
    > - `set_default` - SET\_DEFAULT

    Added enum values:

    - `cascade`

    - `cascade_many`

    - `set_null`

    - `set_default`
      Removed enum values:

    - `CASCADE`

    - `CASCADE_MANY`

    - `SET_NULL`

    - `SET_DEFAULT`

##### `GET` /core/applications/

###### Parameters:

Added: `for_user` in `query`

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      - Changed property `avatar` (string)
        > User's avatar, either a http/https URL or a data URI

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `expiring` (boolean)

  - Changed property `user` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `avatar` (string)
    > User's avatar, either a http/https URL or a data URI

##### `GET` /core/users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /core/users/me/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer for information a user can retrieve about themselves

    - Changed property `avatar` (string)

      > User's avatar, either a http/https URL or a data URI

    - Changed property `settings` (object)
      > Get user settings with brand and group settings applied

##### `POST` /events/events/

###### Request:

Changed content type : `application/json`

- Added property `brand` (object)

- Deleted property `tenant` (object)

- Changed property `user` (object -> object)

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `brand` (object)

  - Deleted property `tenant` (object)

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

##### `GET` /events/events/

###### Parameters:

Added: `brand_name` in `query`

> Brand name

Deleted: `tenant_name` in `query`

> Tenant name

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Serializer

    - Added property `brand` (object)

    - Deleted property `tenant` (object)

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

##### `GET` /events/notifications/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Added property `brand` (object)

    - Deleted property `tenant` (object)

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

##### `PUT` /events/notifications/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

  > Event Serializer

  - Added property `brand` (object)

  - Deleted property `tenant` (object)

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Added property `brand` (object)

    - Deleted property `tenant` (object)

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

##### `PATCH` /events/notifications/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

  > Event Serializer

  - Added property `brand` (object)

  - Deleted property `tenant` (object)

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Added property `brand` (object)

    - Deleted property `tenant` (object)

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

##### `GET` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `PUT` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `PATCH` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

  > - `none` - None
  > - `require_authenticated` - Require Authenticated
  > - `require_unauthenticated` - Require Unauthenticated
  > - `require_superuser` - Require Superuser
  > - `require_outpost` - Require Outpost

  Added enum value:

  - `require_outpost`

- Changed property `layout` (string)
  > - `stacked` - Stacked
  > - `content_left` - Content Left
  > - `content_right` - Content Right
  > - `sidebar_left` - Sidebar Left
  > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `authentication` (string)

    > - `none` - None
    > - `require_authenticated` - Require Authenticated
    > - `require_unauthenticated` - Require Unauthenticated
    > - `require_superuser` - Require Superuser
    > - `require_outpost` - Require Outpost

    Added enum value:

    - `require_outpost`

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

##### `GET` /flows/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Flow Serializer

    - Changed property `authentication` (string)

      > - `none` - None
      > - `require_authenticated` - Require Authenticated
      > - `require_unauthenticated` - Require Unauthenticated
      > - `require_superuser` - Require Superuser
      > - `require_outpost` - Require Outpost

      Added enum value:

      - `require_outpost`

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `POST` /outposts/instances/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

  > - `proxy` - Proxy
  > - `ldap` - Ldap
  > - `radius` - Radius
  > - `rac` - Rac

  Added enum value:

  - `rac`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `type` (string)

    > - `proxy` - Proxy
    > - `ldap` - Ldap
    > - `radius` - Radius
    > - `rac` - Rac

    Added enum value:

    - `rac`

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Outpost Serializer

    - Changed property `type` (string)

      > - `proxy` - Proxy
      > - `ldap` - Ldap
      > - `radius` - Radius
      > - `rac` - Rac

      Added enum value:

      - `rac`

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    - Changed property `avatar` (string)
      > User's avatar, either a http/https URL or a data URI

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      - Changed property `avatar` (string)
        > User's avatar, either a http/https URL or a data URI

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

> - `authentik_tenants.domain` - Domain
> - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
> - `authentik_flows.flow` - Flow
> - `authentik_flows.flowstagebinding` - Flow Stage Binding
> - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
> - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
> - `authentik_outposts.outpost` - Outpost
> - `authentik_policies_dummy.dummypolicy` - Dummy Policy
> - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
> - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
> - `authentik_policies_expression.expressionpolicy` - Expression Policy
> - `authentik_policies_password.passwordpolicy` - Password Policy
> - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
> - `authentik_policies.policybinding` - Policy Binding
> - `authentik_providers_ldap.ldapprovider` - LDAP Provider
> - `authentik_providers_oauth2.scopemapping` - Scope Mapping
> - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
> - `authentik_providers_proxy.proxyprovider` - Proxy Provider
> - `authentik_providers_radius.radiusprovider` - Radius Provider
> - `authentik_providers_saml.samlprovider` - SAML Provider
> - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
> - `authentik_providers_scim.scimprovider` - SCIM Provider
> - `authentik_providers_scim.scimmapping` - SCIM Mapping
> - `authentik_rbac.role` - Role
> - `authentik_sources_ldap.ldapsource` - LDAP Source
> - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
> - `authentik_sources_oauth.oauthsource` - OAuth Source
> - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
> - `authentik_sources_plex.plexsource` - Plex Source
> - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
> - `authentik_sources_saml.samlsource` - SAML Source
> - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
> - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
> - `authentik_stages_authenticator_duo.duodevice` - Duo Device
> - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
> - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
> - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
> - `authentik_stages_authenticator_static.staticdevice` - Static Device
> - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
> - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
> - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
> - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
> - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
> - `authentik_stages_captcha.captchastage` - Captcha Stage
> - `authentik_stages_consent.consentstage` - Consent Stage
> - `authentik_stages_consent.userconsent` - User Consent
> - `authentik_stages_deny.denystage` - Deny Stage
> - `authentik_stages_dummy.dummystage` - Dummy Stage
> - `authentik_stages_email.emailstage` - Email Stage
> - `authentik_stages_identification.identificationstage` - Identification Stage
> - `authentik_stages_invitation.invitationstage` - Invitation Stage
> - `authentik_stages_invitation.invitation` - Invitation
> - `authentik_stages_password.passwordstage` - Password Stage
> - `authentik_stages_prompt.prompt` - Prompt
> - `authentik_stages_prompt.promptstage` - Prompt Stage
> - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
> - `authentik_stages_user_login.userloginstage` - User Login Stage
> - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
> - `authentik_stages_user_write.userwritestage` - User Write Stage
> - `authentik_brands.brand` - Brand
> - `authentik_blueprints.blueprintinstance` - Blueprint Instance
> - `authentik_core.group` - Group
> - `authentik_core.user` - User
> - `authentik_core.application` - Application
> - `authentik_core.token` - Token
> - `authentik_enterprise.license` - License
> - `authentik_providers_rac.racprovider` - RAC Provider
> - `authentik_providers_rac.endpoint` - RAC Endpoint
> - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
> - `authentik_events.event` - Event
> - `authentik_events.notificationtransport` - Notification Transport
> - `authentik_events.notification` - Notification
> - `authentik_events.notificationrule` - Notification Rule
> - `authentik_events.notificationwebhookmapping` - Webhook Mapping

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

> - `authentik_tenants.domain` - Domain
> - `authentik_crypto.certificatekeypair` - Certificate-Key Pair
> - `authentik_flows.flow` - Flow
> - `authentik_flows.flowstagebinding` - Flow Stage Binding
> - `authentik_outposts.dockerserviceconnection` - Docker Service-Connection
> - `authentik_outposts.kubernetesserviceconnection` - Kubernetes Service-Connection
> - `authentik_outposts.outpost` - Outpost
> - `authentik_policies_dummy.dummypolicy` - Dummy Policy
> - `authentik_policies_event_matcher.eventmatcherpolicy` - Event Matcher Policy
> - `authentik_policies_expiry.passwordexpirypolicy` - Password Expiry Policy
> - `authentik_policies_expression.expressionpolicy` - Expression Policy
> - `authentik_policies_password.passwordpolicy` - Password Policy
> - `authentik_policies_reputation.reputationpolicy` - Reputation Policy
> - `authentik_policies.policybinding` - Policy Binding
> - `authentik_providers_ldap.ldapprovider` - LDAP Provider
> - `authentik_providers_oauth2.scopemapping` - Scope Mapping
> - `authentik_providers_oauth2.oauth2provider` - OAuth2/OpenID Provider
> - `authentik_providers_proxy.proxyprovider` - Proxy Provider
> - `authentik_providers_radius.radiusprovider` - Radius Provider
> - `authentik_providers_saml.samlprovider` - SAML Provider
> - `authentik_providers_saml.samlpropertymapping` - SAML Property Mapping
> - `authentik_providers_scim.scimprovider` - SCIM Provider
> - `authentik_providers_scim.scimmapping` - SCIM Mapping
> - `authentik_rbac.role` - Role
> - `authentik_sources_ldap.ldapsource` - LDAP Source
> - `authentik_sources_ldap.ldappropertymapping` - LDAP Property Mapping
> - `authentik_sources_oauth.oauthsource` - OAuth Source
> - `authentik_sources_oauth.useroauthsourceconnection` - User OAuth Source Connection
> - `authentik_sources_plex.plexsource` - Plex Source
> - `authentik_sources_plex.plexsourceconnection` - User Plex Source Connection
> - `authentik_sources_saml.samlsource` - SAML Source
> - `authentik_sources_saml.usersamlsourceconnection` - User SAML Source Connection
> - `authentik_stages_authenticator_duo.authenticatorduostage` - Duo Authenticator Setup Stage
> - `authentik_stages_authenticator_duo.duodevice` - Duo Device
> - `authentik_stages_authenticator_sms.authenticatorsmsstage` - SMS Authenticator Setup Stage
> - `authentik_stages_authenticator_sms.smsdevice` - SMS Device
> - `authentik_stages_authenticator_static.authenticatorstaticstage` - Static Authenticator Setup Stage
> - `authentik_stages_authenticator_static.staticdevice` - Static Device
> - `authentik_stages_authenticator_totp.authenticatortotpstage` - TOTP Authenticator Setup Stage
> - `authentik_stages_authenticator_totp.totpdevice` - TOTP Device
> - `authentik_stages_authenticator_validate.authenticatorvalidatestage` - Authenticator Validation Stage
> - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage` - WebAuthn Authenticator Setup Stage
> - `authentik_stages_authenticator_webauthn.webauthndevice` - WebAuthn Device
> - `authentik_stages_captcha.captchastage` - Captcha Stage
> - `authentik_stages_consent.consentstage` - Consent Stage
> - `authentik_stages_consent.userconsent` - User Consent
> - `authentik_stages_deny.denystage` - Deny Stage
> - `authentik_stages_dummy.dummystage` - Dummy Stage
> - `authentik_stages_email.emailstage` - Email Stage
> - `authentik_stages_identification.identificationstage` - Identification Stage
> - `authentik_stages_invitation.invitationstage` - Invitation Stage
> - `authentik_stages_invitation.invitation` - Invitation
> - `authentik_stages_password.passwordstage` - Password Stage
> - `authentik_stages_prompt.prompt` - Prompt
> - `authentik_stages_prompt.promptstage` - Prompt Stage
> - `authentik_stages_user_delete.userdeletestage` - User Delete Stage
> - `authentik_stages_user_login.userloginstage` - User Login Stage
> - `authentik_stages_user_logout.userlogoutstage` - User Logout Stage
> - `authentik_stages_user_write.userwritestage` - User Write Stage
> - `authentik_brands.brand` - Brand
> - `authentik_blueprints.blueprintinstance` - Blueprint Instance
> - `authentik_core.group` - Group
> - `authentik_core.user` - User
> - `authentik_core.application` - Application
> - `authentik_core.token` - Token
> - `authentik_enterprise.license` - License
> - `authentik_providers_rac.racprovider` - RAC Provider
> - `authentik_providers_rac.endpoint` - RAC Endpoint
> - `authentik_providers_rac.racpropertymapping` - RAC Property Mapping
> - `authentik_events.event` - Event
> - `authentik_events.notificationtransport` - Notification Transport
> - `authentik_events.notification` - Notification
> - `authentik_events.notificationrule` - Notification Rule
> - `authentik_events.notificationwebhookmapping` - Webhook Mapping

##### `POST` /sources/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `connectivity`

  * Added property `connectivity` (object)
    > Get cached source connectivity

##### `GET` /sources/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAP Source Serializer

    New required properties:

    - `connectivity`

    * Added property `connectivity` (object)
      > Get cached source connectivity

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `oidc_jwks` (object -> object)

- Changed property `provider_type` (string)
  > - `apple` - Apple
  > - `openidconnect` - OpenID Connect
  > - `azuread` - Azure AD
  > - `discord` - Discord
  > - `facebook` - Facebook
  > - `github` - GitHub
  > - `google` - Google
  > - `mailcow` - Mailcow
  > - `okta` - Okta
  > - `patreon` - Patreon
  > - `reddit` - Reddit
  > - `twitch` - Twitch
  > - `twitter` - Twitter

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `type` (object)

    > Serializer for SourceType

    New required properties:

    - `verbose_name`

    New optional properties:

    - `slug`

    * Added property `verbose_name` (string)

    * Deleted property `slug` (string)

  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)
    > - `apple` - Apple
    > - `openidconnect` - OpenID Connect
    > - `azuread` - Azure AD
    > - `discord` - Discord
    > - `facebook` - Facebook
    > - `github` - GitHub
    > - `google` - Google
    > - `mailcow` - Mailcow
    > - `okta` - Okta
    > - `patreon` - Patreon
    > - `reddit` - Reddit
    > - `twitch` - Twitch
    > - `twitter` - Twitter

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `type` (object)

      > Serializer for SourceType

      New required properties:

      - `verbose_name`

      New optional properties:

      - `slug`

      * Added property `verbose_name` (string)

      * Deleted property `slug` (string)

    - Changed property `oidc_jwks` (object -> object)

    - Changed property `provider_type` (string)
      > - `apple` - Apple
      > - `openidconnect` - OpenID Connect
      > - `azuread` - Azure AD
      > - `discord` - Discord
      > - `facebook` - Facebook
      > - `github` - GitHub
      > - `google` - Google
      > - `mailcow` - Mailcow
      > - `okta` - Okta
      > - `patreon` - Patreon
      > - `reddit` - Reddit
      > - `twitch` - Twitch
      > - `twitter` - Twitter

##### `GET` /stages/all/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/duo/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/authenticator/duo/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/sms/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/authenticator/sms/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `DELETE` /stages/authenticator/static/\{stage\_uuid}/

###### Parameters:

Changed: `stage_uuid` in `path`

> A UUID string identifying this Static Authenticator Setup Stage.

##### `GET` /stages/authenticator/static/\{stage\_uuid}/

###### Parameters:

Changed: `stage_uuid` in `path`

> A UUID string identifying this Static Authenticator Setup Stage.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/authenticator/static/\{stage\_uuid}/

###### Parameters:

Changed: `stage_uuid` in `path`

> A UUID string identifying this Static Authenticator Setup Stage.

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/authenticator/static/\{stage\_uuid}/

###### Parameters:

Changed: `stage_uuid` in `path`

> A UUID string identifying this Static Authenticator Setup Stage.

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/totp/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `digits` (integer -> string)

    > - `6` - 6 digits, widely compatible
    > - `8` - 8 digits, not compatible with apps like Google Authenticator

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/authenticator/totp/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `digits` (integer -> string)

  > - `6` - 6 digits, widely compatible
  > - `8` - 8 digits, not compatible with apps like Google Authenticator

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `digits` (integer -> string)

    > - `6` - 6 digits, widely compatible
    > - `8` - 8 digits, not compatible with apps like Google Authenticator

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/authenticator/totp/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `digits` (integer -> string)

  > - `6` - 6 digits, widely compatible
  > - `8` - 8 digits, not compatible with apps like Google Authenticator

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `digits` (integer -> string)

    > - `6` - 6 digits, widely compatible
    > - `8` - 8 digits, not compatible with apps like Google Authenticator

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/validate/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/consent/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/consent/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/consent/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/deny/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/deny/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/dummy/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/dummy/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/dummy/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/email/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/identification/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `pretend_user_exists` (boolean)

    > When enabled, the stage will succeed and continue even when incorrect user info is entered.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `pretend_user_exists` (boolean)

  > When enabled, the stage will succeed and continue even when incorrect user info is entered.

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `pretend_user_exists` (boolean)

    > When enabled, the stage will succeed and continue even when incorrect user info is entered.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/identification/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `pretend_user_exists` (boolean)

  > When enabled, the stage will succeed and continue even when incorrect user info is entered.

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `pretend_user_exists` (boolean)

    > When enabled, the stage will succeed and continue even when incorrect user info is entered.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_obj` (object)

    > Flow Serializer

    - Changed property `authentication` (string)

      > - `none` - None
      > - `require_authenticated` - Require Authenticated
      > - `require_unauthenticated` - Require Unauthenticated
      > - `require_superuser` - Require Superuser
      > - `require_outpost` - Require Outpost

      Added enum value:

      - `require_outpost`

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Invitation Serializer

    - Changed property `flow_obj` (object)

      > Flow Serializer

      - Changed property `authentication` (string)

        > - `none` - None
        > - `require_authenticated` - Require Authenticated
        > - `require_unauthenticated` - Require Unauthenticated
        > - `require_superuser` - Require Superuser
        > - `require_outpost` - Require Outpost

        Added enum value:

        - `require_outpost`

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `GET` /stages/invitation/stages/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/invitation/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/invitation/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/password/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/password/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/prompt/stages/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/prompt/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/prompt/stages/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_delete/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/user\_delete/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/user\_delete/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_login/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `network_binding` (object)

    > Bind sessions created by this stage to the configured network
    >
    > - `no_binding` - No Binding
    > - `bind_asn` - Bind Asn
    > - `bind_asn_network` - Bind Asn Network
    > - `bind_asn_network_ip` - Bind Asn Network Ip

    Enum values:

    - `no_binding`
    - `bind_asn`
    - `bind_asn_network`
    - `bind_asn_network_ip`

  - Added property `geoip_binding` (object)

    > Bind sessions created by this stage to the configured GeoIP location
    >
    > - `no_binding` - No Binding
    > - `bind_continent` - Bind Continent
    > - `bind_continent_country` - Bind Continent Country
    > - `bind_continent_country_city` - Bind Continent Country City

    Enum values:

    - `no_binding`
    - `bind_continent`
    - `bind_continent_country`
    - `bind_continent_country_city`

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `network_binding` (object)

  > Bind sessions created by this stage to the configured network
  >
  > - `no_binding` - No Binding
  > - `bind_asn` - Bind Asn
  > - `bind_asn_network` - Bind Asn Network
  > - `bind_asn_network_ip` - Bind Asn Network Ip

- Added property `geoip_binding` (object)

  > Bind sessions created by this stage to the configured GeoIP location
  >
  > - `no_binding` - No Binding
  > - `bind_continent` - Bind Continent
  > - `bind_continent_country` - Bind Continent Country
  > - `bind_continent_country_city` - Bind Continent Country City

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `network_binding` (object)

    > Bind sessions created by this stage to the configured network
    >
    > - `no_binding` - No Binding
    > - `bind_asn` - Bind Asn
    > - `bind_asn_network` - Bind Asn Network
    > - `bind_asn_network_ip` - Bind Asn Network Ip

  - Added property `geoip_binding` (object)

    > Bind sessions created by this stage to the configured GeoIP location
    >
    > - `no_binding` - No Binding
    > - `bind_continent` - Bind Continent
    > - `bind_continent_country` - Bind Continent Country
    > - `bind_continent_country_city` - Bind Continent Country City

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `network_binding` (object)

  > Bind sessions created by this stage to the configured network
  >
  > - `no_binding` - No Binding
  > - `bind_asn` - Bind Asn
  > - `bind_asn_network` - Bind Asn Network
  > - `bind_asn_network_ip` - Bind Asn Network Ip

- Added property `geoip_binding` (object)

  > Bind sessions created by this stage to the configured GeoIP location
  >
  > - `no_binding` - No Binding
  > - `bind_continent` - Bind Continent
  > - `bind_continent_country` - Bind Continent Country
  > - `bind_continent_country_city` - Bind Continent Country City

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `network_binding` (object)

    > Bind sessions created by this stage to the configured network
    >
    > - `no_binding` - No Binding
    > - `bind_asn` - Bind Asn
    > - `bind_asn_network` - Bind Asn Network
    > - `bind_asn_network_ip` - Bind Asn Network Ip

  - Added property `geoip_binding` (object)

    > Bind sessions created by this stage to the configured GeoIP location
    >
    > - `no_binding` - No Binding
    > - `bind_continent` - Bind Continent
    > - `bind_continent_country` - Bind Continent Country
    > - `bind_continent_country_city` - Bind Continent Country City

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_logout/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/user\_logout/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/user\_logout/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_write/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/user\_write/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider_model` (string)

  > - `authentik_providers_ldap.ldapprovider` - authentik\_providers\_ldap.ldapprovider
  > - `authentik_providers_oauth2.oauth2provider` - authentik\_providers\_oauth2.oauth2provider
  > - `authentik_providers_proxy.proxyprovider` - authentik\_providers\_proxy.proxyprovider
  > - `authentik_providers_rac.racprovider` - authentik\_providers\_rac.racprovider
  > - `authentik_providers_radius.radiusprovider` - authentik\_providers\_radius.radiusprovider
  > - `authentik_providers_saml.samlprovider` - authentik\_providers\_saml.samlprovider
  > - `authentik_providers_scim.scimprovider` - authentik\_providers\_scim.scimprovider

  Added enum value:

  - `authentik_providers_rac.racprovider`

- Changed property `provider` (object)

  Added 'authentik\_providers\_rac.racprovider' provider\_model:

  - Property `name` (string)

  - Property `authentication_flow` (string)

    > Flow used for authentication when the associated application is accessed by an un-authenticated user.

  - Property `authorization_flow` (string)

    > Flow used when authorizing this provider.

  - Property `property_mappings` (array)

    Items (string):

  - Property `settings` (object)

  - Property `connection_expiry` (string)

    > Determines how long a session lasts. Default of 0 means that the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)

  - Property `delete_token_on_disconnect` (boolean)
    > When set to true, connection tokens will be deleted upon disconnect.

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Added property `expiring` (boolean)

    - Changed property `user` (object)

      > User Serializer

      - Changed property `avatar` (string)
        > User's avatar, either a http/https URL or a data URI

##### `GET` /events/notifications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Notification Serializer

    - Changed property `event` (object)

      > Event Serializer

      - Added property `brand` (object)

      - Deleted property `tenant` (object)

      - Changed property `user` (object -> object)

      - Changed property `context` (object -> object)

##### `POST` /flows/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `stage_obj` (object)

    > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > FlowStageBinding Serializer

    - Changed property `stage_obj` (object)

      > Stage Serializer

      - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        - Changed property `layout` (string)
          > - `stacked` - Stacked
          > - `content_left` - Content Left
          > - `content_right` - Content Right
          > - `sidebar_left` - Sidebar Left
          > - `sidebar_right` - Sidebar Right

##### `GET` /flows/inspector/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `plans` (array)

    Changed items (object): > Serializer for an active FlowPlan

    - Changed property `current_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `stage_obj` (object)

        > Stage Serializer

        - Changed property `flow_set` (array)

          Changed items (object): > Stripped down flow serializer

          - Changed property `layout` (string)
            > - `stacked` - Stacked
            > - `content_left` - Content Left
            > - `content_right` - Content Right
            > - `sidebar_left` - Sidebar Left
            > - `sidebar_right` - Sidebar Right

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      - Changed property `avatar` (string)
        > User's avatar, either a http/https URL or a data URI

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `user` (object)

      > User Serializer

      - Changed property `avatar` (string)
        > User's avatar, either a http/https URL or a data URI

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      - Changed property `avatar` (string)
        > User's avatar, either a http/https URL or a data URI

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/authenticator/duo/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorDuoStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/authenticator/sms/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorSMSStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/authenticator/static/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorStaticStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/authenticator/totp/

###### Request:

Changed content type : `application/json`

- Changed property `digits` (integer -> string)

  > - `6` - 6 digits, widely compatible
  > - `8` - 8 digits, not compatible with apps like Google Authenticator

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `digits` (integer -> string)

    > - `6` - 6 digits, widely compatible
    > - `8` - 8 digits, not compatible with apps like Google Authenticator

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/totp/

###### Parameters:

Changed: `digits` in `query`

> - `6` - 6 digits, widely compatible
> - `8` - 8 digits, not compatible with apps like Google Authenticator

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorTOTPStage Serializer

    - Changed property `digits` (integer -> string)

      > - `6` - 6 digits, widely compatible
      > - `8` - 8 digits, not compatible with apps like Google Authenticator

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorValidateStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticateWebAuthnStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/consent/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > ConsentStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/deny/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DenyStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/dummy/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > DummyStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > EmailStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Added property `pretend_user_exists` (boolean)

  > When enabled, the stage will succeed and continue even when incorrect user info is entered.

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `pretend_user_exists` (boolean)

    > When enabled, the stage will succeed and continue even when incorrect user info is entered.

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > IdentificationStage Serializer

    - Added property `pretend_user_exists` (boolean)

      > When enabled, the stage will succeed and continue even when incorrect user info is entered.

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/invitation/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > InvitationStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PasswordStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `GET` /stages/prompt/prompts/\{prompt\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `PUT` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `PATCH` /stages/prompt/prompts/\{prompt\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/prompt/prompts/preview/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `POST` /stages/prompt/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PromptStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/user\_delete/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserDeleteStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/user\_login/

###### Request:

Changed content type : `application/json`

- Added property `network_binding` (object)

  > Bind sessions created by this stage to the configured network
  >
  > - `no_binding` - No Binding
  > - `bind_asn` - Bind Asn
  > - `bind_asn_network` - Bind Asn Network
  > - `bind_asn_network_ip` - Bind Asn Network Ip

- Added property `geoip_binding` (object)

  > Bind sessions created by this stage to the configured GeoIP location
  >
  > - `no_binding` - No Binding
  > - `bind_continent` - Bind Continent
  > - `bind_continent_country` - Bind Continent Country
  > - `bind_continent_country_city` - Bind Continent Country City

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `network_binding` (object)

    > Bind sessions created by this stage to the configured network
    >
    > - `no_binding` - No Binding
    > - `bind_asn` - Bind Asn
    > - `bind_asn_network` - Bind Asn Network
    > - `bind_asn_network_ip` - Bind Asn Network Ip

  - Added property `geoip_binding` (object)

    > Bind sessions created by this stage to the configured GeoIP location
    >
    > - `no_binding` - No Binding
    > - `bind_continent` - Bind Continent
    > - `bind_continent_country` - Bind Continent Country
    > - `bind_continent_country_city` - Bind Continent Country City

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_login/

###### Parameters:

Added: `geoip_binding` in `query`

> Bind sessions created by this stage to the configured GeoIP location
>
> - `no_binding` - No Binding
> - `bind_continent` - Bind Continent
> - `bind_continent_country` - Bind Continent Country
> - `bind_continent_country_city` - Bind Continent Country City

Added: `network_binding` in `query`

> Bind sessions created by this stage to the configured network
>
> - `no_binding` - No Binding
> - `bind_asn` - Bind Asn
> - `bind_asn_network` - Bind Asn Network
> - `bind_asn_network_ip` - Bind Asn Network Ip

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLoginStage Serializer

    - Added property `network_binding` (object)

      > Bind sessions created by this stage to the configured network
      >
      > - `no_binding` - No Binding
      > - `bind_asn` - Bind Asn
      > - `bind_asn_network` - Bind Asn Network
      > - `bind_asn_network_ip` - Bind Asn Network Ip

    - Added property `geoip_binding` (object)

      > Bind sessions created by this stage to the configured GeoIP location
      >
      > - `no_binding` - No Binding
      > - `bind_continent` - Bind Continent
      > - `bind_continent_country` - Bind Continent Country
      > - `bind_continent_country_city` - Bind Continent Country City

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/user\_logout/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserLogoutStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/user\_write/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

  Changed items (object): > Stripped down flow serializer

  - Changed property `layout` (string)
    > - `stacked` - Stacked
    > - `content_left` - Content Left
    > - `content_right` - Content Right
    > - `sidebar_left` - Sidebar Left
    > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

##### `GET` /stages/user\_write/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserWriteStage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

- Changed property `promptstage_set` (array)

  Changed items (object): > Stage Serializer

  - Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer

    - Changed property `layout` (string)
      > - `stacked` - Stacked
      > - `content_left` - Content Left
      > - `content_right` - Content Right
      > - `sidebar_left` - Sidebar Left
      > - `sidebar_right` - Sidebar Right

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer

    - Changed property `flow_set` (array)

      Changed items (object): > Stripped down flow serializer

      - Changed property `layout` (string)
        > - `stacked` - Stacked
        > - `content_left` - Content Left
        > - `content_right` - Content Right
        > - `sidebar_left` - Sidebar Left
        > - `sidebar_right` - Sidebar Right

##### `GET` /stages/prompt/prompts/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Prompt Serializer

    - Changed property `promptstage_set` (array)

      Changed items (object): > Stage Serializer

      - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        - Changed property `layout` (string)
          > - `stacked` - Stacked
          > - `content_left` - Content Left
          > - `content_right` - Content Right
          > - `sidebar_left` - Sidebar Left
          > - `sidebar_right` - Sidebar Right

---

## Release 2024.4

<!-- cSpell:ignore moar -->

## Highlights

- **OAuth/SAML as authentication factor** :ak-enterprise Use an external provider as part of an MFA authentication flow, including custom implementations

- **SCIM Source** :ak-preview Provision users and groups in authentik using an SCIM API

- **Configurable WebAuthn device restrictions** Configure which types of WebAuthn devices can be used to enroll and validate for different authorization levels.

- **Performance improvements** The API Endpoints to list Users, Groups, and Events have been optimized by 94%, 41% and 53% respectively

## Breaking changes

### Manual action may be required

- **Configuration options migrated to the Admin interface**

    The following config options have been moved from the config file and can now be set using the Admin interface (under **System** -> **Settings**) or the API:
    - `AUTHENTIK_DEFAULT_TOKEN_LENGTH`

    When upgrading to 2024.4, the currently configured options will be automatically migrated to the database, and can be removed from the `.env` or helm values file afterwards.

## New features

- **Source stage** :ak-enterprise

    The source stage allows for an inclusion of a source as part of a flow. This can be used to link a user to a source as part of their authentication/enrollment, or it can be used as an external multi-factor to provide device health attestation for example.

    For details refer to [Source stage](../../add-secure-apps/flows-stages/stages/source/index.mdx)

- **SCIM Source** :ak-preview

    Provision users and groups in authentik using an SCIM API.

    For details refer to [SCIM Source](../../users-sources/sources/protocols/scim/index.mdx)

- **Configurable WebAuthn device restrictions**

    Configure which types of WebAuthn devices can be used to enroll and validate for different authorization levels.

    For details refer to [WebAuthn authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx)

- **Revamped UI for log messages**

    Log messages from several API endpoints are now shown with much greater detail, which helps with implementing custom policies and property mappings.

- **Python API Client**

    There's now an official API Client for Python: https://pypi.org/project/authentik-client/. This API Client can be used to create/update/delete objects within authentik as well as using the Flow executor to authenticate.

- **Configure LDAP sources to not store hashed password in authentik**

    When authentik is configured to federate with an LDAP source, upon authentication, authentik hashed the password and stored it in its own database. This allows authentication to function when LDAP is unreachable. Admins can now configure this behavior for when this is not desirable.

    For details refer to [LDAP Source](../../users-sources/sources/protocols/ldap/index.mdx)

- **Configurable app password token expiring**

    Thanks @jmdilly for contributing this feature!

    Admins can now configure the default token duration (which defaults to `minutes=30`) in the admin interface as specified above. This value can also be overridden per-user with the `goauthentik.io/user/token-maximum-lifetime` attribute.

## Upgrading

This release does not introduce any new requirements.

### docker-compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2024.4/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.4
```

## Minor changes/fixes

- admin: Handle latest version unknown in admin dashboard (#8858)
- api: capabilities: properly set can_save_media when s3 is enabled (#8896)
- api: fix authentication schema (#9238)
- blueprints: fix default username field in user-settings flow (#9136)
- blueprints: fix schema generation for PrimaryKeyRelated fields with non-int PK (#9140)
- blueprints: only create default brand if no other default brand exists (#9222)
- blueprints: use reconcile decorator instead of relying on function name prefix (#8483)
- brands: add indexes to brand domain and default (#9343)
- brands: fix context processor when request doesn't have a tenant (#8643)
- core: add user settable token durations (#7410)
- core: cache user application list under policies (#8895)
- core: delegated group member management (#9254)
- core: fix api schema for users and groups (#9298)
- core: fix blueprint export (#8695)
- core: optionally don't return groups' users and users' groups by default (#9179)
- core: replace authentik_signals_ignored_fields with audit_ignore (#9291)
- core: rework recovery API to return better error messages (#8655)
- enterprise/rac: fix connection token management (#8909)
- enterprise: fix audit middleware import (#9177)
- enterprise: fix read_only activating when no license is installed (#8697)
- enterprise: force license usage update after change to license (#8723)
- enterprise: only check for valid license existing for creating Enterprise objects (#8813)
- enterprise: use tenant uuid instead of install_id when tenants are enabled (#8823)
- events: add context manager to ignore/modify audit events being written (#9181)
- events: add indexes (#9272)
- events: discard notification if user has empty email (#8938)
- events: fix incorrect user logged when using API token authentication (#9302)
- events: fix log_capture (#9075)
- events: rework log messages returned from API and their rendering (#8770)
- events: sanitize args and kwargs saved in system tasks (#8644)
- flows: fix mismatched redirect behavior for invalid and valid flows (#8794)
- internal: add tests to go flow executor (#9219)
- internal: cleanup static file serving setup code (#8965)
- lib: cache gravatar connection status (#9248)
- lifecycle: gunicorn: fix app preload (#9274)
- lifecycle: migrate: ensure template schema exists before migrating (#8952)
- outposts: improved set secret answers for flow execution (#8013)
- outposts/proxy: Fix invalid redirect on external hosts containing path components (#8915)
- outposts: Enhance config options for k8s outposts (#7363)
- providers/oauth2: fix inconsistent `sub` value when setting via mapping (#8677)
- providers/oauth2: fix interactive device flow (#9076)
- providers/oauth2: fix offline_access requests when prompt doesn't include consent (#8731)
- providers/oauth2: fix refresh_token grant returning incorrect id_token (#9275)
- providers/oauth2: fix validation ordering (#8793)
- providers/oauth2: improve conformance with client_credentials standard (#8471)
- providers/scim: allow custom user and group schemas (#9255)
- rbac: fix permission decorator for global permissions (#8591)
- root: cherry-pick version bump
- root: early spring clean for linting (#8498)
- root: ensure consistent install_id (#8775)
- root: expose session storage configuration (#9337)
- root: fix app settings load order (#8569)
- root: generate python client (#9107)
- root: make redis settings more consistent (#9335)
- root: move database calls from ready() to dedicated startup signal (#9081)
- root: support redis username (#8935)
- sources/ldap: add ability to disable password write on login (#8377)
- sources/ldap: fix default blueprint for mapping user DN to path (#9355)
- sources/oauth: add gitlab type [AUTH-323] (#8195)
- sources/oauth: make URLs not required, only check when no OIDC URLs are defined (#9182)
- sources/scim: cleanup service account when source is deleted (#9319)
- sources/scim: service account should be internal (#9321)
- sources: add SCIM source (#3051)
- stages/authenticator_validate: add ability to limit webauthn device types (#9180)
- stages/authenticator_validate: fix error with get_webauthn_challenge_without_user (#8625)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#9268)
- stages/authenticator_webauthn: add MDS support (#9114)
- stages/authenticator_webauthn: fix attestation value (#9333)
- stages/authenticator_webauthn: fix error when enrolling new device (#8738)
- stages/email: Disable autoescape for text templates (#8812)
- stages/email: fix issue when sending emails to users with same display as email (#8850)
- stages/prompt: fix username field throwing error with existing user (#9342)
- stages/user_write: ensure user data is json-serializable (#8926)
- stages: source stage (#8330)
- tenants: really ensure default tenant cannot be deleted (#8875)
- web/admin: allow custom sorting for bound\* tables (#9080)
- web/admin: don't mark LDAP group property mappings as required (#8772)
- web/admin: don't mark property mappings as required anywhere (#8752)
- web/admin: fix SAML Provider preview (#9192)
- web/admin: fix document title for admin interface (#9362)
- web/admin: fix error in admin interface due to un-hydrated context (#9336)
- web/admin: fix log viewer empty state (#9315)
- web/admin: fix markdown table rendering (#8908)
- web/admin: fix user_write stage's user type input (#9344)
- web/admin: group form dual select (#9354)
- web/admin: remove enterprise preview banner (#8991)
- web/admin: rework captcha stage (#9256)
- web/admin: small fixes (#9002)
- web/flows: fix form input rendering issue (#9297)
- web/flows: general ux improvements (#8558)
- web/flows: fix passwordless hidden without input (#9273)
- web/flows: fix webauthn retry (#8599)
- web/flows: improve authenticator styling (#8560)
- web/flows: update flow background (#9305)
- web: a few minor bugfixes and lintfixes (#9044)
- web: ak-checkbox-group for short, static, multi-select events (#9138)
- web: change "delete" verb to "remove" for one-to-many relationships (#8535)
- web: clean up UserInterface in prep for OAuth and Silo Projects (#8278)
- web: clean up and remove redundant alias '@goauthentik/app' (#8889)
- web: consistent style declarations internally (#9077)
- web: fix save & reset behavior on System ➲ Settings page. (#8528)
- web: improve build speeds even moar!!!!!! (#8954)
- web: maintenance: split tsconfig into “base” and “build” variants. (#9036)
- web: manage stacked modals with a stack (#9193)
- web: move context controllers into reactive controller plugins (#8996)
- web: preserve selected list when provider updates (#9200)
- web: provide InstallID on EnterpriseListPage (#8898)
- web: replace rollup with esbuild (#8699)
- web: restore sourcemaps (#9300)
- web: spell customization with a Z (#8596)
- web: upgrade to lit 3 (#8781)

## Fixed in 2024.4.1

- core: fix logic for token expiration (cherry-pick #9426) (#9428)
- lifecycle: always try custom redis URL (cherry-pick #9441) (#9458)
- sources/oauth: ensure all UI sources return a valid source (cherry-pick #9401) (#9406)
- sources/scim: fix service account user path (cherry-pick #9463) (#9470)
- stages/identification: don't check source component (cherry-pick #9410) (#9420)
- web/admin: fix disabled button color with dark theme (cherry-pick #9465) (#9468)
- web/admin: show user internal service account as disabled (cherry-pick #9464) (#9467)
- web/common: fix locale detection for user-set locale (cherry-pick #9436) (#9439)
- web: Add resolved and integrity fields back to package-lock.json (cherry-pick #9419) (#9421)
- web: markdown: display markdown even when frontmatter is missing (cherry-pick #9404) (#9405)

## Fixed in 2024.4.2

- core: fix source_flow_manager saving user-source connection too early (cherry-pick #9559) (#9578)
- core: fix task clean_expiring_models removing valid sessions with using database storage (cherry-pick #9598) (#9601)
- core: only prefetch related objects when required (cherry-pick #9476) (#9510)
- enterprise/audit: fix audit logging with m2m relations (cherry-pick #9571) (#9572)
- events: ensure all models' `__str__` can be called without any further lookups (cherry-pick #9480) (#9485)
- flows: fix execute API endpoint (cherry-pick #9478) (#9481)
- lifecycle: close database connection after migrating (cherry-pick #9516) (#9531)
- providers/saml: fix ECDSA support (cherry-pick #9537) (#9544)
- providers/scim: fix SCIM ID incorrectly used as primary key (cherry-pick #9557) (#9579)
- providers/scim: fix Sync task's time_limit not set correctly (cherry-pick #9546) (#9553)
- sources/oauth: fix OAuth2 Client sending token request incorrectly (cherry-pick #9474) (#9475)
- sources/scim: fix duplicate groups and invalid schema (cherry-pick #9466) (#9606)
- tenants: fix scheduled tasks not running on default tenant (cherry-pick #9583) (#9586)
- web/flows: fix error when enrolling multiple WebAuthn devices consecutively (cherry-pick #9545) (#9547)
- web/flows: fix missing fallback for flow logo (cherry-pick #9487) (#9492)
- web: Add missing integrity hashes to package-lock.json (#9527)

## Fixed in 2024.4.3

- core: fix source flow_manager not always appending save stage (cherry-pick #9659) (#9662)
- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10236)
- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.mdx), reported by Stefan Zwanenburg (cherry-pick #10229) (#10233)
- sources/saml: fix FlowPlanner error due to pickle (cherry-pick #9708) (#9709)
- web: fix value handling inside controlled components (cherry-pick #9648) (#9685)

## Fixed in 2024.4.4

- security: fix [CVE-2024-42490](../../security/cves/CVE-2024-42490.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #11022) #11024

## API Changes

#### What's New

---

##### `GET` /sources/scim/

##### `POST` /sources/scim/

##### `GET` /sources/scim/&#123;slug&#125;/

##### `PUT` /sources/scim/&#123;slug&#125;/

##### `DELETE` /sources/scim/&#123;slug&#125;/

##### `PATCH` /sources/scim/&#123;slug&#125;/

##### `GET` /sources/scim/&#123;slug&#125;/used_by/

##### `GET` /sources/scim_groups/

##### `POST` /sources/scim_groups/

##### `GET` /sources/scim_groups/&#123;id&#125;/

##### `PUT` /sources/scim_groups/&#123;id&#125;/

##### `DELETE` /sources/scim_groups/&#123;id&#125;/

##### `PATCH` /sources/scim_groups/&#123;id&#125;/

##### `GET` /sources/scim_groups/&#123;id&#125;/used_by/

##### `GET` /sources/scim_users/

##### `POST` /sources/scim_users/

##### `GET` /sources/scim_users/&#123;id&#125;/

##### `PUT` /sources/scim_users/&#123;id&#125;/

##### `DELETE` /sources/scim_users/&#123;id&#125;/

##### `PATCH` /sources/scim_users/&#123;id&#125;/

##### `GET` /sources/scim_users/&#123;id&#125;/used_by/

##### `GET` /stages/authenticator/webauthn_device_types/

##### `GET` /stages/authenticator/webauthn_device_types/&#123;aaguid&#125;/

##### `GET` /stages/source/

##### `POST` /stages/source/

##### `GET` /stages/source/&#123;stage_uuid&#125;/

##### `PUT` /stages/source/&#123;stage_uuid&#125;/

##### `DELETE` /stages/source/&#123;stage_uuid&#125;/

##### `PATCH` /stages/source/&#123;stage_uuid&#125;/

##### `GET` /stages/source/&#123;stage_uuid&#125;/used_by/

##### `POST` /core/users/&#123;id&#125;/recovery/

##### `POST` /core/users/&#123;id&#125;/recovery_email/

#### What's Deleted

---

##### `GET` /core/users/&#123;id&#125;/recovery/

##### `GET` /core/users/&#123;id&#125;/recovery_email/

#### What's Changed

---

##### `GET` /admin/apps/

##### `GET` /admin/models/

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `default_token_duration` (string)

        > Default token duration

    - Added property `default_token_length` (integer)
        > Default token length

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `default_token_duration` (string)

    > Default token duration

- Added property `default_token_length` (integer)
    > Default token length

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `default_token_duration` (string)

        > Default token duration

    - Added property `default_token_length` (integer)
        > Default token length

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `default_token_duration` (string)

    > Default token duration

- Added property `default_token_length` (integer)
    > Default token length

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `default_token_duration` (string)

        > Default token duration

    - Added property `default_token_length` (integer)
        > Default token length

##### `GET` /admin/system/

##### `POST` /admin/system/

##### `GET` /admin/version/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `version_latest_valid`
    * Added property `version_latest_valid` (boolean)
        > Check if latest version is valid

##### `GET` /admin/workers/

##### `GET` /authenticators/admin/all/

##### `GET` /authenticators/admin/duo/&#123;id&#125;/

##### `PUT` /authenticators/admin/duo/&#123;id&#125;/

##### `DELETE` /authenticators/admin/duo/&#123;id&#125;/

##### `PATCH` /authenticators/admin/duo/&#123;id&#125;/

##### `GET` /authenticators/admin/sms/&#123;id&#125;/

##### `PUT` /authenticators/admin/sms/&#123;id&#125;/

##### `DELETE` /authenticators/admin/sms/&#123;id&#125;/

##### `PATCH` /authenticators/admin/sms/&#123;id&#125;/

##### `GET` /authenticators/admin/totp/&#123;id&#125;/

##### `PUT` /authenticators/admin/totp/&#123;id&#125;/

##### `DELETE` /authenticators/admin/totp/&#123;id&#125;/

##### `PATCH` /authenticators/admin/totp/&#123;id&#125;/

##### `GET` /authenticators/admin/webauthn/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)
        - Property `aaguid` (string)

        - Property `description` (string)

    * Added property `aaguid` (string)

##### `PUT` /authenticators/admin/webauthn/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)

    * Added property `aaguid` (string)

##### `DELETE` /authenticators/admin/webauthn/&#123;id&#125;/

##### `PATCH` /authenticators/admin/webauthn/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)

    * Added property `aaguid` (string)

##### `GET` /authenticators/all/

##### `GET` /authenticators/duo/&#123;id&#125;/

##### `PUT` /authenticators/duo/&#123;id&#125;/

##### `DELETE` /authenticators/duo/&#123;id&#125;/

##### `PATCH` /authenticators/duo/&#123;id&#125;/

##### `GET` /authenticators/sms/&#123;id&#125;/

##### `PUT` /authenticators/sms/&#123;id&#125;/

##### `DELETE` /authenticators/sms/&#123;id&#125;/

##### `PATCH` /authenticators/sms/&#123;id&#125;/

##### `GET` /authenticators/totp/&#123;id&#125;/

##### `PUT` /authenticators/totp/&#123;id&#125;/

##### `DELETE` /authenticators/totp/&#123;id&#125;/

##### `PATCH` /authenticators/totp/&#123;id&#125;/

##### `GET` /authenticators/webauthn/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)

    * Added property `aaguid` (string)

##### `PUT` /authenticators/webauthn/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)

    * Added property `aaguid` (string)

##### `DELETE` /authenticators/webauthn/&#123;id&#125;/

##### `PATCH` /authenticators/webauthn/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)

    * Added property `aaguid` (string)

##### `GET` /core/applications/&#123;slug&#125;/check_access/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `log_messages` (array)

        Changed items (object): > Single log message with all context logged.

        New required properties:
        - `attributes`
        - `event`
        - `log_level`
        - `logger`
        - `timestamp`
        * Added property `timestamp` (string)

        * Added property `log_level` (string)

            Enum values:
            - `critical`
            - `exception`
            - `error`
            - `warn`
            - `warning`
            - `info`
            - `debug`
            - `notset`

        * Added property `logger` (string)

        * Added property `event` (string)

        * Added property `attributes` (object)

##### `GET` /core/applications/&#123;slug&#125;/metrics/

##### `POST` /core/applications/&#123;slug&#125;/set_icon/

##### `POST` /core/applications/&#123;slug&#125;/set_icon_url/

##### `GET` /core/authenticated_sessions/&#123;uuid&#125;/

##### `DELETE` /core/authenticated_sessions/&#123;uuid&#125;/

##### `GET` /core/brands/&#123;brand_uuid&#125;/

##### `PUT` /core/brands/&#123;brand_uuid&#125;/

##### `DELETE` /core/brands/&#123;brand_uuid&#125;/

##### `PATCH` /core/brands/&#123;brand_uuid&#125;/

##### `POST` /core/groups/&#123;group_uuid&#125;/add_user/

##### `POST` /core/groups/&#123;group_uuid&#125;/remove_user/

##### `POST` /core/tokens/&#123;identifier&#125;/set_key/

##### `GET` /core/tokens/&#123;identifier&#125;/view_key/

##### `POST` /core/users/&#123;id&#125;/impersonate/

##### `POST` /core/users/&#123;id&#125;/set_password/

##### `GET` /core/users/impersonate_end/

##### `GET` /core/users/paths/

##### `POST` /core/users/service_account/

##### `GET` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

##### `PUT` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

##### `DELETE` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

##### `PATCH` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

##### `GET` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/view_certificate/

##### `GET` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/view_private_key/

##### `POST` /crypto/certificatekeypairs/generate/

##### `GET` /enterprise/license/&#123;license_uuid&#125;/

##### `PUT` /enterprise/license/&#123;license_uuid&#125;/

##### `DELETE` /enterprise/license/&#123;license_uuid&#125;/

##### `PATCH` /enterprise/license/&#123;license_uuid&#125;/

##### `GET` /enterprise/license/forecast/

##### `GET` /enterprise/license/get_install_id/

##### `GET` /enterprise/license/summary/

##### `GET` /events/events/actions/

##### `GET` /events/events/per_month/

##### `GET` /events/events/top_per_user/

##### `GET` /events/events/volume/

##### `POST` /events/notifications/mark_all_seen/

##### `POST` /events/system_tasks/&#123;uuid&#125;/run/

##### `POST` /events/transports/&#123;uuid&#125;/test/

##### `GET` /flows/instances/&#123;slug&#125;/diagram/

##### `GET` /flows/instances/&#123;slug&#125;/execute/

##### `GET` /flows/instances/&#123;slug&#125;/export/

##### `POST` /flows/instances/&#123;slug&#125;/set_background/

##### `POST` /flows/instances/&#123;slug&#125;/set_background_url/

##### `POST` /flows/instances/cache_clear/

##### `GET` /flows/instances/cache_info/

##### `POST` /flows/instances/import/

###### Return Type:

Changed response : **204 No Content**

- Changed content type : `application/json`
    - Changed property `logs` (array)

        Changed items (object): > Single log message with all context logged.

        New required properties:
        - `attributes`
        - `event`
        - `log_level`
        - `logger`
        - `timestamp`
        * Added property `timestamp` (string)

        * Added property `log_level` (string)

        * Added property `logger` (string)

        * Added property `event` (string)

        * Added property `attributes` (object)

Changed response : **400 Bad Request**

- Changed content type : `application/json`
    - Changed property `logs` (array)

        Changed items (object): > Single log message with all context logged.

        New required properties:
        - `attributes`
        - `event`
        - `log_level`
        - `logger`
        - `timestamp`
        * Added property `timestamp` (string)

        * Added property `log_level` (string)

        * Added property `logger` (string)

        * Added property `event` (string)

        * Added property `attributes` (object)

##### `GET` /managed/blueprints/&#123;instance_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `status` (string)

##### `PUT` /managed/blueprints/&#123;instance_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `status` (string)

##### `DELETE` /managed/blueprints/&#123;instance_uuid&#125;/

##### `PATCH` /managed/blueprints/&#123;instance_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `status` (string)

##### `POST` /managed/blueprints/&#123;instance_uuid&#125;/apply/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `status` (string)

##### `GET` /managed/blueprints/available/

##### `GET` /outposts/instances/&#123;uuid&#125;/health/

##### `GET` /outposts/instances/default_settings/

##### `GET` /outposts/proxy/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)
        > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `GET` /outposts/radius/&#123;id&#125;/

##### `GET` /outposts/service_connections/all/&#123;uuid&#125;/

##### `DELETE` /outposts/service_connections/all/&#123;uuid&#125;/

##### `GET` /outposts/service_connections/all/&#123;uuid&#125;/state/

##### `GET` /outposts/service_connections/all/types/

##### `GET` /outposts/service_connections/docker/&#123;uuid&#125;/

##### `PUT` /outposts/service_connections/docker/&#123;uuid&#125;/

##### `DELETE` /outposts/service_connections/docker/&#123;uuid&#125;/

##### `PATCH` /outposts/service_connections/docker/&#123;uuid&#125;/

##### `GET` /outposts/service_connections/kubernetes/&#123;uuid&#125;/

##### `PUT` /outposts/service_connections/kubernetes/&#123;uuid&#125;/

##### `DELETE` /outposts/service_connections/kubernetes/&#123;uuid&#125;/

##### `PATCH` /outposts/service_connections/kubernetes/&#123;uuid&#125;/

##### `GET` /policies/all/&#123;policy_uuid&#125;/

##### `DELETE` /policies/all/&#123;policy_uuid&#125;/

##### `POST` /policies/all/&#123;policy_uuid&#125;/test/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `log_messages` (array)

        Changed items (object): > Single log message with all context logged.

        New required properties:
        - `attributes`
        - `event`
        - `log_level`
        - `logger`
        - `timestamp`
        * Added property `timestamp` (string)

        * Added property `log_level` (string)

        * Added property `logger` (string)

        * Added property `event` (string)

        * Added property `attributes` (object)

##### `POST` /policies/all/cache_clear/

##### `GET` /policies/all/cache_info/

##### `GET` /policies/all/types/

##### `GET` /policies/dummy/&#123;policy_uuid&#125;/

##### `PUT` /policies/dummy/&#123;policy_uuid&#125;/

##### `DELETE` /policies/dummy/&#123;policy_uuid&#125;/

##### `PATCH` /policies/dummy/&#123;policy_uuid&#125;/

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.sources.scim`
        - `authentik.enterprise.stages.source`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_sources_scim.scimsource`
        - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
        - `authentik_stages_source.sourcestage`
          Removed enum value:

        - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `PUT` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.sources.scim`
    - `authentik.enterprise.stages.source`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.sources.scim`
        - `authentik.enterprise.stages.source`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_sources_scim.scimsource`
        - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
        - `authentik_stages_source.sourcestage`
          Removed enum value:

        - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `DELETE` /policies/event_matcher/&#123;policy_uuid&#125;/

##### `PATCH` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.sources.scim`
    - `authentik.enterprise.stages.source`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.sources.scim`
        - `authentik.enterprise.stages.source`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_sources_scim.scimsource`
        - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
        - `authentik_stages_source.sourcestage`
          Removed enum value:

        - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `GET` /policies/expression/&#123;policy_uuid&#125;/

##### `PUT` /policies/expression/&#123;policy_uuid&#125;/

##### `DELETE` /policies/expression/&#123;policy_uuid&#125;/

##### `PATCH` /policies/expression/&#123;policy_uuid&#125;/

##### `GET` /policies/password/&#123;policy_uuid&#125;/

##### `PUT` /policies/password/&#123;policy_uuid&#125;/

##### `DELETE` /policies/password/&#123;policy_uuid&#125;/

##### `PATCH` /policies/password/&#123;policy_uuid&#125;/

##### `GET` /policies/password_expiry/&#123;policy_uuid&#125;/

##### `PUT` /policies/password_expiry/&#123;policy_uuid&#125;/

##### `DELETE` /policies/password_expiry/&#123;policy_uuid&#125;/

##### `PATCH` /policies/password_expiry/&#123;policy_uuid&#125;/

##### `GET` /policies/reputation/&#123;policy_uuid&#125;/

##### `PUT` /policies/reputation/&#123;policy_uuid&#125;/

##### `DELETE` /policies/reputation/&#123;policy_uuid&#125;/

##### `PATCH` /policies/reputation/&#123;policy_uuid&#125;/

##### `GET` /policies/reputation/scores/&#123;reputation_uuid&#125;/

##### `DELETE` /policies/reputation/scores/&#123;reputation_uuid&#125;/

##### `GET` /propertymappings/all/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/all/&#123;pm_uuid&#125;/

##### `POST` /propertymappings/all/&#123;pm_uuid&#125;/test/

##### `GET` /propertymappings/all/types/

##### `GET` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/notification/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/notification/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/notification/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/notification/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `GET` /providers/all/&#123;id&#125;/

##### `DELETE` /providers/all/&#123;id&#125;/

##### `GET` /providers/all/types/

##### `GET` /providers/oauth2/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `client_type` (string)

        > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

    - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    - Changed property `issuer_mode` (string)
        > Configure how the issuer field of the ID Token should be filled.

##### `PUT` /providers/oauth2/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `client_type` (string)

    > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

- Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

- Changed property `issuer_mode` (string)
    > Configure how the issuer field of the ID Token should be filled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `client_type` (string)

        > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

    - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    - Changed property `issuer_mode` (string)
        > Configure how the issuer field of the ID Token should be filled.

##### `DELETE` /providers/oauth2/&#123;id&#125;/

##### `PATCH` /providers/oauth2/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `client_type` (string)

    > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

- Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

- Changed property `issuer_mode` (string)
    > Configure how the issuer field of the ID Token should be filled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `client_type` (string)

        > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

    - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    - Changed property `issuer_mode` (string)
        > Configure how the issuer field of the ID Token should be filled.

##### `GET` /providers/oauth2/&#123;id&#125;/preview_user/

##### `GET` /providers/oauth2/&#123;id&#125;/setup_urls/

##### `GET` /providers/proxy/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)
        > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `PUT` /providers/proxy/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)
    > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)
        > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `DELETE` /providers/proxy/&#123;id&#125;/

##### `PATCH` /providers/proxy/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)
    > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)
        > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `GET` /providers/rac/&#123;id&#125;/

##### `PUT` /providers/rac/&#123;id&#125;/

##### `DELETE` /providers/rac/&#123;id&#125;/

##### `PATCH` /providers/rac/&#123;id&#125;/

##### `GET` /providers/radius/&#123;id&#125;/

##### `PUT` /providers/radius/&#123;id&#125;/

##### `DELETE` /providers/radius/&#123;id&#125;/

##### `PATCH` /providers/radius/&#123;id&#125;/

##### `GET` /providers/saml/&#123;id&#125;/metadata/

##### `GET` /providers/saml/&#123;id&#125;/preview_user/

##### `POST` /providers/saml/import_metadata/

##### `GET` /providers/scim/&#123;id&#125;/

##### `PUT` /providers/scim/&#123;id&#125;/

##### `DELETE` /providers/scim/&#123;id&#125;/

##### `PATCH` /providers/scim/&#123;id&#125;/

##### `GET` /rbac/permissions/&#123;id&#125;/

##### `GET` /rbac/roles/&#123;uuid&#125;/

##### `PUT` /rbac/roles/&#123;uuid&#125;/

##### `DELETE` /rbac/roles/&#123;uuid&#125;/

##### `PATCH` /rbac/roles/&#123;uuid&#125;/

##### `GET` /schema/

##### `POST` /sources/all/&#123;slug&#125;/set_icon/

##### `POST` /sources/all/&#123;slug&#125;/set_icon_url/

##### `GET` /sources/all/types/

##### `GET` /sources/all/user_settings/

##### `GET` /sources/ldap/&#123;slug&#125;/debug/

##### `GET` /sources/oauth/source_types/

##### `POST` /sources/plex/redeem_token_authenticated/

##### `GET` /sources/saml/&#123;slug&#125;/metadata/

##### `GET` /stages/all/types/

##### `GET` /stages/all/user_settings/

##### `POST` /stages/authenticator/duo/&#123;stage_uuid&#125;/import_device_manual/

##### `POST` /stages/authenticator/duo/&#123;stage_uuid&#125;/import_devices_automatic/

##### `GET` /stages/email/templates/

##### `GET` /admin/metrics/

##### `POST` /authenticators/admin/duo/

##### `GET` /authenticators/admin/duo/

##### `POST` /authenticators/admin/sms/

##### `GET` /authenticators/admin/sms/

##### `DELETE` /authenticators/admin/static/&#123;id&#125;/

##### `GET` /authenticators/admin/static/&#123;id&#125;/

##### `PUT` /authenticators/admin/static/&#123;id&#125;/

##### `PATCH` /authenticators/admin/static/&#123;id&#125;/

##### `POST` /authenticators/admin/totp/

##### `GET` /authenticators/admin/totp/

##### `POST` /authenticators/admin/webauthn/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `aaguid`
    - `device_type`
    * Added property `device_type` (object)

    * Added property `aaguid` (string)

##### `GET` /authenticators/admin/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for WebAuthn authenticator devices

        New required properties:
        - `aaguid`
        - `device_type`
        * Added property `device_type` (object)

        * Added property `aaguid` (string)

##### `GET` /authenticators/duo/

##### `GET` /authenticators/duo/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /authenticators/sms/

##### `GET` /authenticators/sms/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /authenticators/static/&#123;id&#125;/

##### `GET` /authenticators/static/&#123;id&#125;/

##### `PUT` /authenticators/static/&#123;id&#125;/

##### `PATCH` /authenticators/static/&#123;id&#125;/

##### `GET` /authenticators/static/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /authenticators/totp/

##### `GET` /authenticators/totp/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /authenticators/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for WebAuthn authenticator devices

        New required properties:
        - `aaguid`
        - `device_type`
        * Added property `device_type` (object)

        * Added property `aaguid` (string)

##### `GET` /authenticators/webauthn/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /core/applications/&#123;slug&#125;/

##### `GET` /core/applications/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `policy_engine_mode` (string)

##### `PUT` /core/applications/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `policy_engine_mode` (string)

##### `PATCH` /core/applications/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `policy_engine_mode` (string)

##### `GET` /core/applications/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /core/authenticated_sessions/

##### `GET` /core/authenticated_sessions/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /core/brands/

##### `GET` /core/brands/

##### `GET` /core/brands/&#123;brand_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `ui_theme` (string)

##### `DELETE` /core/groups/&#123;group_uuid&#125;/

##### `GET` /core/groups/&#123;group_uuid&#125;/

##### `PUT` /core/groups/&#123;group_uuid&#125;/

##### `PATCH` /core/groups/&#123;group_uuid&#125;/

##### `GET` /core/groups/&#123;group_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /core/tokens/&#123;identifier&#125;/

##### `GET` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `intent` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `PUT` /core/tokens/&#123;identifier&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `intent` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `intent` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `PATCH` /core/tokens/&#123;identifier&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `intent` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `intent` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `GET` /core/tokens/&#123;identifier&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /core/user_consent/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /core/users/&#123;id&#125;/

##### `GET` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `PUT` /core/users/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `PATCH` /core/users/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `GET` /core/users/&#123;id&#125;/metrics/

##### `GET` /core/users/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /crypto/certificatekeypairs/

##### `GET` /crypto/certificatekeypairs/

##### `GET` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /enterprise/license/

##### `GET` /enterprise/license/

##### `GET` /enterprise/license/&#123;license_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /events/events/&#123;event_uuid&#125;/

##### `GET` /events/events/&#123;event_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

##### `PUT` /events/events/&#123;event_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

##### `PATCH` /events/events/&#123;event_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

##### `GET` /events/notifications/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /events/rules/&#123;pbm_uuid&#125;/

##### `GET` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `severity` (string)
        > Controls which severity level the created notifications will have.

##### `PUT` /events/rules/&#123;pbm_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `severity` (string)
    > Controls which severity level the created notifications will have.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `severity` (string)
        > Controls which severity level the created notifications will have.

##### `PATCH` /events/rules/&#123;pbm_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `severity` (string)
    > Controls which severity level the created notifications will have.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `severity` (string)
        > Controls which severity level the created notifications will have.

##### `GET` /events/rules/&#123;pbm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /events/system_tasks/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `messages` (array)

        Changed items (string -> object): > Single log message with all context logged.

    - Changed property `status` (string)

##### `DELETE` /events/transports/&#123;uuid&#125;/

##### `GET` /events/transports/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)

##### `PUT` /events/transports/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)

##### `PATCH` /events/transports/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)

##### `GET` /events/transports/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /flows/bindings/&#123;fsb_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /flows/instances/&#123;slug&#125;/

##### `GET` /flows/instances/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

##### `PUT` /flows/instances/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `designation` (string)

    > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

- Changed property `denied_action` (string)

    > Configure what should happen when a flow denies access to a user.

- Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

- Changed property `policy_engine_mode` (string)

- Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

##### `PATCH` /flows/instances/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `designation` (string)

    > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

- Changed property `denied_action` (string)

    > Configure what should happen when a flow denies access to a user.

- Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

- Changed property `policy_engine_mode` (string)

- Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

##### `GET` /flows/instances/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /managed/blueprints/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `status` (string)

##### `GET` /managed/blueprints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Info about a single blueprint instance file
        - Changed property `status` (string)

##### `GET` /managed/blueprints/&#123;instance_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /oauth2/access_tokens/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /oauth2/authorization_codes/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /outposts/instances/&#123;uuid&#125;/

##### `GET` /outposts/instances/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `PUT` /outposts/instances/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `PATCH` /outposts/instances/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `GET` /outposts/instances/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /outposts/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `search_mode` (string)

##### `GET` /outposts/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Proxy provider serializer for outposts
        - Changed property `mode` (string)
            > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `GET` /outposts/radius/

##### `GET` /outposts/service_connections/all/

##### `GET` /outposts/service_connections/all/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /outposts/service_connections/docker/

##### `GET` /outposts/service_connections/docker/

##### `GET` /outposts/service_connections/docker/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /outposts/service_connections/kubernetes/

##### `GET` /outposts/service_connections/kubernetes/

##### `GET` /outposts/service_connections/kubernetes/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /policies/all/

##### `GET` /policies/all/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /policies/bindings/&#123;policy_binding_uuid&#125;/

##### `GET` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `PUT` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `PATCH` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `GET` /policies/bindings/&#123;policy_binding_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /policies/dummy/

##### `GET` /policies/dummy/

##### `GET` /policies/dummy/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.sources.scim`
    - `authentik.enterprise.stages.source`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.sources.scim`
        - `authentik.enterprise.stages.source`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_sources_scim.scimsource`
        - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
        - `authentik_stages_source.sourcestage`
          Removed enum value:

        - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `GET` /policies/event_matcher/

###### Parameters:

Changed: `action` in `query`

> Match created events with this action type. When left empty, all action types will be matched.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Changed property `action` (string)

            > Match created events with this action type. When left empty, all action types will be matched.

        - Changed property `app` (string)

            > Match events created by selected application. When left empty, all applications are matched.

            Added enum values:
            - `authentik.sources.scim`
            - `authentik.enterprise.stages.source`

        - Changed property `model` (string)

            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

            Added enum values:
            - `authentik_sources_scim.scimsource`
            - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
            - `authentik_stages_source.sourcestage`
              Removed enum value:

            - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /policies/expression/

##### `GET` /policies/expression/

##### `GET` /policies/expression/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /policies/password/

##### `GET` /policies/password/

##### `GET` /policies/password/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /policies/password_expiry/

##### `GET` /policies/password_expiry/

##### `GET` /policies/password_expiry/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /policies/reputation/

##### `GET` /policies/reputation/

##### `GET` /policies/reputation/&#123;policy_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /policies/reputation/scores/

##### `GET` /policies/reputation/scores/&#123;reputation_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /propertymappings/all/

##### `GET` /propertymappings/all/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /propertymappings/ldap/

##### `GET` /propertymappings/ldap/

##### `GET` /propertymappings/ldap/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /propertymappings/notification/

##### `GET` /propertymappings/notification/

##### `GET` /propertymappings/notification/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /propertymappings/rac/

##### `GET` /propertymappings/rac/

##### `GET` /propertymappings/rac/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /propertymappings/saml/

##### `GET` /propertymappings/saml/

##### `GET` /propertymappings/saml/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /propertymappings/scim/

##### `GET` /propertymappings/scim/

##### `GET` /propertymappings/scim/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /propertymappings/scope/

##### `GET` /propertymappings/scope/

##### `GET` /propertymappings/scope/&#123;pm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /providers/all/

##### `GET` /providers/all/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /providers/ldap/&#123;id&#125;/

##### `GET` /providers/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `search_mode` (string)

##### `PUT` /providers/ldap/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `search_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `search_mode` (string)

##### `PATCH` /providers/ldap/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `search_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `search_mode` (string)

##### `GET` /providers/ldap/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Changed property `client_type` (string)

    > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

- Changed property `sub_mode` (string)

    > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

- Changed property `issuer_mode` (string)
    > Configure how the issuer field of the ID Token should be filled.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `client_type` (string)

        > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

    - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    - Changed property `issuer_mode` (string)
        > Configure how the issuer field of the ID Token should be filled.

##### `GET` /providers/oauth2/

###### Parameters:

Changed: `client_type` in `query`

> Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

Changed: `issuer_mode` in `query`

> Configure how the issuer field of the ID Token should be filled.

Changed: `sub_mode` in `query`

> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth2Provider Serializer
        - Changed property `client_type` (string)

            > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

        - Changed property `sub_mode` (string)

            > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

        - Changed property `issuer_mode` (string)
            > Configure how the issuer field of the ID Token should be filled.

##### `GET` /providers/oauth2/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /providers/proxy/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)
    > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `mode` (string)
        > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > ProxyProvider Serializer
        - Changed property `mode` (string)
            > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

##### `GET` /providers/proxy/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /providers/rac/

##### `GET` /providers/rac/

##### `GET` /providers/rac/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /providers/radius/

##### `GET` /providers/radius/

##### `GET` /providers/radius/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /providers/saml/&#123;id&#125;/

##### `GET` /providers/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `sp_binding` (string)

        > This determines how authentik sends the response back to the Service Provider.

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `PUT` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `sp_binding` (string)

    > This determines how authentik sends the response back to the Service Provider.

- Changed property `digest_algorithm` (string)

- Changed property `signature_algorithm` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `sp_binding` (string)

        > This determines how authentik sends the response back to the Service Provider.

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `PATCH` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `sp_binding` (string)

    > This determines how authentik sends the response back to the Service Provider.

- Changed property `digest_algorithm` (string)

- Changed property `signature_algorithm` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `sp_binding` (string)

        > This determines how authentik sends the response back to the Service Provider.

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `GET` /providers/saml/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /providers/scim/

##### `GET` /providers/scim/

##### `GET` /providers/scim/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /rac/connection_tokens/&#123;connection_token_uuid&#125;/

###### Parameters:

Changed: `connection_token_uuid` in `path`

> A UUID string identifying this RAC Connection token.

##### `GET` /rac/connection_tokens/&#123;connection_token_uuid&#125;/

###### Parameters:

Changed: `connection_token_uuid` in `path`

> A UUID string identifying this RAC Connection token.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `pk`
    * Changed property `pk` (string)

    * Changed property `endpoint` (string)

    * Changed property `endpoint_obj` (object)

        > Endpoint Serializer
        - Changed property `protocol` (string)

        - Changed property `auth_mode` (string)

##### `PUT` /rac/connection_tokens/&#123;connection_token_uuid&#125;/

###### Parameters:

Changed: `connection_token_uuid` in `path`

> A UUID string identifying this RAC Connection token.

###### Request:

Changed content type : `application/json`

New required properties:

- `endpoint`

* Added property `pk` (string)

* Added property `endpoint` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `pk`
    * Changed property `pk` (string)

    * Changed property `endpoint` (string)

    * Changed property `endpoint_obj` (object)

        > Endpoint Serializer
        - Changed property `protocol` (string)

        - Changed property `auth_mode` (string)

##### `PATCH` /rac/connection_tokens/&#123;connection_token_uuid&#125;/

###### Parameters:

Changed: `connection_token_uuid` in `path`

> A UUID string identifying this RAC Connection token.

###### Request:

Changed content type : `application/json`

- Added property `pk` (string)

- Added property `endpoint` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `pk`
    * Changed property `pk` (string)

    * Changed property `endpoint` (string)

    * Changed property `endpoint_obj` (object)

        > Endpoint Serializer
        - Changed property `protocol` (string)

        - Changed property `auth_mode` (string)

##### `GET` /rac/connection_tokens/&#123;connection_token_uuid&#125;/used_by/

###### Parameters:

Changed: `connection_token_uuid` in `path`

> A UUID string identifying this RAC Connection token.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /rac/endpoints/&#123;pbm_uuid&#125;/

##### `GET` /rac/endpoints/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `protocol` (string)

    - Changed property `auth_mode` (string)

##### `PUT` /rac/endpoints/&#123;pbm_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `protocol` (string)

- Changed property `auth_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `protocol` (string)

    - Changed property `auth_mode` (string)

##### `PATCH` /rac/endpoints/&#123;pbm_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `protocol` (string)

- Changed property `auth_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `protocol` (string)

    - Changed property `auth_mode` (string)

##### `GET` /rac/endpoints/&#123;pbm_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /rbac/permissions/

##### `POST` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `PATCH` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `POST` /rbac/permissions/assigned_by_users/&#123;id&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `PATCH` /rbac/permissions/assigned_by_users/&#123;id&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_sources_scim.scimsource`
    - `authentik_stages_authenticator_webauthn.authenticatorwebauthnstage`
    - `authentik_stages_source.sourcestage`
      Removed enum value:

    - `authentik_stages_authenticator_webauthn.authenticatewebauthnstage`

##### `GET` /rbac/permissions/roles/

##### `GET` /rbac/permissions/users/

##### `POST` /rbac/roles/

##### `GET` /rbac/roles/

##### `GET` /rbac/roles/&#123;uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /root/config/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `capabilities` (array)

        Changed items (string):

##### `DELETE` /sources/all/&#123;slug&#125;/

##### `GET` /sources/all/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `GET` /sources/all/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/ldap/&#123;slug&#125;/

##### `GET` /sources/ldap/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `password_login_update_internal_password` (boolean)

        > Update internal authentik password when login succeeds with LDAP

    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `PUT` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `password_login_update_internal_password` (boolean)

    > Update internal authentik password when login succeeds with LDAP

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `password_login_update_internal_password` (boolean)

        > Update internal authentik password when login succeeds with LDAP

    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `PATCH` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `password_login_update_internal_password` (boolean)

    > Update internal authentik password when login succeeds with LDAP

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `password_login_update_internal_password` (boolean)

        > Update internal authentik password when login succeeds with LDAP

    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `GET` /sources/ldap/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/oauth/&#123;slug&#125;/

##### `GET` /sources/oauth/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

    - Changed property `provider_type` (string)

        Added enum value:
        - `gitlab`

##### `PUT` /sources/oauth/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

- Changed property `provider_type` (string)

    Added enum value:
    - `gitlab`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

    - Changed property `provider_type` (string)

        Added enum value:
        - `gitlab`

##### `PATCH` /sources/oauth/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

- Changed property `provider_type` (string)

    Added enum value:
    - `gitlab`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

    - Changed property `provider_type` (string)

        Added enum value:
        - `gitlab`

##### `GET` /sources/oauth/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/plex/&#123;slug&#125;/

##### `GET` /sources/plex/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `PUT` /sources/plex/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `PATCH` /sources/plex/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `GET` /sources/plex/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/saml/&#123;slug&#125;/

##### `GET` /sources/saml/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `name_id_policy` (string)

        > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    - Changed property `policy_engine_mode` (string)

    - Changed property `binding_type` (string)

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `PUT` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

- Changed property `policy_engine_mode` (string)

- Changed property `binding_type` (string)

- Changed property `digest_algorithm` (string)

- Changed property `signature_algorithm` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `name_id_policy` (string)

        > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    - Changed property `policy_engine_mode` (string)

    - Changed property `binding_type` (string)

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `PATCH` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

- Changed property `policy_engine_mode` (string)

- Changed property `binding_type` (string)

- Changed property `digest_algorithm` (string)

- Changed property `signature_algorithm` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `name_id_policy` (string)

        > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    - Changed property `policy_engine_mode` (string)

    - Changed property `binding_type` (string)

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `GET` /sources/saml/&#123;slug&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/user_connections/all/&#123;id&#125;/

##### `GET` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PUT` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PATCH` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/all/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/user_connections/oauth/&#123;id&#125;/

##### `GET` /sources/user_connections/oauth/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PUT` /sources/user_connections/oauth/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PATCH` /sources/user_connections/oauth/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/oauth/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/user_connections/plex/&#123;id&#125;/

##### `GET` /sources/user_connections/plex/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PUT` /sources/user_connections/plex/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PATCH` /sources/user_connections/plex/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/plex/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /sources/user_connections/saml/&#123;id&#125;/

##### `GET` /sources/user_connections/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PUT` /sources/user_connections/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `PATCH` /sources/user_connections/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/saml/&#123;id&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/all/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /stages/authenticator/duo/&#123;stage_uuid&#125;/enrollment_status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `duo_response` (string)

##### `GET` /stages/authenticator/duo/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/authenticator/sms/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/authenticator/static/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/authenticator/totp/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/authenticator/validate/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/captcha/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/consent/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/deny/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/dummy/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/email/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/identification/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `DELETE` /stages/invitation/invitations/&#123;invite_uuid&#125;/

##### `GET` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/invitation/invitations/&#123;invite_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/invitation/stages/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/password/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/prompt/prompts/&#123;prompt_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/prompt/stages/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/user_delete/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/user_login/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/user_logout/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `GET` /stages/user_write/&#123;stage_uuid&#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

##### `POST` /authenticators/admin/static/

##### `GET` /authenticators/admin/static/

##### `GET` /authenticators/static/

##### `POST` /core/applications/

###### Request:

Changed content type : `application/json`

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `policy_engine_mode` (string)

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Application Serializer
        - Changed property `policy_engine_mode` (string)

##### `POST` /core/groups/

##### `GET` /core/groups/

###### Parameters:

Added: `include_users` in `query`

##### `POST` /core/tokens/

###### Request:

Changed content type : `application/json`

- Changed property `intent` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `intent` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `GET` /core/tokens/

###### Parameters:

Changed: `intent` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Token Serializer
        - Changed property `intent` (string)

        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `type` (string)

##### `DELETE` /core/user_consent/&#123;id&#125;/

##### `GET` /core/user_consent/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `type` (string)

    - Changed property `application` (object)

        > Application Serializer
        - Changed property `policy_engine_mode` (string)

##### `POST` /core/users/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `GET` /core/users/

###### Parameters:

Added: `include_groups` in `query`

Changed: `type` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User Serializer
        - Changed property `type` (string)

##### `GET` /core/users/me/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer for information a user can retrieve about themselves
        - Changed property `type` (string)

##### `POST` /events/events/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `action` (string)

##### `GET` /events/events/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Serializer
        - Changed property `action` (string)

##### `DELETE` /events/notifications/&#123;uuid&#125;/

##### `GET` /events/notifications/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `severity` (string)

    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

##### `PUT` /events/notifications/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

    > Event Serializer
    - Changed property `action` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `severity` (string)

    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

##### `PATCH` /events/notifications/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

    > Event Serializer
    - Changed property `action` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `severity` (string)

    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

##### `POST` /events/rules/

###### Request:

Changed content type : `application/json`

- Changed property `severity` (string)
    > Controls which severity level the created notifications will have.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `severity` (string)
        > Controls which severity level the created notifications will have.

##### `GET` /events/rules/

###### Parameters:

Changed: `severity` in `query`

> Controls which severity level the created notifications will have.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationRule Serializer
        - Changed property `severity` (string)
            > Controls which severity level the created notifications will have.

##### `GET` /events/system_tasks/

###### Parameters:

Changed: `status` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serialize TaskInfo and TaskResult
        - Changed property `messages` (array)

            Changed items (string -> object): > Single log message with all context logged.

        - Changed property `status` (string)

##### `POST` /events/transports/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `mode` (string)

##### `GET` /events/transports/

###### Parameters:

Changed: `mode` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationTransport Serializer
        - Changed property `mode` (string)

##### `DELETE` /flows/bindings/&#123;fsb_uuid&#125;/

##### `GET` /flows/bindings/&#123;fsb_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `invalid_response_action` (string)

        > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

    - Changed property `policy_engine_mode` (string)

    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `layout` (string)

##### `PUT` /flows/bindings/&#123;fsb_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `invalid_response_action` (string)

    > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `invalid_response_action` (string)

        > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

    - Changed property `policy_engine_mode` (string)

    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `layout` (string)

##### `PATCH` /flows/bindings/&#123;fsb_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `invalid_response_action` (string)

    > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `invalid_response_action` (string)

        > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

    - Changed property `policy_engine_mode` (string)

    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `layout` (string)

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Changed property `designation` (string)

    > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

- Changed property `denied_action` (string)

    > Configure what should happen when a flow denies access to a user.

- Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

- Changed property `policy_engine_mode` (string)

- Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

##### `GET` /flows/instances/

###### Parameters:

Changed: `denied_action` in `query`

> Configure what should happen when a flow denies access to a user.

Changed: `designation` in `query`

> Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Flow Serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /oauth2/access_tokens/&#123;id&#125;/

##### `GET` /oauth2/access_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider` (object)

        > OAuth2Provider Serializer
        - Changed property `client_type` (string)

            > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

        - Changed property `sub_mode` (string)

            > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

        - Changed property `issuer_mode` (string)
            > Configure how the issuer field of the ID Token should be filled.

    - Changed property `user` (object)

        > User Serializer
        - Changed property `type` (string)

##### `DELETE` /oauth2/authorization_codes/&#123;id&#125;/

##### `GET` /oauth2/authorization_codes/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider` (object)

        > OAuth2Provider Serializer
        - Changed property `client_type` (string)

            > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

        - Changed property `sub_mode` (string)

            > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

        - Changed property `issuer_mode` (string)
            > Configure how the issuer field of the ID Token should be filled.

    - Changed property `user` (object)

        > User Serializer
        - Changed property `type` (string)

##### `DELETE` /oauth2/refresh_tokens/&#123;id&#125;/

##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider` (object)

        > OAuth2Provider Serializer
        - Changed property `client_type` (string)

            > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

        - Changed property `sub_mode` (string)

            > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

        - Changed property `issuer_mode` (string)
            > Configure how the issuer field of the ID Token should be filled.

    - Changed property `user` (object)

        > User Serializer
        - Changed property `type` (string)

##### `POST` /outposts/instances/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `type` (string)

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Outpost Serializer
        - Changed property `type` (string)

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAPProvider Serializer
        - Changed property `search_mode` (string)

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `type` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PolicyBinding Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `type` (string)

##### `POST` /providers/ldap/

###### Request:

Changed content type : `application/json`

- Changed property `search_mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `search_mode` (string)

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAPProvider Serializer
        - Changed property `search_mode` (string)

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Changed property `sp_binding` (string)

    > This determines how authentik sends the response back to the Service Provider.

- Changed property `digest_algorithm` (string)

- Changed property `signature_algorithm` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `sp_binding` (string)

        > This determines how authentik sends the response back to the Service Provider.

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `GET` /providers/saml/

###### Parameters:

Changed: `digest_algorithm` in `query`

Changed: `signature_algorithm` in `query`

Changed: `sp_binding` in `query`

> This determines how authentik sends the response back to the Service Provider.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLProvider Serializer
        - Changed property `sp_binding` (string)

            > This determines how authentik sends the response back to the Service Provider.

        - Changed property `digest_algorithm` (string)

        - Changed property `signature_algorithm` (string)

##### `GET` /providers/scim/&#123;id&#125;/sync_status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `tasks` (array)

        Changed items (object): > Serialize TaskInfo and TaskResult
        - Changed property `messages` (array)

            Changed items (string -> object): > Single log message with all context logged.

        - Changed property `status` (string)

##### `GET` /rac/connection_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > ConnectionToken Serializer

        New optional properties:
        - `pk`
        * Changed property `pk` (string)

        * Changed property `endpoint` (string)

        * Changed property `endpoint_obj` (object)

            > Endpoint Serializer
            - Changed property `protocol` (string)

            - Changed property `auth_mode` (string)

##### `POST` /rac/endpoints/

###### Request:

Changed content type : `application/json`

- Changed property `protocol` (string)

- Changed property `auth_mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `protocol` (string)

    - Changed property `auth_mode` (string)

##### `GET` /rac/endpoints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Endpoint Serializer
        - Changed property `protocol` (string)

        - Changed property `auth_mode` (string)

##### `GET` /rbac/permissions/assigned_by_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned_by_users/

###### Parameters:

Changed: `model` in `query`

##### `GET` /sources/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `password_login_update_internal_password` (boolean)

    > Update internal authentik password when login succeeds with LDAP

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `password_login_update_internal_password` (boolean)

        > Update internal authentik password when login succeeds with LDAP

    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `GET` /sources/ldap/

###### Parameters:

Added: `password_login_update_internal_password` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAP Source Serializer
        - Added property `password_login_update_internal_password` (boolean)

            > Update internal authentik password when login succeeds with LDAP

        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/ldap/&#123;slug&#125;/sync_status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `tasks` (array)

        Changed items (object): > Serialize TaskInfo and TaskResult
        - Changed property `messages` (array)

            Changed items (string -> object): > Single log message with all context logged.

        - Changed property `status` (string)

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

- Changed property `provider_type` (string)

    Added enum value:
    - `gitlab`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

    - Changed property `provider_type` (string)

        Added enum value:
        - `gitlab`

##### `GET` /sources/oauth/

###### Parameters:

Changed: `policy_engine_mode` in `query`

Changed: `user_matching_mode` in `query`

> How the source determines if an existing user should be authenticated or a new user enrolled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

        - Changed property `provider_type` (string)

            Added enum value:
            - `gitlab`

##### `POST` /sources/plex/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `policy_engine_mode` (string)

##### `GET` /sources/plex/

###### Parameters:

Changed: `policy_engine_mode` in `query`

Changed: `user_matching_mode` in `query`

> How the source determines if an existing user should be authenticated or a new user enrolled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Plex Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `POST` /sources/plex/redeem_token/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

    - Changed property `flow_info` (object)

        > Contextual flow information for a challenge
        - Changed property `layout` (string)

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Changed property `user_matching_mode` (string)

    > How the source determines if an existing user should be authenticated or a new user enrolled.

- Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

- Changed property `policy_engine_mode` (string)

- Changed property `binding_type` (string)

- Changed property `digest_algorithm` (string)

- Changed property `signature_algorithm` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_matching_mode` (string)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `name_id_policy` (string)

        > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    - Changed property `policy_engine_mode` (string)

    - Changed property `binding_type` (string)

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

##### `GET` /sources/saml/

###### Parameters:

Changed: `binding_type` in `query`

Changed: `digest_algorithm` in `query`

Changed: `name_id_policy` in `query`

> NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

Changed: `policy_engine_mode` in `query`

Changed: `signature_algorithm` in `query`

Changed: `user_matching_mode` in `query`

> How the source determines if an existing user should be authenticated or a new user enrolled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLSource Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `name_id_policy` (string)

            > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

        - Changed property `policy_engine_mode` (string)

        - Changed property `binding_type` (string)

        - Changed property `digest_algorithm` (string)

        - Changed property `signature_algorithm` (string)

##### `GET` /sources/user_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer
        - Changed property `source` (object)

            > Source Serializer
            - Changed property `user_matching_mode` (string)

                > How the source determines if an existing user should be authenticated or a new user enrolled.

            - Changed property `policy_engine_mode` (string)

##### `POST` /sources/user_connections/oauth/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer
        - Changed property `source` (object)

            > Source Serializer
            - Changed property `user_matching_mode` (string)

                > How the source determines if an existing user should be authenticated or a new user enrolled.

            - Changed property `policy_engine_mode` (string)

##### `POST` /sources/user_connections/plex/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Plex Source connection Serializer
        - Changed property `source` (object)

            > Source Serializer
            - Changed property `user_matching_mode` (string)

                > How the source determines if an existing user should be authenticated or a new user enrolled.

            - Changed property `policy_engine_mode` (string)

##### `POST` /sources/user_connections/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Changed property `user_matching_mode` (string)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `policy_engine_mode` (string)

##### `GET` /sources/user_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAML Source Serializer
        - Changed property `source` (object)

            > Source Serializer
            - Changed property `user_matching_mode` (string)

                > How the source determines if an existing user should be authenticated or a new user enrolled.

            - Changed property `policy_engine_mode` (string)

##### `DELETE` /stages/all/&#123;stage_uuid&#125;/

##### `GET` /stages/all/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/authenticator/duo/&#123;stage_uuid&#125;/

##### `GET` /stages/authenticator/duo/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/authenticator/duo/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/authenticator/duo/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/authenticator/sms/&#123;stage_uuid&#125;/

##### `GET` /stages/authenticator/sms/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider` (string)

    - Changed property `auth_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/authenticator/sms/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (string)

- Changed property `auth_type` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider` (string)

    - Changed property `auth_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/authenticator/sms/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (string)

- Changed property `auth_type` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider` (string)

    - Changed property `auth_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/authenticator/static/&#123;stage_uuid&#125;/

##### `GET` /stages/authenticator/static/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/authenticator/static/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/authenticator/static/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/authenticator/totp/&#123;stage_uuid&#125;/

##### `GET` /stages/authenticator/totp/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `digits` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/authenticator/totp/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `digits` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `digits` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/authenticator/totp/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `digits` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `digits` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/authenticator/validate/&#123;stage_uuid&#125;/

##### `GET` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `webauthn_allowed_device_types_obj`
    * Added property `webauthn_allowed_device_types` (array)

        Items (string):

    * Added property `webauthn_allowed_device_types_obj` (array)

        Items (object): > WebAuthnDeviceType Serializer

    * Changed property `webauthn_user_verification` (string)

        > Enforce user verification for WebAuthn devices.

    * Changed property `not_configured_action` (string)

    * Changed property `device_classes` (array)

        > Device classes which can be used to authenticate

        Changed items (string):

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_allowed_device_types` (array)

- Changed property `webauthn_user_verification` (string)

    > Enforce user verification for WebAuthn devices.

- Changed property `not_configured_action` (string)

- Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `webauthn_allowed_device_types_obj`
    * Added property `webauthn_allowed_device_types` (array)

    * Added property `webauthn_allowed_device_types_obj` (array)

    * Changed property `webauthn_user_verification` (string)

        > Enforce user verification for WebAuthn devices.

    * Changed property `not_configured_action` (string)

    * Changed property `device_classes` (array)

        > Device classes which can be used to authenticate

        Changed items (string):

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_allowed_device_types` (array)

- Changed property `webauthn_user_verification` (string)

    > Enforce user verification for WebAuthn devices.

- Changed property `not_configured_action` (string)

- Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `webauthn_allowed_device_types_obj`
    * Added property `webauthn_allowed_device_types` (array)

    * Added property `webauthn_allowed_device_types_obj` (array)

    * Changed property `webauthn_user_verification` (string)

        > Enforce user verification for WebAuthn devices.

    * Changed property `not_configured_action` (string)

    * Changed property `device_classes` (array)

        > Device classes which can be used to authenticate

        Changed items (string):

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

##### `GET` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `device_type_restrictions_obj`
    * Added property `device_type_restrictions` (array)

    * Added property `device_type_restrictions_obj` (array)

    * Changed property `authenticator_attachment` (string)

    * Changed property `user_verification` (string)

    * Changed property `resident_key_requirement` (string)

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `device_type_restrictions` (array)

- Changed property `authenticator_attachment` (string)

- Changed property `user_verification` (string)

- Changed property `resident_key_requirement` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `device_type_restrictions_obj`
    * Added property `device_type_restrictions` (array)

    * Added property `device_type_restrictions_obj` (array)

    * Changed property `authenticator_attachment` (string)

    * Changed property `user_verification` (string)

    * Changed property `resident_key_requirement` (string)

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `device_type_restrictions` (array)

- Changed property `authenticator_attachment` (string)

- Changed property `user_verification` (string)

- Changed property `resident_key_requirement` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `device_type_restrictions_obj`
    * Added property `device_type_restrictions` (array)

    * Added property `device_type_restrictions_obj` (array)

    * Changed property `authenticator_attachment` (string)

    * Changed property `user_verification` (string)

    * Changed property `resident_key_requirement` (string)

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/captcha/&#123;stage_uuid&#125;/

##### `GET` /stages/captcha/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/captcha/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/captcha/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/consent/&#123;stage_uuid&#125;/

##### `GET` /stages/consent/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/consent/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/consent/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `mode` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/deny/&#123;stage_uuid&#125;/

##### `GET` /stages/deny/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/deny/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/deny/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/dummy/&#123;stage_uuid&#125;/

##### `GET` /stages/dummy/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/dummy/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/dummy/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/email/&#123;stage_uuid&#125;/

##### `GET` /stages/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/email/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/email/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/identification/&#123;stage_uuid&#125;/

##### `GET` /stages/identification/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_fields` (array)

        > Fields of the user object to match against. (Hold shift to select multiple options)

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/identification/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_fields` (array)

    > Fields of the user object to match against. (Hold shift to select multiple options)

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_fields` (array)

        > Fields of the user object to match against. (Hold shift to select multiple options)

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/identification/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_fields` (array)

    > Fields of the user object to match against. (Hold shift to select multiple options)

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_fields` (array)

        > Fields of the user object to match against. (Hold shift to select multiple options)

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Invitation Serializer
        - Changed property `flow_obj` (object)

            > Flow Serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `authentication` (string)

                > Required level of authentication and authorization to access a flow.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `DELETE` /stages/invitation/stages/&#123;stage_uuid&#125;/

##### `GET` /stages/invitation/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/invitation/stages/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/invitation/stages/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/password/&#123;stage_uuid&#125;/

##### `GET` /stages/password/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `backends` (array)

        > Selection of backends to test the password against.

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/password/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `backends` (array)

        > Selection of backends to test the password against.

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/password/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `backends` (array)

        > Selection of backends to test the password against.

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/prompt/stages/&#123;stage_uuid&#125;/

##### `GET` /stages/prompt/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/prompt/stages/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/prompt/stages/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/user_delete/&#123;stage_uuid&#125;/

##### `GET` /stages/user_delete/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/user_delete/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/user_delete/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/user_login/&#123;stage_uuid&#125;/

##### `GET` /stages/user_login/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `network_binding` (string)

        > Bind sessions created by this stage to the configured network

    - Changed property `geoip_binding` (string)

        > Bind sessions created by this stage to the configured GeoIP location

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/user_login/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `network_binding` (string)

    > Bind sessions created by this stage to the configured network

- Changed property `geoip_binding` (string)

    > Bind sessions created by this stage to the configured GeoIP location

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `network_binding` (string)

        > Bind sessions created by this stage to the configured network

    - Changed property `geoip_binding` (string)

        > Bind sessions created by this stage to the configured GeoIP location

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/user_login/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `network_binding` (string)

    > Bind sessions created by this stage to the configured network

- Changed property `geoip_binding` (string)

    > Bind sessions created by this stage to the configured GeoIP location

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `network_binding` (string)

        > Bind sessions created by this stage to the configured network

    - Changed property `geoip_binding` (string)

        > Bind sessions created by this stage to the configured GeoIP location

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/user_logout/&#123;stage_uuid&#125;/

##### `GET` /stages/user_logout/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/user_logout/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/user_logout/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `DELETE` /stages/user_write/&#123;stage_uuid&#125;/

##### `GET` /stages/user_write/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_creation_mode` (string)

    - Changed property `user_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /stages/user_write/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_creation_mode` (string)

- Changed property `user_type` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_creation_mode` (string)

    - Changed property `user_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PATCH` /stages/user_write/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `user_creation_mode` (string)

- Changed property `user_type` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_creation_mode` (string)

    - Changed property `user_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider_model` (string)

- Changed property `app` (object)

    > Application Serializer
    - Changed property `policy_engine_mode` (string)

- Changed property `provider` (object)

    Updated `authentik_providers_oauth2.oauth2provider` provider_model:
    - Changed property `client_type` (string)

        > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

    - Changed property `sub_mode` (string)

        > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

    - Changed property `issuer_mode` (string)
        > Configure how the issuer field of the ID Token should be filled.

    Updated `authentik_providers_proxy.proxyprovider` provider_model:
    - Changed property `mode` (string)
        > Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

    Updated `authentik_providers_saml.samlprovider` provider_model:
    - Changed property `sp_binding` (string)

        > This determines how authentik sends the response back to the Service Provider.

    - Changed property `digest_algorithm` (string)

    - Changed property `signature_algorithm` (string)

    Updated `authentik_providers_ldap.ldapprovider` provider_model:
    - Changed property `search_mode` (string)

##### `GET` /core/user_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserConsent Serializer
        - Changed property `user` (object)

            > User Serializer
            - Changed property `type` (string)

        - Changed property `application` (object)

            > Application Serializer
            - Changed property `policy_engine_mode` (string)

##### `GET` /events/notifications/

###### Parameters:

Changed: `severity` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Notification Serializer
        - Changed property `severity` (string)

        - Changed property `event` (object)

            > Event Serializer
            - Changed property `action` (string)

##### `POST` /flows/bindings/

###### Request:

Changed content type : `application/json`

- Changed property `invalid_response_action` (string)

    > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

- Changed property `policy_engine_mode` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `invalid_response_action` (string)

        > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

    - Changed property `policy_engine_mode` (string)

    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `layout` (string)

##### `GET` /flows/bindings/

###### Parameters:

Changed: `invalid_response_action` in `query`

> Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

Changed: `policy_engine_mode` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > FlowStageBinding Serializer
        - Changed property `invalid_response_action` (string)

            > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

        - Changed property `policy_engine_mode` (string)

        - Changed property `stage_obj` (object)

            > Stage Serializer
            - Changed property `flow_set` (array)

                Changed items (object): > Stripped down flow serializer
                - Changed property `designation` (string)

                    > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

                - Changed property `denied_action` (string)

                    > Configure what should happen when a flow denies access to a user.

                - Changed property `layout` (string)

##### `GET` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-dummy` component:
    New required properties:
    - `name`
    * Added property `name` (string)

    Updated `ak-provider-oauth2-device-code` component:
    - Changed property `type` (string)

    - Changed property `flow_info` (object)

        > Contextual flow information for a challenge
        - Changed property `layout` (string)

    Updated `ak-stage-prompt` component:
    - Changed property `fields` (array)

        Changed items (object): > Serializer for a single Prompt field
        - Changed property `type` (string)

    Updated `ak-stage-identification` component:
    New required properties:
    - `flow_designation`
    * Added property `flow_designation` (string)

        Enum values:
        - `authentication`
        - `authorization`
        - `invalidation`
        - `enrollment`
        - `unenrollment`
        - `recovery`
        - `stage_configuration`

##### `POST` /flows/executor/&#123;flow_slug&#125;/

###### Request:

Changed content type : `application/json`

Updated `ak-source-oauth-apple` component:

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-dummy` component:
    New required properties:
    - `name`
    * Added property `name` (string)

    Updated `ak-provider-oauth2-device-code` component:
    - Changed property `type` (string)

    - Changed property `flow_info` (object)

        > Contextual flow information for a challenge
        - Changed property `layout` (string)

    Updated `ak-stage-prompt` component:
    - Changed property `fields` (array)

        Changed items (object): > Serializer for a single Prompt field
        - Changed property `type` (string)

    Updated `ak-stage-identification` component:
    New required properties:
    - `flow_designation`
    * Added property `flow_designation` (string)

##### `GET` /flows/inspector/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `plans` (array)

        Changed items (object): > Serializer for an active FlowPlan
        - Changed property `next_planned_stage` (object)

            > FlowStageBinding Serializer
            - Changed property `invalid_response_action` (string)
                > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

        - Changed property `current_stage` (object)

            > FlowStageBinding Serializer
            - Changed property `invalid_response_action` (string)

                > Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.

            - Changed property `policy_engine_mode` (string)

            - Changed property `stage_obj` (object)

                > Stage Serializer
                - Changed property `flow_set` (array)

                    Changed items (object): > Stripped down flow serializer
                    - Changed property `designation` (string)

                        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

                    - Changed property `denied_action` (string)

                        > Configure what should happen when a flow denies access to a user.

                    - Changed property `layout` (string)

##### `GET` /oauth2/access_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `provider` (object)

            > OAuth2Provider Serializer
            - Changed property `client_type` (string)

                > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

            - Changed property `sub_mode` (string)

                > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

            - Changed property `issuer_mode` (string)
                > Configure how the issuer field of the ID Token should be filled.

        - Changed property `user` (object)

            > User Serializer
            - Changed property `type` (string)

##### `GET` /oauth2/authorization_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
        - Changed property `provider` (object)

            > OAuth2Provider Serializer
            - Changed property `client_type` (string)

                > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

            - Changed property `sub_mode` (string)

                > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

            - Changed property `issuer_mode` (string)
                > Configure how the issuer field of the ID Token should be filled.

        - Changed property `user` (object)

            > User Serializer
            - Changed property `type` (string)

##### `GET` /oauth2/refresh_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `provider` (object)

            > OAuth2Provider Serializer
            - Changed property `client_type` (string)

                > Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

            - Changed property `sub_mode` (string)

                > Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

            - Changed property `issuer_mode` (string)
                > Configure how the issuer field of the ID Token should be filled.

        - Changed property `user` (object)

            > User Serializer
            - Changed property `type` (string)

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/authenticator/duo/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorDuoStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/authenticator/sms/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (string)

- Changed property `auth_type` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `provider` (string)

    - Changed property `auth_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/authenticator/sms/

###### Parameters:

Changed: `auth_type` in `query`

Changed: `provider` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorSMSStage Serializer
        - Changed property `provider` (string)

        - Changed property `auth_type` (string)

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/authenticator/static/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorStaticStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/authenticator/totp/

###### Request:

Changed content type : `application/json`

- Changed property `digits` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `digits` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/authenticator/totp/

###### Parameters:

Changed: `digits` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorTOTPStage Serializer
        - Changed property `digits` (string)

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_allowed_device_types` (array)

- Changed property `webauthn_user_verification` (string)

    > Enforce user verification for WebAuthn devices.

- Changed property `not_configured_action` (string)

- Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `webauthn_allowed_device_types_obj`
    * Added property `webauthn_allowed_device_types` (array)

    * Added property `webauthn_allowed_device_types_obj` (array)

    * Changed property `webauthn_user_verification` (string)

        > Enforce user verification for WebAuthn devices.

    * Changed property `not_configured_action` (string)

    * Changed property `device_classes` (array)

        > Device classes which can be used to authenticate

        Changed items (string):

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/authenticator/validate/

###### Parameters:

Changed: `not_configured_action` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorValidateStage Serializer

        New required properties:
        - `webauthn_allowed_device_types_obj`
        * Added property `webauthn_allowed_device_types` (array)

        * Added property `webauthn_allowed_device_types_obj` (array)

        * Changed property `webauthn_user_verification` (string)

            > Enforce user verification for WebAuthn devices.

        * Changed property `not_configured_action` (string)

        * Changed property `device_classes` (array)

            > Device classes which can be used to authenticate

            Changed items (string):

        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Added property `device_type_restrictions` (array)

- Changed property `authenticator_attachment` (string)

- Changed property `user_verification` (string)

- Changed property `resident_key_requirement` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `device_type_restrictions_obj`
    * Added property `device_type_restrictions` (array)

    * Added property `device_type_restrictions_obj` (array)

    * Changed property `authenticator_attachment` (string)

    * Changed property `user_verification` (string)

    * Changed property `resident_key_requirement` (string)

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/authenticator/webauthn/

###### Parameters:

Added: `device_type_restrictions` in `query`

Changed: `authenticator_attachment` in `query`

Changed: `resident_key_requirement` in `query`

Changed: `user_verification` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorWebAuthnStage Serializer

        New required properties:
        - `device_type_restrictions_obj`
        * Added property `device_type_restrictions` (array)

        * Added property `device_type_restrictions_obj` (array)

        * Changed property `authenticator_attachment` (string)

        * Changed property `user_verification` (string)

        * Changed property `resident_key_requirement` (string)

        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > CaptchaStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/consent/

###### Request:

Changed content type : `application/json`

- Changed property `mode` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `mode` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/consent/

###### Parameters:

Changed: `mode` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > ConsentStage Serializer
        - Changed property `mode` (string)

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/deny/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > DenyStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/dummy/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > DummyStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > EmailStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Changed property `user_fields` (array)

    > Fields of the user object to match against. (Hold shift to select multiple options)

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_fields` (array)

        > Fields of the user object to match against. (Hold shift to select multiple options)

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > IdentificationStage Serializer
        - Changed property `user_fields` (array)

            > Fields of the user object to match against. (Hold shift to select multiple options)

            Changed items (string):

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/invitation/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > InvitationStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Changed property `backends` (array)

    > Selection of backends to test the password against.

    Changed items (string):

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `backends` (array)

        > Selection of backends to test the password against.

        Changed items (string):

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PasswordStage Serializer
        - Changed property `backends` (array)

            > Selection of backends to test the password against.

            Changed items (string):

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `DELETE` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

##### `GET` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

    - Changed property `promptstage_set` (array)

        Changed items (object): > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `PUT` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

- Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

    - Changed property `promptstage_set` (array)

        Changed items (object): > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `PATCH` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

- Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

    - Changed property `promptstage_set` (array)

        Changed items (object): > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/prompt/prompts/preview/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

- Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

    - Changed property `flow_info` (object)

        > Contextual flow information for a challenge
        - Changed property `layout` (string)

    - Changed property `fields` (array)

        Changed items (object): > Serializer for a single Prompt field
        - Changed property `type` (string)

##### `POST` /stages/prompt/stages/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PromptStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/user_delete/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/user_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserDeleteStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/user_login/

###### Request:

Changed content type : `application/json`

- Changed property `network_binding` (string)

    > Bind sessions created by this stage to the configured network

- Changed property `geoip_binding` (string)

    > Bind sessions created by this stage to the configured GeoIP location

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `network_binding` (string)

        > Bind sessions created by this stage to the configured network

    - Changed property `geoip_binding` (string)

        > Bind sessions created by this stage to the configured GeoIP location

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/user_login/

###### Parameters:

Changed: `geoip_binding` in `query`

> Bind sessions created by this stage to the configured GeoIP location

Changed: `network_binding` in `query`

> Bind sessions created by this stage to the configured network

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserLoginStage Serializer
        - Changed property `network_binding` (string)

            > Bind sessions created by this stage to the configured network

        - Changed property `geoip_binding` (string)

            > Bind sessions created by this stage to the configured GeoIP location

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/user_logout/

###### Request:

Changed content type : `application/json`

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/user_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserLogoutStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/user_write/

###### Request:

Changed content type : `application/json`

- Changed property `user_creation_mode` (string)

- Changed property `user_type` (string)

- Changed property `flow_set` (array)

    Changed items (object): > Stripped down flow serializer
    - Changed property `designation` (string)

        > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

    - Changed property `denied_action` (string)

        > Configure what should happen when a flow denies access to a user.

    - Changed property `policy_engine_mode` (string)

    - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_creation_mode` (string)

    - Changed property `user_type` (string)

    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

##### `GET` /stages/user_write/

###### Parameters:

Changed: `user_creation_mode` in `query`

Changed: `user_type` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserWriteStage Serializer
        - Changed property `user_creation_mode` (string)

        - Changed property `user_type` (string)

        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

- Changed property `promptstage_set` (array)

    Changed items (object): > Stage Serializer
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `designation` (string)

            > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

        - Changed property `denied_action` (string)

            > Configure what should happen when a flow denies access to a user.

        - Changed property `policy_engine_mode` (string)

        - Changed property `layout` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `type` (string)

    - Changed property `promptstage_set` (array)

        Changed items (object): > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `designation` (string)

                > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

            - Changed property `denied_action` (string)

                > Configure what should happen when a flow denies access to a user.

            - Changed property `policy_engine_mode` (string)

            - Changed property `layout` (string)

##### `GET` /stages/prompt/prompts/

###### Parameters:

Changed: `type` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Prompt Serializer
        - Changed property `type` (string)

        - Changed property `promptstage_set` (array)

            Changed items (object): > Stage Serializer
            - Changed property `flow_set` (array)

                Changed items (object): > Stripped down flow serializer
                - Changed property `designation` (string)

                    > Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.

                - Changed property `denied_action` (string)

                    > Configure what should happen when a flow denies access to a user.

                - Changed property `policy_engine_mode` (string)

                - Changed property `layout` (string)

---

## Release 2024.6

## Highlights

- **PostgreSQL read replicas**: Optimize database query routing by using read replicas to balance the load
- **New Enterprise providers**:   Google Workspace and Microsoft Entra ID providers allow for user synchronization with authentik
- **Improved CAPTCHA stage**: Allows configurable dynamic use of CAPTCHAs

## Breaking changes

### PostgreSQL minimum supported version upgrade

With this release, authentik now requires PostgreSQL version 14 or later. We recommend upgrading to the latest version if you are running an older version.

The provided Helm chart defaults to PostgreSQL 15. If you are using the Helm chart with the default values, no action is required.

The provided Compose file was updated with PostgreSQL 16. You can follow the procedure [here](../../troubleshooting/postgres/upgrade_docker.mdx) to upgrade.

### Group names unicity

With this release, authentik now enforces unique group names. Existing groups with name collisions that were created in earlier versions can still exist, but any new groups you create will need a unique name. If changing attributes, permission-level, or parent on an existing group with a name collision, you need to also change its name to be unique. Note that changing members or roles associated with the group does not require a rename.

### GeoIP and ASN context object

The `context["geoip"]` and `context["asn"]` objects available in expression policies are now dictionaries. Attributes must now be accessed via dictionary accessors. See [our policy examples](../../customize/policies/types/expression/index.mdx) for the updated syntax.

## New features

- **Google Workspace Provider** &#x20;

  With the Google Workspace provider, authentik serves as the single source of truth for all users and groups, when using Google products like Gmail.

  For details refer to the [Google Workspace Provider documentation](../../add-secure-apps/providers/gws/index.mdx)

- **Microsoft Entra ID Provider** &#x20;

  With the Microsoft Entra ID provider, authentik serves as the single source of truth for all users and groups. Configuring Entra ID as a provider allows for auto-discovery of user and group accounts, on-going synchronization of user data such as email address, name, and status, and integrated data mapping of field names and values.

  For details refer to the [Microsoft Entra ID documentation](../../add-secure-apps/providers/entra/index.mdx)

- **Read-replica DB support**

  Multiple read-only databases can be configured to route read-only requests to the non-primary database instance so that the main database can be reserved to write requests.

  For details refer to the [PostgreSQL configuration](../../install-config/configuration/configuration.mdx#postgresql-settings)

- **Improved CAPTCHA stage**

  Thresholds can now be configured on the CAPTCHA stage to customize its result. Additionally, the stage can be configured to continue the flow if the CAPTCHA score is outside of those thresholds for further decision making via expression policies.

  For details refer to the [CAPTCHA stage](../../add-secure-apps/flows-stages/stages/captcha/index.mdx)

- **Optimize sync and property mapping execution**

  The synchronization process from sources has been optimized to avoid unnecessary operations. Additionally, the Python compilation of property mappings is now cached so that it only happens once per sync.

- **Wizards now use a grid layout**

  The provider and source creation wizards now use a grid layout showing logos and descriptions of available protocols and services.

## Fixes

- **Reworked proxy provider redirect**

  Following-up on a [highly requested issue](https://github.com/goauthentik/authentik/issues/6886), we've reworked our [Proxy provider](../../add-secure-apps/providers/proxy/index.mdx) to avoid invalid user-facing redirects.

## Upgrading

With this release, authentik now requires PostgreSQL version 14 or later. We recommend upgrading to the latest version if needed. Follow the instructions [here](../../troubleshooting/postgres/upgrade_docker.mdx) if you need to upgrade PostgreSQL with docker-compose.

### Docker Compose

To upgrade, download the new `docker-compose.yml` file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2024.6/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6
```

## Minor changes/fixes

- admin: system api: do not show FIPS status if no valid license (#10091)
- admin: system api: fix FIPS status schema (#10110)
- core: FIPS (#9683)
- core: add include\_users flag to single group retrieval (#9721)
- core: add option to select group for property mapping testing (#9834)
- core: fix auth\_method and auth\_method\_args being overwritten by password stage (#9782)
- core: fix condition in task clean\_expiring\_models (#9603)
- core: fix error when raising SkipObject in mapping (cherry-pick #10153)
- core: fix logic for token expiration (#9426)
- core: fix source flow\_manager not always appending save stage (#9659)
- core: fix source\_flow\_manager saving user-source connection too early (#9559)
- core: fix task clean\_expiring\_models removing valid sessions with using database storage (#9598)
- core: groups api: always prefetch users (#9974)
- core: groups: optimize recursive children query (#9931)
- core: include version in built JS files (cherry-pick #9558) (#10148)
- core: only prefetch related objects when required (#9476)
- core: rework base for SkipObject exception to better support control flow exceptions (cherry-pick #10186) (#10187)
- crypto: update fingerprint at same time as certificate (#10036)
- enterprise/audit: fix audit logging with m2m relations (#9571)
- enterprise/providers/google: initial account sync to google workspace (#9384)
- enterprise/providers/google\_workspace: ensure no group is created when no property mappings are set (#9783)
- enterprise/providers/microsoft\_entra: fix error when updating connection attributes (#10039)
- enterprise/providers/microsoft\_entra: initial account sync to microsoft entra (#9632)
- enterprise/providers: import user/group data when manually linking objects (#10089)
- enterprise/stages/source: fix error when creating source stage from blueprint (#9810)
- events: ensure all models' **str** can be called without any further lookups (#9480)
- events: fix geoip enrich context not converting to json-serializable data (#9885)
- flows: fix execute API endpoint (#9478)
- lib/providers/sync: improve outgoing sync (#9835)
- lib/providers/sync: multiple minor fixes (#9667)
- lib/sync/outgoing, sources/ldap: fix sync status endpoint (#9855)
- lib/sync: fix json error (#9827)
- lifecycle/migrate: only acquire lock once (#9856)
- lifecycle: always try custom redis URL (#9441)
- lifecycle: close database connection after migrating (#9516)
- lifecycle: fix ak test-all command
- policies/reputation: fix existing reputation update (cherry-pick #10124) (#10125)
- policies/reputation: save to database directly (#10059)
- policies: fix ak\_call\_policy failing when used in testing (#9853)
- providers/oauth2: don't handle api scope as special scope (#9910)
- providers/proxy: rework redirect mechanism (#8594)
- providers/rac: bump guacd to 1.5.5 (#9514)
- providers/saml: fix ecdsa support (#9537)
- providers/scim, sources/ldap: switch to using postgres advisory locks instead of redis locks (#9511)
- providers/scim: fix SCIM ID incorrectly used as primary key (#9557)
- providers/scim: fix time\_limit not set correctly (#9546)
- providers/scim: optimize PropertyMapping fetching and execution (#9689)
- providers/sync: improve v3 (#9966)
- providers/sync: update attributes on update (#10012)
- rbac: filters: fix missing attribute for unauthenticated requests (#10061)
- rbac: fix some rough edges and inconsistencies (#9771)
- root: add configuration option to enable fips (#10088)
- root: add primary-replica db router (#9479)
- root: bump blueprint schema version
- root: docker-compose: remove version top level element (#9631)
- root: handle asgi exception (#10085)
- root: include task\_id in events and logs (#9749)
- root: use custom model serializer that saves m2m without bulk (cherry-pick #10139) (#10151)
- security: fix [CVE-2024-37905](../../security/cves/CVE-2024-37905.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #10230) (#10237)
- security: fix [CVE-2024-38371](../../security/cves/CVE-2024-38371.mdx), reported by Stefan Zwanenburg (cherry-pick #10229) (#10234)
- sources/oauth: ensure all UI sources return a valid source (#9401)
- sources/oauth: fix OAuth Client sending token request incorrectly (#9474)
- sources/oauth: modernizes discord icon (#9817)
- sources/saml: fix FlowPlanner error due to pickle (#9708)
- sources/scim: fix duplicate groups and invalid schema (#9466)
- sources/scim: fix service account user path (#9463)
- stages/authenticator\_validate: fix priority of auth\_method being set to auth\_webauthn\_pwl (#9909)
- stages/authenticator\_webauthn: migrate device type import to systemtask and schedule (#9958)
- stages/authenticator\_webauthn: optimize device types creation (#9932)
- stages/captcha: rework (#9959)
- stages/email: fix sanitization of email addresses (#9999)
- stages/identification: don't check source component (#9410)
- stages/user\_login: fix non-json-serializable being used (#9886)
- tenants: fix scheduled tasks not running on default tenant (#9583)
- web/admin: add link to enterprise docs on license page (#9811)
- web/admin: fix disabled button color with dark theme (#9465)
- web/admin: fix document title for admin interface (#9362)
- web/admin: fix entra provider mapping form (#9767)
- web/admin: fix scim provider user list (#10028)
- web/admin: only show non-backchannel providers in application provider select (#9658)
- web/admin: rework initial wizard pages and add grid layout (#9668)
- web/admin: show user internal service account as disabled (#9464)
- web/admin: use chips to display permissions/scopes (#9912)
- web/common: fix locale detection for user-set locale (#9436)
- web/flows: fix error when enrolling multiple WebAuthn devices consecutively (#9545)
- web/flows: fix error when using consecutive webauthn validator stages (#9629)
- web/flows: fix missing fallback for flow logo (#9487)
- web: Add enterprise / FIPS notification to the AdminOverviewPage (#10090)
- web: Add missing integrity hashes to package-lock.json (#9527)
- web: Add resolved and integrity fields back to package-lock.json (#9419)
- web: clean up some repetitive types (#9241)
- web: clean up the options rendering in PromptForm (#9564)
- web: fix docker build for non-release versions (cherry-pick #10154) (#10155)
- web: fix needed because recent upgrade to task breaks spinner button (cherry-pick #10142) (#10150)
- web: fix value handling inside controlled components (#9648)
- web: markdown: display markdown even when frontmatter is missing (#9404)

## Fixed in 2024.6.1

- core: fix migrations missing using db\_alias (cherry-pick #10409) (#10410)
- core: fix source flow\_manager not resuming flow when linking (cherry-pick #10436) (#10438)
- core: remove transitionary old JS urls (cherry-pick #10317) (#10321)
- core: revert backchannel only filtering (cherry-pick #10455) (#10457)
- providers/saml: fix metadata import error handling (cherry-pick #10349) (#10350)
- providers/scim: Fix exception handling for missing ServiceProviderConfig (cherry-pick #10322) (#10335)
- sources/oauth: fix link not being saved (cherry-pick #10374) (#10376)
- sources/saml: fix pickle error, add saml auth tests (cherry-pick #10348) (#10352)
- stages/authenticator\_validate: fix friendly\_name being required (cherry-pick #10382) (#10385)
- stages/user\_login: fix ?next parameter not carried through broken session binding (cherry-pick #10301) (#10302)
- web: set noopener and noreferrer on all external links (#10304)
- web/admin: fix access token list calling wrong API (cherry-pick #10434) (#10435)
- web/flows: remove background image link (cherry-pick #10318) (#10320)
- web/flows: Simplified flow executor (#10296)

## Fixed in 2024.6.2

- core: improve error handling on ASGI level (cherry-pick #10547) (#10552)
- core: remove html language tag for pages that are translated (cherry-pick #10611) (#10613)
- events: associate login\_failed events to a user if possible (cherry-pick #10270) (#10676)
- events: fix race condition (cherry-pick #10602) (#10609)
- lib/sync: handle SkipObject in direct triggered tasks (cherry-pick #10590) (#10591)
- lifecycle: only create tenant media root if needed (cherry-pick #10616) (#10617)
- outposts: ensure minimum refresh interval (cherry-pick #10701) (#10702)
- outposts: make refresh interval configurable (cherry-pick #10138) (#10700)
- stages/prompt: fix prompt not editable with invalid expression (cherry-pick #10603) (#10604)
- web: fix dark theme and theme switch (#10667)
- web/admin: fix missing SAML Provider ECDSA options (cherry-pick #10612) (#10618)
- web/admin: show matching user reputation scores in user details (cherry-pick #10276) (#10699)
- web/flows: remove continue button from AutoSubmit stage (cherry-pick #10253) (#10677)

## Fixed in 2024.6.3

- enterprise/rac: fix error when listing connection tokens as non-superuser (cherry-pick #10771) (#10773)
- root: remove warnings (#10774)
- sources/scim: fix duplicate service account users and changing token (cherry-pick #10735) (#10737)
- web: fix theme not applying to document correctly (cherry-pick #10721) (#10722)
- web: replace all occurrences of the theme placeholder (cherry-pick #10749) (#10750)

## Fixed in 2024.6.4

- security: fix [CVE-2024-42490](../../security/cves/CVE-2024-42490.mdx), reported by [@m2a2](https://github.com/m2a2) (cherry-pick #11022) #11025

## Fixed in 2024.6.5

- security: fix [CVE-2024-47070](../../security/cves/CVE-2024-47070.mdx), reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/) (cherry-pick #11536) (#11540)
- security: fix [CVE-2024-47077](../../security/cves/CVE-2024-47077.mdx), reported by [@quentinmit](https://github.com/quentinmit) (cherry-pick #11535) (#11538)

## API Changes

#### What's New

***

##### `GET` /propertymappings/provider/google\_workspace/

##### `POST` /propertymappings/provider/google\_workspace/

##### `GET` /propertymappings/provider/google\_workspace/\{pm\_uuid}/

##### `PUT` /propertymappings/provider/google\_workspace/\{pm\_uuid}/

##### `DELETE` /propertymappings/provider/google\_workspace/\{pm\_uuid}/

##### `PATCH` /propertymappings/provider/google\_workspace/\{pm\_uuid}/

##### `GET` /propertymappings/provider/google\_workspace/\{pm\_uuid}/used\_by/

##### `GET` /propertymappings/provider/microsoft\_entra/

##### `POST` /propertymappings/provider/microsoft\_entra/

##### `GET` /propertymappings/provider/microsoft\_entra/\{pm\_uuid}/

##### `PUT` /propertymappings/provider/microsoft\_entra/\{pm\_uuid}/

##### `DELETE` /propertymappings/provider/microsoft\_entra/\{pm\_uuid}/

##### `PATCH` /propertymappings/provider/microsoft\_entra/\{pm\_uuid}/

##### `GET` /propertymappings/provider/microsoft\_entra/\{pm\_uuid}/used\_by/

##### `GET` /providers/google\_workspace/

##### `POST` /providers/google\_workspace/

##### `GET` /providers/google\_workspace/\{id}/

##### `PUT` /providers/google\_workspace/\{id}/

##### `DELETE` /providers/google\_workspace/\{id}/

##### `PATCH` /providers/google\_workspace/\{id}/

##### `GET` /providers/google\_workspace/\{id}/sync/status/

##### `GET` /providers/google\_workspace/\{id}/used\_by/

##### `GET` /providers/google\_workspace\_groups/

##### `POST` /providers/google\_workspace\_groups/

##### `GET` /providers/google\_workspace\_groups/\{id}/

##### `DELETE` /providers/google\_workspace\_groups/\{id}/

##### `GET` /providers/google\_workspace\_groups/\{id}/used\_by/

##### `GET` /providers/google\_workspace\_users/

##### `POST` /providers/google\_workspace\_users/

##### `GET` /providers/google\_workspace\_users/\{id}/

##### `DELETE` /providers/google\_workspace\_users/\{id}/

##### `GET` /providers/google\_workspace\_users/\{id}/used\_by/

##### `GET` /providers/microsoft\_entra/

##### `POST` /providers/microsoft\_entra/

##### `GET` /providers/microsoft\_entra/\{id}/

##### `PUT` /providers/microsoft\_entra/\{id}/

##### `DELETE` /providers/microsoft\_entra/\{id}/

##### `PATCH` /providers/microsoft\_entra/\{id}/

##### `GET` /providers/microsoft\_entra/\{id}/sync/status/

##### `GET` /providers/microsoft\_entra/\{id}/used\_by/

##### `GET` /providers/microsoft\_entra\_groups/

##### `POST` /providers/microsoft\_entra\_groups/

##### `GET` /providers/microsoft\_entra\_groups/\{id}/

##### `DELETE` /providers/microsoft\_entra\_groups/\{id}/

##### `GET` /providers/microsoft\_entra\_groups/\{id}/used\_by/

##### `GET` /providers/microsoft\_entra\_users/

##### `POST` /providers/microsoft\_entra\_users/

##### `GET` /providers/microsoft\_entra\_users/\{id}/

##### `DELETE` /providers/microsoft\_entra\_users/\{id}/

##### `GET` /providers/microsoft\_entra\_users/\{id}/used\_by/

##### `GET` /providers/scim/\{id}/sync/status/

##### `GET` /providers/scim\_groups/

##### `POST` /providers/scim\_groups/

##### `GET` /providers/scim\_groups/\{id}/

##### `DELETE` /providers/scim\_groups/\{id}/

##### `GET` /providers/scim\_groups/\{id}/used\_by/

##### `GET` /providers/scim\_users/

##### `POST` /providers/scim\_users/

##### `GET` /providers/scim\_users/\{id}/

##### `DELETE` /providers/scim\_users/\{id}/

##### `GET` /providers/scim\_users/\{id}/used\_by/

##### `GET` /sources/ldap/\{slug}/sync/status/

#### What's Deleted

***

##### `GET` /providers/scim/\{id}/sync\_status/

##### `GET` /sources/ldap/\{slug}/sync\_status/

#### What's Changed

***

##### `GET` /admin/system/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `runtime` (object)

    > Get versions

    New required properties:

    - `authentik_version`
    - `openssl_fips_mode`
    - `openssl_version`

    New optional properties:

    - `gunicorn_version`

    * Added property `openssl_version` (string)

    * Added property `openssl_fips_mode` (boolean)

    * Added property `authentik_version` (string)

    * Deleted property `gunicorn_version` (string)

##### `POST` /admin/system/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `runtime` (object)

    > Get versions

    New required properties:

    - `authentik_version`
    - `openssl_fips_mode`
    - `openssl_version`

    New optional properties:

    - `gunicorn_version`

    * Added property `openssl_version` (string)

    * Added property `openssl_fips_mode` (boolean)

    * Added property `authentik_version` (string)

    * Deleted property `gunicorn_version` (string)

##### `GET` /events/events/actions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /outposts/instances/\{uuid}/health/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Outpost health status

  New required properties:

  - `fips_enabled`
  - `golang_version`
  - `openssl_enabled`
  - `openssl_version`

  * Added property `golang_version` (string)

  * Added property `openssl_enabled` (boolean)

  * Added property `openssl_version` (string)

  * Added property `fips_enabled` (boolean)
    > Get FIPS enabled

##### `GET` /outposts/service\_connections/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /policies/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.providers.google_workspace`
    - `authentik.enterprise.providers.microsoft_entra`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_providers_google_workspace.googleworkspaceprovider`
    - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
    - `authentik_providers_microsoft_entra.microsoftentraprovider`
    - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.enterprise.providers.google_workspace`
  - `authentik.enterprise.providers.microsoft_entra`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.providers.google_workspace`
    - `authentik.enterprise.providers.microsoft_entra`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_providers_google_workspace.googleworkspaceprovider`
    - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
    - `authentik_providers_microsoft_entra.microsoftentraprovider`
    - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.enterprise.providers.google_workspace`
  - `authentik.enterprise.providers.microsoft_entra`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.providers.google_workspace`
    - `authentik.enterprise.providers.microsoft_entra`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_providers_google_workspace.googleworkspaceprovider`
    - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
    - `authentik_providers_microsoft_entra.microsoftentraprovider`
    - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `POST` /propertymappings/all/\{pm\_uuid}/test/

###### Request:

Changed content type : `application/json`

New optional properties:

- `user`

* Added property `group` (string)

##### `GET` /propertymappings/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /providers/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /sources/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /stages/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /stages/email/templates/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Types of an object that can be created

  - Added property `icon_url` (string)

##### `GET` /core/groups/\{group\_uuid}/

###### Parameters:

Added: `include_users` in `query`

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.enterprise.providers.google_workspace`
  - `authentik.enterprise.providers.microsoft_entra`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.providers.google_workspace`
    - `authentik.enterprise.providers.microsoft_entra`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_providers_google_workspace.googleworkspaceprovider`
    - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
    - `authentik_providers_microsoft_entra.microsoftentraprovider`
    - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum values:

      - `authentik.enterprise.providers.google_workspace`
      - `authentik.enterprise.providers.microsoft_entra`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum values:

      - `authentik_providers_google_workspace.googleworkspaceprovider`
      - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
      - `authentik_providers_microsoft_entra.microsoftentraprovider`
      - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `GET` /providers/all/

###### Parameters:

Added: `backchannel` in `query`

> When not set all providers are returned. When set to true, only backchannel providers are returned. When set to false, backchannel providers are excluded

Deleted: `backchannel_only` in `query`

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_google_workspace.googleworkspaceprovidermapping`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`

##### `GET` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PUT` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PATCH` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PUT` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PATCH` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/plex/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PUT` /sources/plex/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PATCH` /sources/plex/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PUT` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `PATCH` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /events/system\_tasks/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `expires` (string)

  - Added property `expiring` (boolean)

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

##### `POST` /sources/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAP Source Serializer

    - Changed property `icon` (string)

##### `POST` /sources/oauth/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `icon` (string)

##### `POST` /sources/plex/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Plex Source Serializer

    - Changed property `icon` (string)

##### `POST` /sources/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `icon` (string)

##### `GET` /sources/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLSource Serializer

    - Changed property `icon` (string)

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `score_min_threshold` (number)

  - Added property `score_max_threshold` (number)

  - Added property `error_on_invalid_score` (boolean)
    > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `score_min_threshold` (number)

- Added property `score_max_threshold` (number)

- Added property `error_on_invalid_score` (boolean)
  > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `score_min_threshold` (number)

  - Added property `score_max_threshold` (number)

  - Added property `error_on_invalid_score` (boolean)
    > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `score_min_threshold` (number)

- Added property `score_max_threshold` (number)

- Added property `error_on_invalid_score` (boolean)
  > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `score_min_threshold` (number)

  - Added property `score_max_threshold` (number)

  - Added property `error_on_invalid_score` (boolean)
    > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider_model` (string)

  Added enum values:

  - `authentik_providers_google_workspace.googleworkspaceprovider`
  - `authentik_providers_microsoft_entra.microsoftentraprovider`

- Changed property `provider` (object)

  Added 'authentik\_providers\_google\_workspace.googleworkspaceprovider' provider\_model:

  - Property `name` (string)

  - Property `property_mappings` (array)

    Items (string):

  - Property `property_mappings_group` (array)

    > Property mappings used for group creation/updating.

    Items (string):

  - Property `delegated_subject` (string)

  - Property `credentials` (object)

  - Property `scopes` (string)

  - Property `exclude_users_service_account` (boolean)

  - Property `filter_group` (string)

  - Property `user_delete_action` (string)

    Enum values:

    - `do_nothing`
    - `delete`
    - `suspend`

  - Property `group_delete_action` (string)

  - Property `default_group_email_domain` (string)

  Added 'authentik\_providers\_microsoft\_entra.microsoftentraprovider' provider\_model:

  - Property `name` (string)

  - Property `property_mappings` (array)

  - Property `property_mappings_group` (array)

    > Property mappings used for group creation/updating.

  - Property `client_id` (string)

  - Property `client_secret` (string)

  - Property `tenant_id` (string)

  - Property `exclude_users_service_account` (boolean)

  - Property `filter_group` (string)

  - Property `user_delete_action` (string)

  - Property `group_delete_action` (string)

##### `GET` /events/system\_tasks/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serialize TaskInfo and TaskResult

    - Added property `expires` (string)

    - Added property `expiring` (boolean)

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Added property `score_min_threshold` (number)

- Added property `score_max_threshold` (number)

- Added property `error_on_invalid_score` (boolean)
  > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `score_min_threshold` (number)

  - Added property `score_max_threshold` (number)

  - Added property `error_on_invalid_score` (boolean)
    > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Added property `score_min_threshold` (number)

    - Added property `score_max_threshold` (number)

    - Added property `error_on_invalid_score` (boolean)
      > When enabled and the received captcha score is outside of the given threshold, the stage will show an error message. When not enabled, the flow will continue, but the data from the captcha will be available in the context for policy decisions

---

## Release 2024.8

## Highlights

- **Source property mappings for SCIM, OAuth, SAML, and Plex sources**: All sources now support property mappings to configure how authentik interprets the incoming source's data. Additionally, groups can be synced from all sources that provide group info.
- **RADIUS provider custom attribute support**: Integrate RADIUS better into network infrastructure by sending vendor-specific attributes based on the user authenticating.
- **SAML encryption support**: SAML source and provider support encryption now, which prevents anyone from viewing the information of in-flight assertions.
- **RBAC support for blueprints and Terraform**: Permissions can now be assigned and automated using both blueprints and Terraform.

## Breaking changes

### Manual action is required

- **LDAP property mappings simplification**

    LDAP property mappings have been reworked to remove **Object field**. With this release, instead of returning a single user or group attribute for each property mapping, you can now return several of them. Here is an example of what new property mappings look like:

    ```python
    return {
        "username": ldap.get("uid"), # list_flatten is automatically applied to top-level attributes
        "attributes": {
            "phone": list_flatten(ldap.get("phoneNumber")), # but not for attributes!
        },
    }
    ```

    This property mapping populates the `username` and `attributes.phone` attributes of a user at the same time, reducing the number of mappings that are run and thus improving performance. Additionally, they are more straightforward to read, and this change allowed us to implement property mappings for OAuth and SAML sources as well.

    authentik will automatically convert existing property mappings to this new format, by generating some Python code for each of the existing property mappings expressions. Property mappings that are managed by authentik will automatically get updated to the new format.

    **If you have any custom property mappings, we recommend converting them to this new format.**

- **OAuth and SAML sources now sync groups by default**

    OAuth (specifically OpenID and Okta) sources now sync groups by default when a `groups` claim is available.

    SAML sources now sync groups by default when a `http://schemas.xmlsoap.org/claims/Group` attribute is available in the assertion.

    To disable that behavior, create an OAuth/SAML source property mapping with the expression below and assign it as a user property mapping on the source.

    ```python
    return {
        "groups": [],
    }
    ```

- **Terraform Resource rename**

    Several resources in the Terraform provider have been renamed to align with new functionality. This mainly applies to property mapping-related resources. With the authentik version 2024.8.1 of the Terraform provider, both the old and new resources are available, and resources can be moved to the new name using `terraform state mv`.

    These resources have been renamed:
    - `authentik_property_mapping_google_workspace`
    - `authentik_property_mapping_ldap`
    - `authentik_property_mapping_microsoft_entra`
    - `authentik_property_mapping_rac`
    - `authentik_property_mapping_radius`
    - `authentik_property_mapping_saml`
    - `authentik_property_mapping_scim`

### Manual action _may_ be required

- **Changes to the external user type**

    Since the introduction of user types with [2023.8](../2023/v2023.8.mdx), the main difference between internal and external users has mostly been relevant when using the [Enterprise](../../enterprise/index.mdx) version of authentik.

    With this release, authentik improves support for B2C use-cases, which external users are intended for. It is now possible to configure a default application. External users _not_ attempting to access a specific application will always be redirected to this default application.

    As part of this, external users will no longer have access to the User and Admin interfaces. If you're using the open-source version and you require this workflow, you can change users to be Internal, which will have no side-effects. For Enterprise customers, please reach out to us with any questions.

<!-- prettier-ignore -->
    <details><summary>Bulk changing the user type</summary>In the container, run the command `ak change_user_type --all --type internal` to change all users to Internal. Instead of using `--all` you can also pass usernames to the command to only change individual users to internal.</details>

- **Changed HTTP healthcheck endpoints status code**

    For increased compatibility, the `/-/health/live/` and `/-/health/ready/` endpoints return 200 HTTP Status codes for successful checks. Previously these endpoints returned 204, which means in most cases no changes are required.

## New features

- **Source property mappings for SCIM, OAuth, SAML and Plex sources**

    All source types now support property mappings to customize how authentik should interpret the data the source provides. In addition to that, it is also now possible to sync groups and group membership from sources that provide group information. See [Property Mappings](../../users-sources/sources/property-mappings/index.mdx).

- **RADIUS provider custom attribute support**

    With 2024.8 it is possible to define custom attributes for the RADIUS provider, for example vendor-specific attributes like Cisco's `AV-Pair` attribute. These attributes are defined in property mappings which means they can be dynamically defined based on the user authenticating. See [RADIUS Provider](../../add-secure-apps/providers/radius/index.mdx#radius-attributes)

- **SAML encryption support**

    It is now possible to configure SAML sources and providers to decrypt and validate encrypted assertions. This can be configured by creating a [Certificate-keypair](../../sys-mgmt/certificates.mdx) and selecting it in the SAML source or provider.

- **GeoIP Policy**

    With the new [GeoIP Policy](../../customize/policies/types/geoip.mdx) it is possible to grant/deny access based on Country and ASN, without having to write an expression policy.

- **Simplification of LDAP Provider permissions**

    The LDAP provider now uses RBAC to assign the appropriate permission to search the full directory instead of requiring a dedicated group to be created. As part of the upgrade, existing search groups' users are migrated to grant the required permission to search the full directory.

- **RBAC support for blueprints and Terraform**

    RBAC permissions for global/object level permissions for users/roles can now be managed via blueprints and Terraform. This allows for the automatic configuration of permissions.

- **UX improvements**

    In previous versions of authentik, there were several places in the Admin interface where you could not select more than 100 items. With this change, it is now possible to search for items and select more than 100 items.

- **WebFinger support**

    With the addition of the [default application](../../customize/branding/index.mdx#external-user-settings) setting, when the default application uses an OIDC provider, a WebFinger endpoint is available now.

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2024.8/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.8
```

## Minor changes/fixes

- api: use custom json renderer for speed (#9977)
- blueprints: handle model referencing non-existent app/model (#10796)
- brands: add OIDC webfinger support (#10400)
- core: add index on enabled field of sources (#10572)
- core: add primitives for source property mappings (#10651)
- core: b2c improvements p1 (#9257)
- core: fix error when raising SkipObject in mapping (#10153)
- core: fix migrations missing using db_alias (#10409)
- core: fix source flow_manager not resuming flow when linking (#10436)
- core: fix URLValidator regex to allow single digit port (#10280)
- core: remove deprecated sentry-sdk method usage (#10648)
- core: remove html language tag for pages that are translated (#10611)
- core: remove transitionary old JS urls (#10317)
- core: rework base for SkipObject exception to better support control flow exceptions (#10186)
- enterprise: add support for license flags (#10842)
- enterprise: UI improvements, better handling of expiry (#10828)
- enterprise/rac: fix error when listing connection tokens as non-superuser (#10771)
- events: associate login_failed events to a user if possible (#10270)
- events: fix race condition (#10602)
- flows: remove stage challenge type (#10476)
- internal: Use loop instead of recursion in NewAPIController (#10745)
- lib/sync: handle SkipObject in direct triggered tasks (#10590)
- lifecycle: only create tenant media root if needed (#10616)
- outposts: add better UI for showing mismatched versions (#10885)
- outposts: ensure minimum refresh interval (#10701)
- outposts: implement general paginator for list API requests (#10619)
- outposts: make refresh interval configurable (#10138)
- policies: add GeoIP policy (#10454)
- policies/reputation: fix existing reputation update (#10124)
- providers: add provider/ prefix for property mappings API (#10874)
- providers/ldap: fix missing using in migrations (#10906)
- providers/ldap: Remove search group (#10639)
- providers/proxy: avoid erroring on logout with session_id is None (#9119)
- providers/proxy: fix Traefik label generation for v3 (#10411)
- providers/radius: Add support for custom attributes (#10509)
- providers/radius: fix custom attribute (#10704)
- providers/radius: property mapping docs (#10908)
- providers/saml: encryption support (#10934)
- providers/saml: fix incorrect migration for sign_response (#10975)
- providers/saml: fix metadata import error handling (#10349)
- providers/saml: remove redundant ACSUrl in POST (#10707)
- providers/scim: Fix exception handling for missing ServiceProviderConfig (#10322)
- rbac: generate blueprint schema permissions from defined models not DB (#10962)
- rbac: rework API for terraform, add blueprint support (#10698)
- root: allow extra sentry settings (#10269)
- root: dependency maintenance (#10689)
- root: Make health checks compatible with cloud platform load balancers (#10554)
- root: make pyrad a standard dependency (#10649)
- root: makefile: add codespell to make-website (#10116)
- root: only load daphne django app in development (#10723)
- root: use custom model serializer that saves m2m without bulk (#10139)
- sources: add property mappings for all oauth and saml sources (#8771)
- sources: introduce new property mappings per user and group (#8750)
- sources: refactor user connection api (#10607)
- sources/ldap: Add enabled filter for ldap_password_validate signal (#10823)
- sources/ldap: fix migrations failing (#10588)
- sources/ldap: rename ldappropertymapping to ldapsourcepropertymapping (#10606)
- sources/oauth: fix link not being saved (#10374)
- sources/plex: add property mappings (#10772)
- sources/saml: Basic support for EncryptedAssertion element. (#10099)
- sources/saml: fix pickle error, add saml auth tests (#10348)
- sources/scim: add property mappings (#10650)
- sources/scim: fix duplicate service account users and changing token (#10735)
- sources/scim: fix schema loading with pwd is not set properly (#10574)
- stages/authenticator_validate: fix friendly_name being required (#10382)
- stages/authenticator: actually update last_used (#10813)
- stages/authenticator: add created, last_updated and last_used metadata (#10636)
- stages/prompt: fix prompt not editable with invalid expression (#10603)
- stages/user_login: fix ?next parameter not carried through broken session binding (#10301)
- web: disable reading dark mode out of the UI by default (#10256)
- web: enable custom-element-manifest and DOM/JS integration checking. (#10177)
- web: enhance search select with portal, overflow, and keyboard controls (#9517)
- web: fix bad name target that's breaking build (#10506)
- web: fix dark theme and theme switch (#10667)
- web: fix docker build for non-release versions (#10154)
- web: fix early modal stack depletion (#10068)
- web: fix mismatched button labels for boundpolicy and boundstage list (#10551)
- web: fix needed because recent upgrade to task breaks spinner button (#10142)
- web: fix theme not applying to document correctly (#10721)
- web: fixed missed internationalized strings (#10323)
- web: licenseStatus is not defined on initial render (#10894)
- web: provide 'show password' button (#10337)
- web: provide a test framework (#9681)
- web: provide better feedback on Application Library page about search results (#9386)
- web: provide default endpoint api configuration (#10319)
- web: replace all occurrences of the theme placeholder (#10749)
- web: replace multi-select with dual-select for all propertyMapping invocations (#9359)
- web: restore hasLaunchUrl to client-side criteria for filtering apps (#10291)
- web: search select with focus, autocomplete, and progressive search (#10728)
- web: set noopener and noreferrer on all external links (#10304)
- web/admin: fix access token list calling wrong API (#10434)
- web/admin: fix authentication/enrollment flow in sources being marked as required (#10911)
- web/admin: fix missing SAML Provider ECDSA options (#10612)
- web/admin: fix selectable card color in dark theme (#10794)
- web/admin: refactor property mappings forms (#10810)
- web/admin: show matching user reputation scores in user details (#10276)
- web/admin: widen prompt form (#10615)
- web/elements: fix empty enterprise banner (#10882)
- web/flows: clean up loading, syntax and transitions (#10792)
- web/flows: don't grab focus for password input on identification stage (#10593)
- web/flows: remove background image link (#10318)
- web/flows: remove continue button from AutoSubmit stage (#10253)
- web/flows: Simplified flow executor (#10296)

## Fixed in 2024.8.1

- core: bump cryptography from 43.0.0 to 43.0.1 (cherry-pick #11185) (#11202)
- core: fix change_user_type always requiring usernames (cherry-pick #11177) (#11178)
- core: fix missing argument name escaping for property mapping (cherry-pick #11231) (#11252)
- internal: fix go paginator not setting page correctly (cherry-pick #11253) (#11255)
- providers/ldap: fix incorrect permission check for search access (cherry-pick #11217) (#11218)
- providers/ldap: fix migration assuming search group is set (cherry-pick #11170) (#11172)
- providers/ldap: rework search_group migration to work with read replicas (cherry-pick #11228) (#11229)
- root: backport s3 storage changes (cherry-pick #11181) (#11183)
- web/admin: fix error in Outpost creation form (cherry-pick #11173) (#11175)
- web/admin: fix misc dual select on different forms (#11203)
- web/admin: fix missing Sync object button SCIM Provider (cherry-pick #11211) (#11213)
- web/admin: improve error handling (cherry-pick #11212) (#11219)
- web/users: show - if device was registered before we started saving the time (cherry-pick #11256) (#11257)

## Fixed in 2024.8.2

- core: ensure all providers have correct priority (cherry-pick #11280) (#11281)
- core: ensure proxy provider is correctly looked up (cherry-pick #11267) (#11269)
- core: fix permission check for scoped impersonation (cherry-pick #11315) (#11316)
- enterprise: fix API mixin license validity check (cherry-pick #11331) (#11342)
- enterprise: show specific error if Install ID is invalid in license (cherry-pick #11317) (#11319)
- events: optimize marking events as seen (cherry-pick #11297) (#11299)
- providers/proxy: fix URL path getting lost when partial URL is given to rd= (cherry-pick #11354) (#11355)
- root: fix ensure `outpost_connection_discovery` runs on worker startup (cherry-pick #11260) (#11270)
- sources/ldap: fix missing search attribute (cherry-pick #11125) (#11340)
- web: revert lockfile lint, re-add integrity (#11380)
- web/admin: fix notification property mapping forms (cherry-pick #11298) (#11300)

## Fixed in 2024.8.3

- events: always use expiry from current tenant for events, not only when creating from HTTP request (cherry-pick #11415) (#11416)
- providers/proxy: fix traefik label generation (cherry-pick #11460) (#11480)
- security: [CVE-2024-47070](../../security/cves/CVE-2024-47070.mdx), reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/) (cherry-pick #11536) (#11539)
- security: [CVE-2024-47077](../../security/cves/CVE-2024-47077.mdx), reported by [@quentinmit](https://github.com/quentinmit) (cherry-pick #11535) (#11537)
- sources/ldap: fix mapping check, fix debug endpoint (cherry-pick #11442) (#11498)
- sources/ldap: fix ms_ad userAccountControl not checking for lockout (cherry-pick #11532) (#11534)
- web: Fix missing integrity fields in package-lock.json (#11509)
- web/admin: fix Authentication flow being required (cherry-pick #11496) (#11497)

## Fixed in 2024.8.4

- blueprints: fix validation error when using internal storage (cherry-pick #11654) (#11656)
- core: fix permission check for scoped impersonation (cherry-pick #11603) (#11650)
- internal: restore /ping behavior for embedded outpost (cherry-pick #11568) (#11570)
- policies/event_matcher: fix inconsistent behavior (cherry-pick #11724) (#11726)
- providers/oauth2: don't overwrite attributes when updating service account (cherry-pick #11709) (#11723)
- providers/saml: fix incorrect ds:Reference URI (cherry-pick #11699) (#11701)
- providers/scim: add comparison with existing group on update and delta update users (cherry-pick #11414) (#11796)
- providers/scim: clamp batch size for patch requests (cherry-pick #11797) (#11802)
- providers/scim: handle no members in group in consistency check (cherry-pick #11801) (#11812)
- web/admin: fix invalid create date shown for MFA registered before date was saved (cherry-pick #11728) (#11729)
- web/admin: fix sync single button throwing error (cherry-pick #11727) (#11730)

## Fixed in 2024.8.5

- security: fix [CVE-2024-52287](../../security/cves/CVE-2024-52287.mdx), reported by [@matt1097](https://github.com/matt1097) (#12114)
- security: fix [CVE-2024-52289](../../security/cves/CVE-2024-52289.mdx), reported by [@PontusHanssen](https://github.com/PontusHanssen) (#12113)
- security: fix [CVE-2024-52307](../../security/cves/CVE-2024-52307.mdx), reported by [@mgerstner](https://github.com/mgerstner) (#12115)
- web/admin: better footer links (#12004)
- web: bump API Client version (#12118)

## Fixed in 2024.8.6

- providers/oauth2: fix migration (cherry-pick #12138) (#12140)
- providers/oauth2: fix redirect uri input (cherry-pick #12122) (#12128)
- providers/proxy: fix redirect_uri (cherry-pick #12121) (#12126)
- web: bump API Client version (cherry-pick #12129) (#12131)

## API Changes

#### What's New

---

##### `GET` /outposts/ldap/&#123;id&#125;/check_access/

##### `GET` /outposts/radius/&#123;id&#125;/check_access/

##### `GET` /policies/geoip/

##### `POST` /policies/geoip/

##### `GET` /policies/geoip/&#123;policy_uuid&#125;/

##### `PUT` /policies/geoip/&#123;policy_uuid&#125;/

##### `DELETE` /policies/geoip/&#123;policy_uuid&#125;/

##### `PATCH` /policies/geoip/&#123;policy_uuid&#125;/

##### `GET` /policies/geoip/&#123;policy_uuid&#125;/used_by/

##### `GET` /policies/geoip_iso3166/

##### `GET` /propertymappings/provider/rac/

##### `POST` /propertymappings/provider/rac/

##### `GET` /propertymappings/provider/rac/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/provider/rac/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/provider/rac/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/provider/rac/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/provider/rac/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/provider/radius/

##### `POST` /propertymappings/provider/radius/

##### `GET` /propertymappings/provider/radius/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/provider/radius/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/provider/radius/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/provider/radius/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/provider/radius/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/provider/saml/

##### `POST` /propertymappings/provider/saml/

##### `GET` /propertymappings/provider/saml/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/provider/saml/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/provider/saml/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/provider/saml/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/provider/saml/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/provider/scim/

##### `POST` /propertymappings/provider/scim/

##### `GET` /propertymappings/provider/scim/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/provider/scim/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/provider/scim/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/provider/scim/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/provider/scim/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/provider/scope/

##### `POST` /propertymappings/provider/scope/

##### `GET` /propertymappings/provider/scope/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/provider/scope/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/provider/scope/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/provider/scope/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/provider/scope/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/source/ldap/

##### `POST` /propertymappings/source/ldap/

##### `GET` /propertymappings/source/ldap/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/source/ldap/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/source/ldap/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/source/ldap/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/source/ldap/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/source/oauth/

##### `POST` /propertymappings/source/oauth/

##### `GET` /propertymappings/source/oauth/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/source/oauth/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/source/oauth/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/source/oauth/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/source/oauth/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/source/plex/

##### `POST` /propertymappings/source/plex/

##### `GET` /propertymappings/source/plex/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/source/plex/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/source/plex/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/source/plex/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/source/plex/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/source/saml/

##### `POST` /propertymappings/source/saml/

##### `GET` /propertymappings/source/saml/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/source/saml/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/source/saml/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/source/saml/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/source/saml/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/source/scim/

##### `POST` /propertymappings/source/scim/

##### `GET` /propertymappings/source/scim/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/source/scim/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/source/scim/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/source/scim/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/source/scim/&#123;pm_uuid&#125;/used_by/

##### `GET` /rbac/permissions/roles/&#123;id&#125;/

##### `PUT` /rbac/permissions/roles/&#123;id&#125;/

##### `DELETE` /rbac/permissions/roles/&#123;id&#125;/

##### `PATCH` /rbac/permissions/roles/&#123;id&#125;/

##### `GET` /rbac/permissions/users/&#123;id&#125;/

##### `PUT` /rbac/permissions/users/&#123;id&#125;/

##### `DELETE` /rbac/permissions/users/&#123;id&#125;/

##### `PATCH` /rbac/permissions/users/&#123;id&#125;/

##### `GET` /sources/group_connections/oauth/

##### `POST` /sources/group_connections/oauth/

##### `GET` /sources/group_connections/oauth/&#123;id&#125;/

##### `PUT` /sources/group_connections/oauth/&#123;id&#125;/

##### `DELETE` /sources/group_connections/oauth/&#123;id&#125;/

##### `PATCH` /sources/group_connections/oauth/&#123;id&#125;/

##### `GET` /sources/group_connections/oauth/&#123;id&#125;/used_by/

##### `GET` /sources/group_connections/plex/

##### `POST` /sources/group_connections/plex/

##### `GET` /sources/group_connections/plex/&#123;id&#125;/

##### `PUT` /sources/group_connections/plex/&#123;id&#125;/

##### `DELETE` /sources/group_connections/plex/&#123;id&#125;/

##### `PATCH` /sources/group_connections/plex/&#123;id&#125;/

##### `GET` /sources/group_connections/plex/&#123;id&#125;/used_by/

##### `GET` /sources/group_connections/saml/

##### `GET` /sources/group_connections/saml/&#123;id&#125;/

##### `PUT` /sources/group_connections/saml/&#123;id&#125;/

##### `DELETE` /sources/group_connections/saml/&#123;id&#125;/

##### `PATCH` /sources/group_connections/saml/&#123;id&#125;/

##### `GET` /sources/group_connections/saml/&#123;id&#125;/used_by/

#### What's Deleted

---

##### `GET` /outposts/ldap/&#123;id&#125;/

##### `GET` /outposts/proxy/&#123;id&#125;/

##### `GET` /outposts/radius/&#123;id&#125;/

##### `GET` /propertymappings/ldap/

##### `POST` /propertymappings/ldap/

##### `GET` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/ldap/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/ldap/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/rac/

##### `POST` /propertymappings/rac/

##### `GET` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/rac/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/rac/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/saml/

##### `POST` /propertymappings/saml/

##### `GET` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/saml/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/saml/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/scim/

##### `POST` /propertymappings/scim/

##### `GET` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/scim/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/scim/&#123;pm_uuid&#125;/used_by/

##### `GET` /propertymappings/scope/

##### `POST` /propertymappings/scope/

##### `GET` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `PUT` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `DELETE` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `PATCH` /propertymappings/scope/&#123;pm_uuid&#125;/

##### `GET` /propertymappings/scope/&#123;pm_uuid&#125;/used_by/

#### What's Changed

---

##### `GET` /admin/version/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `outpost_outdated`
    * Added property `outpost_outdated` (boolean)
        > Check if any outpost is outdated/has a version mismatch

##### `GET` /authenticators/admin/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Serializer for Duo authenticator devices

    New required properties:
    - `created`
    - `last_updated`
    - `last_used`
    * Added property `created` (string)

    * Added property `last_updated` (string)

    * Added property `last_used` (string)

##### `GET` /authenticators/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Serializer for Duo authenticator devices

    New required properties:
    - `created`
    - `last_updated`
    - `last_used`
    * Added property `created` (string)

    * Added property `last_updated` (string)

    * Added property `last_used` (string)

##### `GET` /core/brands/&#123;brand_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `default_application` (string)
        > When set, external users will be redirected to this application after authenticating.

##### `PUT` /core/brands/&#123;brand_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `default_application` (string)
    > When set, external users will be redirected to this application after authenticating.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `default_application` (string)
        > When set, external users will be redirected to this application after authenticating.

##### `PATCH` /core/brands/&#123;brand_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `default_application` (string)
    > When set, external users will be redirected to this application after authenticating.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `default_application` (string)
        > When set, external users will be redirected to this application after authenticating.

##### `GET` /enterprise/license/summary/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `license_flags`
    - `status`

    New optional properties:
    - `has_license`
    - `read_only`
    - `show_admin_warning`
    - `show_user_warning`
    - `valid`
    * Added property `status` (string)

        Enum values:
        - `unlicensed`
        - `valid`
        - `expired`
        - `expiry_soon`
        - `limit_exceeded_admin`
        - `limit_exceeded_user`
        - `read_only`

    * Added property `license_flags` (array)

        Items (string):

        Enum values:
        - `trial`
        - `non_production`

    * Deleted property `valid` (boolean)

    * Deleted property `show_admin_warning` (boolean)

    * Deleted property `show_user_warning` (boolean)

    * Deleted property `read_only` (boolean)

    * Deleted property `has_license` (boolean)

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.policies.geoip`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_policies_geoip.geoippolicy`
        - `authentik_providers_radius.radiusproviderpropertymapping`
        - `authentik_sources_ldap.ldapsourcepropertymapping`
        - `authentik_sources_oauth.oauthsourcepropertymapping`
        - `authentik_sources_oauth.groupoauthsourceconnection`
        - `authentik_sources_plex.plexsourcepropertymapping`
        - `authentik_sources_plex.userplexsourceconnection`
        - `authentik_sources_plex.groupplexsourceconnection`
        - `authentik_sources_saml.samlsourcepropertymapping`
        - `authentik_sources_saml.groupsamlsourceconnection`
        - `authentik_sources_scim.scimsourcepropertymapping`
          Removed enum values:

        - `authentik_sources_ldap.ldappropertymapping`
        - `authentik_sources_plex.plexsourceconnection`

##### `PUT` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:
    - `authentik.policies.geoip`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.policies.geoip`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_policies_geoip.geoippolicy`
        - `authentik_providers_radius.radiusproviderpropertymapping`
        - `authentik_sources_ldap.ldapsourcepropertymapping`
        - `authentik_sources_oauth.oauthsourcepropertymapping`
        - `authentik_sources_oauth.groupoauthsourceconnection`
        - `authentik_sources_plex.plexsourcepropertymapping`
        - `authentik_sources_plex.userplexsourceconnection`
        - `authentik_sources_plex.groupplexsourceconnection`
        - `authentik_sources_saml.samlsourcepropertymapping`
        - `authentik_sources_saml.groupsamlsourceconnection`
        - `authentik_sources_scim.scimsourcepropertymapping`
          Removed enum values:

        - `authentik_sources_ldap.ldappropertymapping`
        - `authentik_sources_plex.plexsourceconnection`

##### `PATCH` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:
    - `authentik.policies.geoip`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.policies.geoip`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_policies_geoip.geoippolicy`
        - `authentik_providers_radius.radiusproviderpropertymapping`
        - `authentik_sources_ldap.ldapsourcepropertymapping`
        - `authentik_sources_oauth.oauthsourcepropertymapping`
        - `authentik_sources_oauth.groupoauthsourceconnection`
        - `authentik_sources_plex.plexsourcepropertymapping`
        - `authentik_sources_plex.userplexsourceconnection`
        - `authentik_sources_plex.groupplexsourceconnection`
        - `authentik_sources_saml.samlsourcepropertymapping`
        - `authentik_sources_saml.groupsamlsourceconnection`
        - `authentik_sources_scim.scimsourcepropertymapping`
          Removed enum values:

        - `authentik_sources_ldap.ldappropertymapping`
        - `authentik_sources_plex.plexsourceconnection`

##### `GET` /providers/google_workspace_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /providers/microsoft_entra_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /providers/scim_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /sources/scim_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `PUT` /sources/scim_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `PATCH` /sources/scim_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `POST` /core/brands/

###### Request:

Changed content type : `application/json`

- Added property `default_application` (string)
    > When set, external users will be redirected to this application after authenticating.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `default_application` (string)
        > When set, external users will be redirected to this application after authenticating.

##### `GET` /core/brands/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Brand Serializer
        - Added property `default_application` (string)
            > When set, external users will be redirected to this application after authenticating.

##### `GET` /core/groups/&#123;group_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `PUT` /core/groups/&#123;group_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `PATCH` /core/groups/&#123;group_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `GET` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `PUT` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `PATCH` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `PUT` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `PATCH` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

##### `PUT` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

##### `PATCH` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

##### `GET` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `PUT` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `PATCH` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:
    - `authentik.policies.geoip`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.policies.geoip`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_policies_geoip.geoippolicy`
        - `authentik_providers_radius.radiusproviderpropertymapping`
        - `authentik_sources_ldap.ldapsourcepropertymapping`
        - `authentik_sources_oauth.oauthsourcepropertymapping`
        - `authentik_sources_oauth.groupoauthsourceconnection`
        - `authentik_sources_plex.plexsourcepropertymapping`
        - `authentik_sources_plex.userplexsourceconnection`
        - `authentik_sources_plex.groupplexsourceconnection`
        - `authentik_sources_saml.samlsourcepropertymapping`
        - `authentik_sources_saml.groupsamlsourceconnection`
        - `authentik_sources_scim.scimsourcepropertymapping`
          Removed enum values:

        - `authentik_sources_ldap.ldappropertymapping`
        - `authentik_sources_plex.plexsourceconnection`

##### `GET` /policies/event_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Changed property `app` (string)

            > Match events created by selected application. When left empty, all applications are matched.

            Added enum value:
            - `authentik.policies.geoip`

        - Changed property `model` (string)

            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

            Added enum values:
            - `authentik_policies_geoip.geoippolicy`
            - `authentik_providers_radius.radiusproviderpropertymapping`
            - `authentik_sources_ldap.ldapsourcepropertymapping`
            - `authentik_sources_oauth.oauthsourcepropertymapping`
            - `authentik_sources_oauth.groupoauthsourceconnection`
            - `authentik_sources_plex.plexsourcepropertymapping`
            - `authentik_sources_plex.userplexsourceconnection`
            - `authentik_sources_plex.groupplexsourceconnection`
            - `authentik_sources_saml.samlsourcepropertymapping`
            - `authentik_sources_saml.groupsamlsourceconnection`
            - `authentik_sources_scim.scimsourcepropertymapping`
              Removed enum values:

            - `authentik_sources_ldap.ldappropertymapping`
            - `authentik_sources_plex.plexsourceconnection`

##### `GET` /propertymappings/all/

###### Parameters:

Added: `managed` in `query`

Added: `name` in `query`

##### `POST` /providers/google_workspace_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /providers/google_workspace_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > GoogleWorkspaceProviderGroup Serializer
        - Changed property `group_obj` (object)

            > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /providers/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Deleted property `search_group` (string)
        > Users in this group can do search queries. If not set, every user can execute search queries.

##### `PUT` /providers/ldap/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `search_group` (string)
    > Users in this group can do search queries. If not set, every user can execute search queries.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Deleted property `search_group` (string)
        > Users in this group can do search queries. If not set, every user can execute search queries.

##### `PATCH` /providers/ldap/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `search_group` (string)
    > Users in this group can do search queries. If not set, every user can execute search queries.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Deleted property `search_group` (string)
        > Users in this group can do search queries. If not set, every user can execute search queries.

##### `POST` /providers/microsoft_entra_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /providers/microsoft_entra_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > MicrosoftEntraProviderGroup Serializer
        - Changed property `group_obj` (object)

            > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /providers/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `encryption_kp` (string)

        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

    - Added property `sign_assertion` (boolean)

    - Added property `sign_response` (boolean)

##### `PUT` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `encryption_kp` (string)

    > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

- Added property `sign_assertion` (boolean)

- Added property `sign_response` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `encryption_kp` (string)

        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

    - Added property `sign_assertion` (boolean)

    - Added property `sign_response` (boolean)

##### `PATCH` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `encryption_kp` (string)

    > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

- Added property `sign_assertion` (boolean)

- Added property `sign_response` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `encryption_kp` (string)

        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

    - Added property `sign_assertion` (boolean)

    - Added property `sign_response` (boolean)

##### `POST` /providers/scim_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /providers/scim_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProviderGroup Serializer
        - Changed property `group_obj` (object)

            > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `POST` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

###### Return Type:

New response : **200 OK**
Deleted response : **204 No Content**

> Successfully assigned

##### `PATCH` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

##### `POST` /rbac/permissions/assigned_by_users/&#123;id&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

###### Return Type:

New response : **200 OK**
Deleted response : **204 No Content**

> Successfully assigned

##### `PATCH` /rbac/permissions/assigned_by_users/&#123;id&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_policies_geoip.geoippolicy`
    - `authentik_providers_radius.radiusproviderpropertymapping`
    - `authentik_sources_ldap.ldapsourcepropertymapping`
    - `authentik_sources_oauth.oauthsourcepropertymapping`
    - `authentik_sources_oauth.groupoauthsourceconnection`
    - `authentik_sources_plex.plexsourcepropertymapping`
    - `authentik_sources_plex.userplexsourceconnection`
    - `authentik_sources_plex.groupplexsourceconnection`
    - `authentik_sources_saml.samlsourcepropertymapping`
    - `authentik_sources_saml.groupsamlsourceconnection`
    - `authentik_sources_scim.scimsourcepropertymapping`
      Removed enum values:

    - `authentik_sources_ldap.ldappropertymapping`
    - `authentik_sources_plex.plexsourceconnection`

##### `GET` /rbac/permissions/roles/

###### Parameters:

Changed: `uuid` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User permission with additional object-related data
        - Changed property `object_pk` (string)

##### `GET` /rbac/permissions/users/

###### Parameters:

Changed: `user_id` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User permission with additional object-related data
        - Changed property `object_pk` (string)

##### `GET` /sources/all/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

        Items (string):

    - Added property `group_property_mappings` (array)

##### `GET` /sources/ldap/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `property_mappings` (array)

    - Deleted property `property_mappings_group` (array)
        > Property mappings used for group creation/updating.

##### `PUT` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Deleted property `property_mappings` (array)

- Deleted property `property_mappings_group` (array)
    > Property mappings used for group creation/updating.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `property_mappings` (array)

    - Deleted property `property_mappings_group` (array)
        > Property mappings used for group creation/updating.

##### `PATCH` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Deleted property `property_mappings` (array)

- Deleted property `property_mappings_group` (array)
    > Property mappings used for group creation/updating.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `property_mappings` (array)

    - Deleted property `property_mappings_group` (array)
        > Property mappings used for group creation/updating.

##### `GET` /sources/oauth/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)

        > How the source determines if an existing group should be used or a new group created.

        Enum values:
        - `identifier`
        - `name_link`
        - `name_deny`

##### `PUT` /sources/oauth/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)
    > How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `PATCH` /sources/oauth/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)
    > How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `GET` /sources/plex/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `PUT` /sources/plex/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)
    > How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `PATCH` /sources/plex/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)
    > How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `GET` /sources/saml/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)

        > How the source determines if an existing group should be used or a new group created.

    - Added property `encryption_kp` (string)
        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

##### `PUT` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)

    > How the source determines if an existing group should be used or a new group created.

- Added property `encryption_kp` (string)
    > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)

        > How the source determines if an existing group should be used or a new group created.

    - Added property `encryption_kp` (string)
        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

##### `PATCH` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)

    > How the source determines if an existing group should be used or a new group created.

- Added property `encryption_kp` (string)
    > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)

        > How the source determines if an existing group should be used or a new group created.

    - Added property `encryption_kp` (string)
        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

##### `GET` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `user_matching_mode` (object)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `PUT` /sources/scim/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Deleted property `user_matching_mode` (object)
    > How the source determines if an existing user should be authenticated or a new user enrolled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `user_matching_mode` (object)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `PATCH` /sources/scim/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Deleted property `user_matching_mode` (object)
    > How the source determines if an existing user should be authenticated or a new user enrolled.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `user_matching_mode` (object)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `POST` /sources/scim_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /sources/scim_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMSourceGroup Serializer
        - Changed property `group_obj` (object)

            > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PUT` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PATCH` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /sources/user_connections/oauth/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PUT` /sources/user_connections/oauth/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

New optional properties:

- `user`

* Deleted property `user` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PATCH` /sources/user_connections/oauth/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `user` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /sources/user_connections/plex/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`

    New optional properties:
    - `plex_token`
    * Added property `created` (string)

    * Deleted property `plex_token` (string)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PUT` /sources/user_connections/plex/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `plex_token` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`

    New optional properties:
    - `plex_token`
    * Added property `created` (string)

    * Deleted property `plex_token` (string)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PATCH` /sources/user_connections/plex/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `plex_token` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`

    New optional properties:
    - `plex_token`
    * Added property `created` (string)

    * Deleted property `plex_token` (string)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /sources/user_connections/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PUT` /sources/user_connections/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

New optional properties:

- `user`

* Deleted property `user` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `PATCH` /sources/user_connections/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `user` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /core/applications/

###### Parameters:

Added: `only_with_launch_url` in `query`

##### `POST` /core/groups/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `GET` /core/groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Serializer
        - Changed property `name` (string)

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `GET` /core/user_consent/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `groups_obj` (array)

        Changed items (object): > Simplified Group Serializer for user's groups
        - Changed property `name` (string)

##### `GET` /core/users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `POST` /events/rules/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

##### `GET` /events/rules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationRule Serializer
        - Changed property `group_obj` (object)

            > Group Serializer
            - Changed property `name` (string)

##### `GET` /oauth2/access_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /oauth2/authorization_codes/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAPProvider Serializer
        - Deleted property `search_group` (string)
            > Users in this group can do search queries. If not set, every user can execute search queries.

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Group Serializer
        - Changed property `name` (string)

    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `groups_obj` (array)

            Changed items (object): > Simplified Group Serializer for user's groups
            - Changed property `name` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PolicyBinding Serializer
        - Changed property `group_obj` (object)

            > Group Serializer
            - Changed property `name` (string)

        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `POST` /providers/ldap/

###### Request:

Changed content type : `application/json`

- Deleted property `search_group` (string)
    > Users in this group can do search queries. If not set, every user can execute search queries.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Deleted property `search_group` (string)
        > Users in this group can do search queries. If not set, every user can execute search queries.

##### `GET` /providers/ldap/

###### Parameters:

Deleted: `search_group__group_uuid__iexact` in `query`

Deleted: `search_group__name__iexact` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAPProvider Serializer
        - Deleted property `search_group` (string)
            > Users in this group can do search queries. If not set, every user can execute search queries.

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Added property `encryption_kp` (string)

    > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

- Added property `sign_assertion` (boolean)

- Added property `sign_response` (boolean)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `encryption_kp` (string)

        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

    - Added property `sign_assertion` (boolean)

    - Added property `sign_response` (boolean)

##### `GET` /providers/saml/

###### Parameters:

Added: `encryption_kp` in `query`

Added: `sign_assertion` in `query`

Added: `sign_response` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLProvider Serializer
        - Added property `encryption_kp` (string)

            > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

        - Added property `sign_assertion` (boolean)

        - Added property `sign_response` (boolean)

##### `GET` /rbac/permissions/assigned_by_roles/

###### Parameters:

Changed: `model` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Roles assigned object permission serializer
        - Changed property `permissions` (array)

            Changed items (object): > Role-bound object level permission
            - Changed property `object_pk` (string)

##### `GET` /rbac/permissions/assigned_by_users/

###### Parameters:

Changed: `model` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Users assigned object permission serializer
        - Changed property `permissions` (array)

            Changed items (object): > User-bound object level permission
            - Changed property `object_pk` (string)

##### `GET` /sources/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Deleted property `property_mappings` (array)

- Deleted property `property_mappings_group` (array)
    > Property mappings used for group creation/updating.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `property_mappings` (array)

    - Deleted property `property_mappings_group` (array)
        > Property mappings used for group creation/updating.

##### `GET` /sources/ldap/

###### Parameters:

Added: `group_property_mappings` in `query`

Added: `user_property_mappings` in `query`

Deleted: `property_mappings` in `query`

Deleted: `property_mappings_group` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAP Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

        - Deleted property `property_mappings` (array)

        - Deleted property `property_mappings_group` (array)
            > Property mappings used for group creation/updating.

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)
    > How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `GET` /sources/oauth/

###### Parameters:

Added: `group_matching_mode` in `query`

> How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

        - Added property `group_matching_mode` (object)
            > How the source determines if an existing group should be used or a new group created.

##### `POST` /sources/plex/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)
    > How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)
        > How the source determines if an existing group should be used or a new group created.

##### `GET` /sources/plex/

###### Parameters:

Added: `group_matching_mode` in `query`

> How the source determines if an existing group should be used or a new group created.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Plex Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

        - Added property `group_matching_mode` (object)
            > How the source determines if an existing group should be used or a new group created.

##### `POST` /sources/plex/redeem_token/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `type`
    * Deleted property `type` (object)

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Added property `group_matching_mode` (object)

    > How the source determines if an existing group should be used or a new group created.

- Added property `encryption_kp` (string)
    > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Added property `group_matching_mode` (object)

        > How the source determines if an existing group should be used or a new group created.

    - Added property `encryption_kp` (string)
        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

##### `GET` /sources/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLSource Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

        - Added property `group_matching_mode` (object)

            > How the source determines if an existing group should be used or a new group created.

        - Added property `encryption_kp` (string)
            > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

##### `POST` /sources/scim/

###### Request:

Changed content type : `application/json`

- Added property `user_property_mappings` (array)

- Added property `group_property_mappings` (array)

- Deleted property `user_matching_mode` (object)
    > How the source determines if an existing user should be authenticated or a new user enrolled.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `user_property_mappings` (array)

    - Added property `group_property_mappings` (array)

    - Deleted property `user_matching_mode` (object)

        > How the source determines if an existing user should be authenticated or a new user enrolled.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `GET` /sources/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMSource Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

        - Deleted property `user_matching_mode` (object)

            > How the source determines if an existing user should be authenticated or a new user enrolled.

        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer
                - Changed property `groups_obj` (array)

                    Changed items (object): > Simplified Group Serializer for user's groups
                    - Changed property `name` (string)

##### `GET` /sources/user_connections/all/

###### Parameters:

Added: `source__slug` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer
        - Changed property `source` (object)

            > Source Serializer
            - Added property `user_property_mappings` (array)

            - Added property `group_property_mappings` (array)

##### `POST` /sources/user_connections/oauth/

###### Request:

Changed content type : `application/json`

New optional properties:

- `user`

* Deleted property `user` (integer)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /sources/user_connections/oauth/

###### Parameters:

Added: `user` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer

        New required properties:
        - `created`
        * Added property `created` (string)

        * Changed property `user` (integer)

        * Changed property `source` (object)

            > Source Serializer
            - Added property `user_property_mappings` (array)

            - Added property `group_property_mappings` (array)

##### `POST` /sources/user_connections/plex/

###### Request:

Changed content type : `application/json`

- Changed property `plex_token` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `created`

    New optional properties:
    - `plex_token`
    * Added property `created` (string)

    * Deleted property `plex_token` (string)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /sources/user_connections/plex/

###### Parameters:

Added: `user` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Plex Source connection Serializer

        New required properties:
        - `created`

        New optional properties:
        - `plex_token`
        * Added property `created` (string)

        * Deleted property `plex_token` (string)

        * Changed property `source` (object)

            > Source Serializer
            - Added property `user_property_mappings` (array)

            - Added property `group_property_mappings` (array)

##### `POST` /sources/user_connections/saml/

###### Request:

Changed content type : `application/json`

New optional properties:

- `user`

* Deleted property `user` (integer)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `created`
    * Added property `created` (string)

    * Changed property `user` (integer)

    * Changed property `source` (object)

        > Source Serializer
        - Added property `user_property_mappings` (array)

        - Added property `group_property_mappings` (array)

##### `GET` /sources/user_connections/saml/

###### Parameters:

Added: `user` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAML Source Serializer

        New required properties:
        - `created`
        * Added property `created` (string)

        * Changed property `user` (integer)

        * Changed property `source` (object)

            > Source Serializer
            - Added property `user_property_mappings` (array)

            - Added property `group_property_mappings` (array)

##### `GET` /stages/identification/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `password_stage` (string)
        > When set, shows a password field, instead of showing the password field as separate step.

##### `PUT` /stages/identification/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `password_stage` (string)
    > When set, shows a password field, instead of showing the password field as separate step.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `password_stage` (string)
        > When set, shows a password field, instead of showing the password field as separate step.

##### `PATCH` /stages/identification/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `password_stage` (string)
    > When set, shows a password field, instead of showing the password field as separate step.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `password_stage` (string)
        > When set, shows a password field, instead of showing the password field as separate step.

##### `GET` /stages/password/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `allow_show_password` (boolean)
        > When enabled, provides a 'show password' button with the password input field.

##### `PUT` /stages/password/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `allow_show_password` (boolean)
    > When enabled, provides a 'show password' button with the password input field.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `allow_show_password` (boolean)
        > When enabled, provides a 'show password' button with the password input field.

##### `PATCH` /stages/password/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `allow_show_password` (boolean)
    > When enabled, provides a 'show password' button with the password input field.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `allow_show_password` (boolean)
        > When enabled, provides a 'show password' button with the password input field.

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

    Updated `authentik_providers_saml.samlprovider` provider_model:
    - Added property `encryption_kp` (string)

        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

    - Added property `sign_assertion` (boolean)

    - Added property `sign_response` (boolean)

    Updated `authentik_providers_ldap.ldapprovider` provider_model:
    - Deleted property `search_group` (string)
        > Users in this group can do search queries. If not set, every user can execute search queries.

##### `GET` /core/user_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserConsent Serializer
        - Changed property `user` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `GET` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-flow-error` component:
    - Deleted property `type` (string)

    Updated `ak-stage-authenticator-totp` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-captcha` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-source-oauth-apple` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-user-login` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-access-denied` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-source-plex` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-duo` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-password` component:
    New optional properties:
    - `type`
    * Added property `allow_show_password` (boolean)

    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-static` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-autosubmit` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `xak-flow-shell` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-provider-oauth2-device-code-finish` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-sms` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-email` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-webauthn` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `xak-flow-redirect` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-dummy` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-validate` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-consent` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-provider-oauth2-device-code` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-prompt` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-identification` component:
    New optional properties:
    - `type`
    * Added property `allow_show_password` (boolean)

    * Deleted property `type` (object)

##### `POST` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-flow-error` component:
    - Deleted property `type` (string)

    Updated `ak-stage-authenticator-totp` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-captcha` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-source-oauth-apple` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-user-login` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-access-denied` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-source-plex` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-duo` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-password` component:
    New optional properties:
    - `type`
    * Added property `allow_show_password` (boolean)

    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-static` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-autosubmit` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `xak-flow-shell` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-provider-oauth2-device-code-finish` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-sms` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-email` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-webauthn` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `xak-flow-redirect` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-dummy` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-authenticator-validate` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-consent` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-provider-oauth2-device-code` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-prompt` component:
    New optional properties:
    - `type`
    * Deleted property `type` (object)

    Updated `ak-stage-identification` component:
    New optional properties:
    - `type`
    * Added property `allow_show_password` (boolean)

    * Deleted property `type` (object)

##### `GET` /oauth2/access_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `GET` /oauth2/authorization_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
        - Changed property `user` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `GET` /oauth2/refresh_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer
            - Changed property `groups_obj` (array)

                Changed items (object): > Simplified Group Serializer for user's groups
                - Changed property `name` (string)

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Changed property `password_stage` (string)
    > When set, shows a password field, instead of showing the password field as separate step.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `password_stage` (string)
        > When set, shows a password field, instead of showing the password field as separate step.

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > IdentificationStage Serializer
        - Changed property `password_stage` (string)
            > When set, shows a password field, instead of showing the password field as separate step.

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Added property `allow_show_password` (boolean)
    > When enabled, provides a 'show password' button with the password input field.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `allow_show_password` (boolean)
        > When enabled, provides a 'show password' button with the password input field.

##### `GET` /stages/password/

###### Parameters:

Added: `allow_show_password` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PasswordStage Serializer
        - Added property `allow_show_password` (boolean)
            > When enabled, provides a 'show password' button with the password input field.

##### `POST` /stages/prompt/prompts/preview/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `type`
    * Deleted property `type` (object)

---

## Release 2025.10

## Highlights

- **SAML and OAuth2 provider Single Logout support**: This release adds support for back-channel and front-channel SLO for SAML and front-channel for OAuth2/OIDC.
- **Removed Redis dependency**: authentik no longer uses Redis at all.
- **Telegram source**: Telegram can now be used for social login.
- **SCIM provider OAuth support**:  SCIM providers can use OAuth providers to authenticate to SCIM endpoints.
- **RADIUS EAP-TLS Support**:  The RADIUS provider now supports EAP-TLS, which can be used to authenticate WiFi clients.

## Breaking changes

### Redis removal

In previous versions, authentik used Redis for caching, tasks, the embedded proxy outpost's session store, and WebSocket connections. Since [2025.8](./v2025.8.mdx), tasks were migrated to use Postgres. With this release we've also migrated caching, the embedded outpost, and WebSocket to Postgres, fully removing the need for Redis.

As a result of this change, it is expected that authentik will use roughly 50% more database connections to Postgres. Redis-related settings have also been removed and can be deleted from your configuration.

If your Postgres instance requires a TLS connection, authentik now requires TLS 1.3 or the Extended Master Secret extension to connect to Postgres.

### Default OAuth scope mappings

In previous releases with the default scope mappings, we set the `email_verified` claim to `true`. As we don't have a single source of whether a users' email is verified or not, and claiming that it is verified could lead to security implications, this claim has been corrected to `false`.

Some applications may require this claim to be `true` to successfully authenticate users, in which case you can create a custom `email` scope mapping that returns `email_verified` as `true`.

For more information, refer to the [Email scope verification documentation](../../add-secure-apps/providers/oauth2/index.mdx#email-scope-verification).

## New features and improvements

### SCIM provider OAuth support&#x20;

SCIM providers can now use OAuth sources to authenticate to SCIM endpoints. This requires support in the remote system for OAuth authentication. Using an OAuth source provides improved security due to not requiring long-lived static tokens.

This is supported by applications such as Slack and Salesforce.

See [SCIM Provider documentation](../../add-secure-apps/providers/scim/index.mdx) for more details.

### RADIUS EAP-TLS support&#x20;

The RADIUS outpost can now support EAP-TLS which allows for client authentication using certificates with the [Mutual TLS stage](../../add-secure-apps/flows-stages/stages/mtls/index.mdx).

See [RADIUS Provider documentation](../../add-secure-apps/providers/radius/index.mdx).

### SAML and OAuth2 provider Single Logout support

In [2025.8](v2025.8.mdx) we've introduced support for back-channel logout in the OAuth2 Provider. This release adds support for front-channel logout in the OAuth2 Provider and both back- and front-channel logout support in the SAML Provider.

See [OAuth2 Provider documentation](../../add-secure-apps/providers/oauth2/index.mdx) and [SAML Provider documentation](../../add-secure-apps/providers/saml/index.mdx).

### Telegram source

Being one of the most upvoted GitHub issues, we've finally done it. Telegram can now be used as a federated identity provider in authentik. This allows users to authenticate with their Telegram credentials.

See [Telegram Source documentation](../../users-sources/sources/social-logins/telegram/index.mdx).

### Refined flow and user library

The flow interface now fits better on mobile devices/small viewports and looks sharper on HiDPi devices. There are also improvements for auto-completion during credential input (thanks to @cjoshmartin!).
The user library has improved scaling and makes better use of space with a higher density.

### Additional noteworthy improvements

- Credential provider: Alpha releases of desktop integrations are now available for testing; reach out to [hello@goauthentik.io](mailto\:hello@goauthentik.io) if you are interested in providing early feedback for any of these:
  - Windows: a custom credential provider allowing custom authentication flows.
  - macOS: a Platform SSO integration allowing seamless authentication.
  - Linux: accessing Linux servers via an authentik identity.
- Add `ak_send_email`: Allow for easier sending of emails in expressions; see [ak\_send\_email](../../customize/policies/types/expression/reference.mdx).
- Change recovery token duration: When using `ak create_recovery_key`, the duration is now set in minutes instead of years.
- Add OIDC `ui_locales` support: The OAuth2 provider now accepts `ui_locales` to set the locale of authentik.
- Add support for separate labels and values in prompt choice inputs, see [Prompt stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.mdx); thanks to @ErikAhlund!

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added.

- [Cloudflare](https://integrations.goauthentik.io/platforms/cloudflare/)
- [Digital Ocean](https://integrations.goauthentik.io/cloud-providers/digitalocean/)
- [Entra ID SCIM](../../users-sources/sources/social-logins/entra-id/scim/index.mdx)
- [osTicket](https://integrations.goauthentik.io/infrastructure/osticket/)
- [Terraform Cloud](https://integrations.goauthentik.io/infrastructure/terraform-cloud/)
- [Termix](https://integrations.goauthentik.io/infrastructure/termix/)
- [Zendesk](https://integrations.goauthentik.io/infrastructure/zendesk/)
- [Zoom](https://integrations.goauthentik.io/chat-communication-collaboration/zoom/)
- [Zot](https://integrations.goauthentik.io/infrastructure/zot/)

## Upgrading

Following the upgrade instructions below will remove Redis from your installation. If you use authentik with an externally configured Redis, you can simply remove the Redis configuration from authentik; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2025.10/docker-compose.yml
docker compose up -d --remove-orphans
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

The `--remove-orphans` flag removes the Redis container as it's no longer needed.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.10
```

If you had persistence for Redis configured, you can delete the PVC and PV after the upgrade.

## Minor changes/fixes

- \*: add ruff BLE rules (#16943)
- \*: Fix dead doc link (#16288)
- \*: remove Redis leftovers (#17146)
- \*/bindings: order by pk (#17027)
- api: Clean schema up more (#17055)
- api: Fix locale propagation from ?locale parameter in frontend (#16857)
- api: optimize schemas' common query parameters (#16884)
- blueprints: ensure tasks retry on database errors (#17333)
- blueprints: exclude exporting UserConsent (#16640)
- blueprints: fix email address verified by default (#16206)
- blueprints: fix typo in sources-google-ldap-mappings (#16955)
- blueprints: regenerate schema (#17365)
- brands: revert sort matched brand by match length (revert #15413) (#16233)
- cmd/server/healthcheck: info log success instead of debug (#17093)
- core, events: reduce memory usage when batch deleting objects (#12436)
- core: Add ak\_send\_email function in expression context (#16941)
- core: Add email template selector (#16170)
- core: add index on Group.is\_superuser (#17011)
- core: Add input validation for service account creation (#16964)
- core: add QL for groups (#17527)
- core: Block usage of Django's createsuperuser (#16215)
- core: fix absolute and relative path file uploads (#17269)
- core: fix application and source's fa:// icon (#17416)
- core: fix client-side only validation allowing admin to set blank user password (#16467)
- core: fix description on remove\_user\_from\_group (#16694)
- core: Fix middleware race condition induced crash (#16705)
- core: Fix typo (#16560)
- core: Include region comments in VSCode Minimap. (#16667)
- core: Mark impersonation reason field as required in UI and fix status codes (#16065)
- core: Normalize NPM script arguments. (#16725)
- core: update\_attributes: only update the model if attributes changed (#16322)
- core: use email backend for test\_email management command (#16311)
- core/api: Better naming for partial user/group serializer, optimize bindings (#17022)
- enterprise/providers/gws+entra: fix group integrity error during discovery (#17355)
- enterprise/providers/gws+entra: fix integrity error during discovery (#17341)
- enterprise/providers/radius: add EAP-TLS support (#15702)
- enterprise/providers/scim: Add SCIM OAuth support (#16903)
- enterprise/stages/mtls: Improve Email address extraction (#17068)
- events: remove deprecated models (#15823)
- flows: redirect to next when accessing an unapplicable authentication flow while already authenticated (#17243)
- flows: SessionEndStage: only show page if user is still authenticated (#17003)
- lib: import ExceptionDictTransformer from structlog.tracebacks (#17526)
- lib: match exception\_to\_dict locals behavior (#17006)
- lib: small type hinting improvements (#17528)
- lib/config: fix listen settings (#17005)
- lib/logging: only show locals when in debug mode (#16772)
- lib/sync: fix missing f for string (#16423)
- lib/sync: revert breaking type change (#17553)
- lib/sync/outgoing: fix single object sync timeout (#16447)
- lib/sync/outgoing: revert reduce number of db queries made (revert #14177) (#17306)
- lifecycle: fix permission error when running worker as root (#16735)
- lifecycle: fix PROMETHEUS\_MULTIPROC\_DIR missing suffix (#16401)
- lifecycle: set PROMETHEUS\_MULTIPROC\_DIR as early as possible (#16298)
- outpost: proxyv2: Use Postgres for the Embedded Outpost (#16628)
- outpost/proxyv2: postgresstore: credential refresh (#17414)
- outpost/proxyv2: postgresstore: db/pool/misc cleanup and enhancement (#17511)
- outposts: allow ingress path type configuration (#16339)
- outposts: fix flow executor when using subpath (#16947)
- outposts: fix service connection update task arguments (#16312)
- outposts/ldap: add pwdChangeTime attribute (#17010)
- packages/django-channels-postgres: compression and connection pool (#17303)
- packages/django-channels-postgres: init (#17247)
- packages/django-channels-postgres/layer: fix connection deadlock (#17270)
- packages/django-dramatiq-postgres: broker: fix new messages not being picked up when too many messages are waiting (#17106)version-2025.8) (#17108)
- packages/django-dramatiq-postgres: broker: fix task expiration (#17178)
- packages/django-dramatiq-postgres: broker: fix various timing issues (#16340)
- packages/django-dramatiq-postgres: broker: task retrieval fixes and improvements (#17335)
- packages/django-dramatiq-postgres: fix error when updating task with no changes (#16728)
- packages/django-dramatiq-postgres: middleware: fix listening on hosts where ipv6 is not supported (#16308)
- packages/django-dramatiq-postgres: typing (#16978)
- packages/django-postgres-cache: Initial implementation of postgres cache (#16653)
- policies: remove object pk from authentik\_policies\_execution\_time to reduce cardinality (#16500)
- policies/password: Fix amount\_uppercase in password policy check (#16197)
- policies/reputation: update reputation in a single query (#17529)
- providers/ldap: add include\_children parameter to cached search mode (#16918)
- providers/oauth2: add missing exp claim for logout token (#16593)
- providers/oauth2: add ui\_locales support for OIDC (#17140)
- providers/oauth2: allow setting logout method always (#17470)
- providers/oauth2: avoid deadlock during session migration (#16361)
- providers/oauth2: fix authentication error with identical app passwords (#17100)
- providers/oauth2: fix logout token missing sid, fix wrong sub mode used (#16295)
- providers/oauth2: include scope in JWT (#16454)
- providers/oauth2: only issue new refresh token if old one is about to expire (#16905)
- providers/proxy: fix missing postgres import (#17582)
- providers/rac: bump guacd to 1.6 (#17392)
- providers/rac: fix `AuthenticatedSession` migration (#16400)
- providers/rac: remove autobahn import (#17224)
- providers/saml: add frontchannel idp slo, backchannel post idp slo (#15863)
- providers/saml: fix timezone naive warning (#17382)
- providers/scim: add salesforce support (#16976)
- providers/scim: fix string formatting for SCIM user filter (#16465)
- providers/scim: improve error message when object fails to sync (#16625)
- rbac: assign `InitialPermission`s in a middleware (#16138)
- rbac: fix role search fields (#17305)
- rbac: fix typo (#16476)
- rbac: optimize rbac assigned by users query (#17015)
- readme: Remove Docker pulls badge (#16707)
- recovery: Default to 60 minutes (#16005)
- router: fix missing response headers on compressed 404 for static files (#16216)
- sources: add Telegram source (#15749)
- sources/ldap: fix malformed filter error with special characters in group DN (#16243)
- sources/oauth: add support for login support if source was started within a flow executor (#16982)
- sources/oauth: configurable PKCE mode (#17487)
- sources/oauth/entra\_id: do not assume group\_id comes from entra (#16456)
- sources/saml: add default error messages to exceptions (#15562)
- sources/saml: add location selection for Signature node (#15626)
- stages: update friendly\_name model from null to blank (#16672)
- stages/authenticator\_duo: Add test to fix codecov error (#16257)
- stages/authenticator\_duo: return generic error message (#16194)
- stages/email\_authenticator: Fix email mfa loop (#16579)
- stages/identification: fix mismatched error messages (#17090)
- stages/prompt: add ability to set separate labels and values for choices (#16693)
- stages/user\_login: add user to query (#17171)
- stages/user\_write: fix attribute path replacement (#17507)
- tasks: add preprocess, running and postprocess statuses (#17297)
- tasks: add rel\_obj to system task exception event (#16270)
- tasks: add sentry dramatiq integration (#16167)
- tasks: add task status summary (#17302)
- tasks: fix errors found in tests (#17062)
- tasks: fix logger name (#17009)
- tasks: fix status and healthcheck breaking with connection issues (#16504)
- tasks: only set tenant on task creation (#17358)
- tasks: reduce default number of retries and max backoff (#17107)
- tasks: set uid early (#17356)
- tasks: show number of retries and planned execution time (#17295)
- tasks: store messages in separate table (#17359)
- tasks/middlewares/messages: make sure exceptions are always logged (#17237)
- tasks/schedules: fix api search fields (#16405)
- tasks/schedules: upsert instead of update\_or\_create (#17534)
- tests/e2e: fix ldap tests following #17010 (#17021)
- tests/e2e: less hardcoded names (#17047)
- tests/e2e: switch chrome for chromium (#17407)
- web: Add disabled radio styles. (#17026)
- web: Additional text field properties, ARIA fixes (#17115)
- web: ak-status-label: add neutral status (#16064)
- web: Apply consistent background color when input is disabled or readonly. (#17105)
- web: Automatic reload during server start up. (#16030)
- web: Clean up render interfaces. (#16031)
- web: Do not mark Attributes as a mandatory field (#16004)
- web: Docker versioning compatibility (#16139)
- web: fix "Explore integrations" link in Quick actions (#16274)
- web: Fix ak-flow-card footer alignment. (#16236)
- web: Fix avatar image load flash. (#17220)
- web: Fix behavior for modals configured with closeAfterSuccessfulSubmit (#17277)
- web: Fix card alignment, slotting, labeling (#17307)
- web: Fix default RADIUS EAP-TLS cert without license. (#17152)
- web: Fix docs links, a11y input descriptors (#16671)
- web: Fix flow autofocus element targeting. (#17255)
- web: Fix flow view title setter. (#17245)
- web: Fix hidden textarea `required` attribute. (#16168)
- web: Fix issue where clicking a list item scrolls container. (#16174)
- web: Fix issue where form group uses unknown slot. (#16276)
- web: Fix layout class for 'row' in LibraryPage (#16752)
- web: Fix low DPI on QR Codes. (#17251)
- web: Fix native icon colors when using dark theme. (#17118)
- web: Fix nested table column span behavior. (#17177)
- web: Fix numeric values in search select inputs, search input fixes (#16928)
- web: Fix Recent Events toolbar height. (#17172)
- web: Fix reported error precedence (#16231)
- web: Fix skip-to-content element target, order. (#17030)
- web: Fix tab theme consistency, table overflow. (#17222)
- web: Fix table child alignment (#17114)
- web: Fix table column updates, template parsing (#17254)
- web: Fixed null lastUsed and autofocus on TOTP login field (#16739)
- web: Flow fixes -- Captchas, form states, compatibility mode. (#17226)
- web: Flush logs on SIGINT. (#16723)
- web: Ignore spellchecking of Playwright output. (#16862)
- web: Improvements to ReCaptcha resizing (#16171)
- web: Minimal mobile flow (#17280)
- web: Minimal mobile flow, revisions (#17310)
- web: Remove brand column. (#17173)
- web: Remove CSS constructor polyfill. (#16920)
- web: Remove deprecated `node:path` polyfill. (#16702)
- web: Replace Github Slugger package with change-case. (#16921)
- web: Report unregistered elements. (#17025)
- web: Responsive toolbar flow (#17278)
- web: revert bump the swc group across 1 directory with 11 updates (#17113)
- web: revise ak-page-navbar to use standard event handlers (#16898)
- web: saml provider view: fix state refresh issues (#14474)
- web: Table refresh timestamp. (#17145)
- web: Use curated dictionary for e2e fixtures. (#16750)
- web: Use embedded layout. (#16481)
- web: Use Pino console logger, reduce live reload noise. (#16703)
- web: User library UI fixes (#17376)
- web: Username truncation, field alignment. (#16283)
- web/a11y: Accessible scrollbars. (#17253)
- web/a11y: Admin overview regions. (#17170)
- web/a11y: Associating labels with inputs (#16119)
- web/a11y: Brand form (#16011)
- web/a11y: Codemirror (#16010)
- web/a11y: File Inputs (#16038)
- web/a11y: Fix "skip to content" target. (#17510)
- web/a11y: Fix dark theme color contrast (#17144)
- web/a11y: Fix missing screen reader class on fieldset legends. (#17298)
- web/a11y: Flow inspector. (#17271)
- web/a11y: Flow Search (#15876)
- web/a11y: Flow Stages (#17273)
- web/a11y: Notifications drawer (#17031)
- web/a11y: QL Search Input (#16198)
- web/a11y: Status label (#17148)
- web/a11y: Table header -- Fix pagination jitter, prepare alignment (#17116)
- web/a11y: Table header -- Search input (#17117)
- web/a11y: Tables -- labels, input handlers, selection and expanded state (#16207)
- web/a11y: Text Input (#16041)
- web/a11y: Tree view (#17147)
- web/a11y: User library (#17311)
- web/a11y: User settings flow. (#17219)
- web/admin: Add link to the docs in the import flow dialog (#17436)
- web/admin: allow blank value for User path template in User Write Stage (#16347)
- web/admin: Fix disappearing "Create" button in service account modal (#16963)
- web/admin: fix federation sources automatically selected (#17069)
- web/admin: fix incorrect placeholder for scim provider (#17308)
- web/admin: fix settings saving (#16184)
- web/admin: providers/rac: improve host field hint (#16443)
- web/admin: remove maxlength on user display name (#17412)
- web/admin: rework task status summary (#17337)
- web/e2e: Playwright end-to-end test runner (#16014)
- web/e2e: User creation (#17149)
- web/flow: small layout fixes (#17551)
- web/flows: fix card alignment (#17332)
- web/flows: only disable login button when interactive captcha is configured and not loaded (#16586)
- web/flows: update default flow background (#17315)
- web/maintenance: typo in icon class (#16371)

## Fixed in 2025.10.1

- internal: fix Go deprecation for +build (cherry-pick #17806 to version-2025.10) (#17824)
- internal: full openssl path (cherry-pick #17856 to version-2025.10) (#17860)
- internal/web/proxy: fix return status code during startup (cherry-pick #17827 to version-2025.10) (#17832)
- outpost: revert breaking signals change (cherry-pick #17847 to version-2025.10) (#17848)
- outposts: update permissions more eagerly (cherry-pick #17783 to version-2025.10) (#17841)
- packages/django-postgres-cache: use upsert instead of select/update in a transaction (cherry-pick #17760 to version-2025.10) (#17767)
- providers/oauth2: fix kid always required for federation (cherry-pick #17914 to version-2025.10) (#17917)
- providers/oauth2: move encryption key field (cherry-pick #17722 to version-2025.10) (#17729)
- providers/proxy: fix missing JWT/claims header (cherry-pick #17759 to version-2025.10) (#17764)
- providers/radius: fix inverted message authenticator validation (cherry-pick #17855 to version-2025.10) (#17888)
- providers/radius: fix panic when no cert is configured (cherry-pick #17762 to version-2025.10) (#17766)
- providers/radius: revert fix inverted message authenticator validation (#17855) (cherry-pick #17915 to version-2025.10) (#17916)
- root: Add Dockerfile label org.opencontainers.image.source (cherry-pick #17756 to version-2025.10) (#17757)
- root: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10) (#17798)
- sources/oauth: Make PKCE verifier 128 characters (cherry-pick #17763 to version-2025.10) (#17765)
- tasks: delay startup signals (cherry-pick #17769 to version-2025.10) (#17775)
- tasks: sanitize log attributes (cherry-pick #17833 to version-2025.10) (#17842)
- web: Consistent Tab Panel URL Parameters (cherry-pick #17804 to version-2025.10) (#17859)
- web/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (cherry-pick #17522 to version-2025.10) (#17828)
- web/admin: fix SCIM provider form (cherry-pick #17831 to version-2025.10) (#17834)

## Fixed in 2025.10.2

- brands: add more matching tests (cherry-pick #16185 to version-2025.10) (#17924)
- brands: sort matched brand by match length (cherry-pick #17920 to version-2025.10) (#17935)
- cmd/server/healthcheck: remove worker HTTP healthcheck (cherry-pick #18090 to version-2025.10) (#18091)
- core: bump django from 5.2.7 to 5.2.8 (cherry-pick #17967 to version-2025.10) (#18003)
- core: improve app launch URL formatting (cherry-pick #18076 to version-2025.10) (#18087)
- events: fix timezone not set for log events (cherry-pick #18067 to version-2025.10) (#18071)
- internal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10 (#18258)
- internal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10 (#18259)
- internal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10 (#18260)
- packages/django-channels-postgres/layer: fix query when subscribed to multiple channels (cherry-pick #18152 to version-2025.10) (#18153)
- packages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (cherry-pick #18095 to version-2025.10) (#18119)
- providers/scim: allow custom schema data (cherry-pick #18073 to version-2025.10) (#18075)
- stages/prompt: fix choices with labels causing error on submit (cherry-pick #18183 to version-2025.10) (#18236)
- tasks/schedules: fix rel obj not being associated or updated (cherry-pick #17934 to version-2025.10) (#17936)
- web: Disable library `<datalist>` on Firefox. (cherry-pick #18103 to version-2025.10) (#18135)
- web: Fix RAC modal visibility. (cherry-pick #17941 to version-2025.10) (#18097)
- web: Fix tab activation, blank provider URLs (cherry-pick #18031 to version-2025.10) (#18101)
- web/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10) (#18134)
- web/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10) (#18128)
- web/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10) (#18171)

## Fixed in 2025.10.3

- core: list applications fix (cherry-pick #18798 to version-2025.10) (#18827)
- core: optimize list applications (cherry-pick #18330 to version-2025.10) (#18791)
- enterprise/stages/mtls: fix traefik certificate parsing (cherry-pick #18607 to version-2025.10) (#18645)
- flows: refresh unauthenticated tabs (cherry-pick #18621 to version-2025.10) (#18633)
- lib/sync/outgoing: check if there is a provider before creating tasks (cherry-pick #18394 to version-2025.10) (#18397)
- outpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (cherry-pick #18211 to version-2025.10) (#18742)
- outposts: set container healthcheck inline (cherry-pick #18298 to version-2025.10) (#18370)
- packages/django-channels-postgres: fix notify size check (cherry-pick #18347 to version-2025.10) (#18409)
- packages/django-dramatiq-postgres: broker: close django connections on consumer close (cherry-pick #18833 to version-2025.10) (#18835)
- providers/scim: compare users/groups before sending update request (cherry-pick #18456 to version-2025.10) (#18465)
- root: fix missing authentik\_device cookie causing error (cherry-pick #18642 to version-2025.10) (#18644)
- root: skip current tab when refreshing others (cherry-pick #18674 to version-2025.10) (#18675)
- sources/ldap: make server info optional (cherry-pick #18648 to version-2025.10) (#18654)
- stages/prompt: set allow\_blank for \_read\_only fields (cherry-pick #18297 to version-2025.10) (#18406)
- web: Fix row expansion on modal trigger buttons. (cherry-pick #18412 to version-2025.10) (#18647)
- web: Fix stale table rows (cherry-pick #17940 to version-2025.10) (#18373)
- web: Fix stale table rows (cherry-pick #17940 to version-2025.10) (#18408)
- web: Hide device picker when challenges are not present. (cherry-pick #18611 to version-2025.10) (#18681)
- web: Improved table selection behavior (cherry-pick #18622 to version-2025.10) (#18685)
- web: revert Fix stale table rows (cherry-pick #17940 to version-2025.10) (#18407)
- web/admin: add entitlement search (cherry-pick #18291 to version-2025.10) (#18390)
- web/admin: fix brands default switch label (cherry-pick #18518 to version-2025.10) (#18522)
- web/admin: fix event volume chart not updating with query (cherry-pick #18649 to version-2025.10) (#18653)
- web/admin: fix wording in password stage (cherry-pick #18393 to version-2025.10) (#18395)
- web/admin: fixes capitalization in application wizard title (cherry-pick #17959 to version-2025.10) (#17962)

## Fixed in 2025.10.4

- core: bump django from v5.2.8 to 5.2.11 (version-2025.10) (#20020)
- core: fix read replica routing during transactions (cherry-pick #19086 to version-2025.10) (#19240)
- core: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.10) (#19709)
- core: use chunked\_queryset for expired message deletion (cherry-pick #19028 to version-2025.10) (#19030)
- internal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.10) (#19702)
- internal: rework liveness probe and proxy (cherry-pick #19312 to version-2025.10) (#19383)
- internal: update TLS Suite (cherry-pick #19076 to version-2025.10) (#19077)
- outpost/proxyv2: fix stale session cookie causing 400 error in createState (cherry-pick #19026 to version-2025.10) (#19374)
- outpost/proxyv2: reduce max number of postgres connections (cherry-pick #19211 to version-2025.10) (#20139)
- outpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.10) (#20058)
- providers/oauth2: add logout+jwt token type for oidc logout token. (cherry-pick #19554 to version-2025.10) (#19674)
- providers/oauth2: use compare\_digest for client\_secret comparison (cherry-pick #19979 to version-2025.10) (#19982)
- recovery: consume token in transaction (cherry-pick #19967 to version-2025.10) (#19981)
- root: update client-go generation (cherry-pick #19762 and #19906 to version-2025.10) (#19933)
- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227.mdx) (#20227)
- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748.mdx) (#20228)
- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922.mdx) (#20229)
- web/admin: Fix haveibeenpwned link in PasswordPolicyForm (cherry-pick #18984 to version-2025.10) (#18988)
- web/admin: add banner to flow import form (cherry-pick #19288 to version-2025.10) (#19292)
- web/admin: fix dark theme on map (cherry-pick #18985 to version-2025.10) (#18986)
- web/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.10) (#19711)
- web/elements: hidden secrets not propagating (cherry-pick #19029 to version-2025.10) (#19376)
- web/flow: Fix spurious double submit on ak-stage-autosubmit (cherry-pick #18727 to version-2025.10) (#18932)
- web/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.10) (#19764)
- web: fix slug auto-updating when editing existing applications (cherry-pick #19169 to version-2025.10) (#19172)

## API Changes

#### What's Changed

***

##### `GET` /providers/google\_workspace/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `PUT` /providers/google\_workspace/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `PATCH` /providers/google\_workspace/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `GET` /providers/microsoft\_entra/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `PUT` /providers/microsoft\_entra/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `PATCH` /providers/microsoft\_entra/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `GET` /providers/scim/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `PUT` /providers/scim/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `PATCH` /providers/scim/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `POST` /providers/google\_workspace/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `GET` /providers/google\_workspace/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > GoogleWorkspaceProvider Serializer

    - Added property `sync_page_size` (integer)

      > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
      > Timeout for synchronization of a single page

##### `POST` /providers/microsoft\_entra/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `GET` /providers/microsoft\_entra/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > MicrosoftEntraProvider Serializer

    - Added property `sync_page_size` (integer)

      > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
      > Timeout for synchronization of a single page

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

  > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
  > Timeout for synchronization of a single page

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SCIMProvider Serializer

    - Added property `sync_page_size` (integer)

      > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
      > Timeout for synchronization of a single page

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

  Updated `authentik_providers_microsoft_entra.microsoftentraprovider` provider\_model:

  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

  Updated `authentik_providers_google_workspace.googleworkspaceprovider` provider\_model:

  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

  Updated `authentik_providers_scim.scimprovider` provider\_model:

  - Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

  - Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

---

## Release 2025.12

<!-- spellchecker:ignore fqxr xjjx -->

## Highlights

- **Endpoint Devices**: :ak-enterprise :ak-preview Endpoint Devices is a new feature set for Windows, macOS, and Linux devices that enables SSH authentication, local device login, and more, all with authentik credentials. See the [Endpoint Devices docs](../../endpoint-devices/index.mdx) for more details.
- **CSV Data Exports**: :ak-enterprise Now you can export user and event data in CSV format for backup or analysis purposes.
- **RBAC Permissions**: Permissions are now granted exclusively via roles, and permission inheritance and basic object permissions have been enhanced.
- **Passkey Autofill (WebAuthn Conditional UI)**: Passkeys now appear in the browser's autofill dropdown alongside saved passwords, enabling seamless passwordless login when focusing on input fields.

## Breaking changes

### RBAC

As a first step to overhaul authentik's access control system, much of how groups and roles work internally is altered in this release. We recommend you check any custom code (e.g. expression policies, property mappings) that deals with group/role memberships or access control.

#### Group name uniqueness

Make sure your group names are unique before starting the upgrade.

From `2024.6`, authentik enforced group name uniqueness through the API. However, groups created earlier or groups created by non-API mechanisms (e.g. a sync from a Source) may have left groups with duplicate names in your system. With `2025.12`, group name uniqueness will now be enforced on the database-level.

We played with automatically renaming duplicates, but ultimately found it too confusing for admins. Instead, we made the migration fail loudly in case offending groups exist and now require manual renaming.

#### Permission inheritance

Groups already inherit `is_superuser` from their ancestor groups. With `2025.12`, groups will also inherit all permissions from their ancestor groups.

#### Group hierarchy

Groups can now have multiple parent groups. Specifically, the `Group.parent` field (which was a `ForeignKey`) is now migrated to `Group.parents` (which is a `ManyToManyField`).

#### User permissions

All permissions now must be attached to a role. The direct relationships between the User and Permission models still exist (`User.user_permissions` and `User.userobjectpermission_set`), but they are not used and will be removed in a future release.

### Storage improvements

File storage has been reworked to unify media file configuration (icons, branding options), and allow future uses of file storage including [CSV Data Exports](.).

Files stored by authentik are now served from the `/files` prefix, and not from `/media` anymore. Any custom reverse proxy configuration handling those paths will need to be updated.

#### Storage mount changes

If local storage is used, authentik now expects a mount at `/data` for file storage. The existing `/media` mount must be moved to `/data/media`.

For Docker Compose users, the migration is as follows:

```shell
# Shut down authentik
docker compose down
# Create the new storage folder
mkdir -p ./data
# Move the old media storage to the new location
mv ./media ./data/media
# Download the new Docker Compose with the updated paths and start authentik. See below for details.
```

#### Storage configuration changes

New storage configuration options are available. See the [storage settings reference](../../install-config/configuration/configuration.mdx#storage-settings) for details.

## New features and improvements

### Endpoint devices :ak-preview

Endpoint Devices are end-user devices or servers that are integrated with authentik.

Devices can be integrated by installing the [authentik Agent](../../endpoint-devices/authentik-agent/index.mdx) which supports:

- [Local device login](../../endpoint-devices/authentik-agent/device-authentication/local-device-login/index.mdx) with authentik credentials
- [Connecting via SSH to Endpoint Devices](../../endpoint-devices/authentik-agent/device-authentication/ssh-authentication.mdx) with authentik credentials
- [Authenticating to CLI applications](../../endpoint-devices/authentik-agent/device-authentication/cli-app-authentication/index.mdx) such as kubectl and AWS with authentik credentials

[Connectors](../../endpoint-devices/device-compliance/connectors/index.mdx) allow authentik to fetch device information which enables [Device Compliance](../../endpoint-devices/device-compliance/index.mdx) functionality in authentik flows and policies. For example, you can limit authentication to devices running a specific OS or OS version.

Currently, only the authentik Agent connector is supported. Connectors to fetch information from third-party tools like Fleet, Cloudflare WARP, and Microsoft Intune are in development.

### CSV Data Exports :ak-enterprise

authentik now allows you to export user and event data in CSV format for backup or analysis purposes. The exported content matches that returned by the API endpoints for the respective object types. You can access past data exports from **System Management** > **Data Exports**, where you can view the query used for each export, search by data type and user, download completed exports, and delete exports you no longer need.

See [Data Exports documentation](../../sys-mgmt/data-exports.mdx) for more details.

### Passkey Autofill (WebAuthn Conditional UI)

WebAuthn Conditional UI allows passkeys to appear directly in the browser's autofill dropdown alongside saved passwords. When a user focuses on a login input field, their registered passkeys are presented as autofill options, enabling a seamless passwordless authentication experience without requiring users to explicitly select a passkey option first.

This feature improves the discoverability of passkeys and reduces friction for users who have registered WebAuthn credentials, making passwordless login as intuitive as traditional password autofill.

See the [Passkey Autofill documentation](../../add-secure-apps/flows-stages/stages/identification/#passkey-autofill-webauthn-conditional-ui) for more details.

### RBAC Permissions

authentik's access control is now completely role-based. The `2025.12` release also provides support for multiple parents for a group, inherited permissions from ancestors, allowing one or MORE roles to be assigned to a single group, and enforcement of unique names for groups. Additionally, object permissions are auto-assigned to the object's creator via managed roles, to ensure CRUD rights.

If you currently have user permissions defined, they will be migrated to the role named `ak-migrated-role--user-{user_id}`.

### Files

authentik now provides a centralized file management system for storing and organizing image files used throughout the platform. This includes application icons, source icons, and branding assets such as logos, favicons, and flow background images. Files can be uploaded and managed from **Customization** > **Files** in the Admin interface. By default, files are stored on disk, but S3 storage can also be configured.

See [Files documentation](../../customize/files.mdx) for more details.

### UI improvements on mobile and tablet devices

Flows now work better on smaller screens, including fixes for scrollbars on mobile and tablet devices, smarter login card shadows, and better form label alignment. If you use custom styles, you may need to revise them.

### Localization improvements

A locale selector is now available on the login screen, allowing users to choose their preferred language before authenticating. The selected locale persists for the browser session, and after authentication, user attributes take priority over the session preference if configured. We've also improved locale detection and updated our locale management to make future translations easier.

### Promoted source

Sources can now be promoted to display as primary buttons on the login page instead of small icons. This allows administrators to emphasize preferred social login providers (such as Google, GitHub, or Discord) by giving them more visual prominence in the authentication flow, making it easier for users to identify and select their preferred login method.

### Glossary

We have replaced our too-short Terminology page with a more rich [Glossary](../../core/glossary/), with terms that are searchable by tags or first letter.

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added. A big thanks to the contributors of many of these new guides.

- [Audiobookshelf](https://integrations.goauthentik.io/media/audiobookshelf/) (Thanks to [@0skater0](https://github.com/0skater0)!)
- [Amazon Business](https://integrations.goauthentik.io/miscellaneous/amazon-business/) (Thanks to [@nicedevil007](https://github.com/nicedevil007)!)
- [ChatGPT](https://integrations.goauthentik.io/chat-communication-collaboration/chatgpt/) (Thanks to [@nicedevil007](https://github.com/nicedevil007)!)
- [ezBookkeeping](https://integrations.goauthentik.io/miscellaneous/ezbookkeeping/) (Thanks to [@mayswind](https://github.com/mayswind)!)
- [FortiMail](https://integrations.goauthentik.io/security/fortimail/) (Thanks to [@nicedevil007](https://github.com/nicedevil007)!)
- [GLPI](https://integrations.goauthentik.io/documentation/glpi/) (Thanks to [@lameslime](https://github.com/lameslime)!)
- [Hoop.dev](https://integrations.goauthentik.io/networking/hoop.dev/) (Thanks to [@shcherbak](https://github.com/shcherbak)!)
- [Jellyseer](https://integrations.goauthentik.io/media/jellyseerr/) (Thanks to [@gabay](https://github.com/gabay)!)
- [Joplin](https://integrations.goauthentik.io/chat-communication-collaboration/joplin/) (Thanks to [@tetragir](https://github.com/tetragir)!)
- [Keycloak](https://integrations.goauthentik.io/infrastructure/keycloak/)
- [KitchenOwl](https://integrations.goauthentik.io/documentation/kitchenowl/) (Thanks to [@l0f3n](https://github.com/l0f3n)!)
- [KnowBe4](https://integrations.goauthentik.io/security/knowbe4/) (Thanks to [@nicedevil007](https://github.com/nicedevil007)!)
- [macmon NAC](https://integrations.goauthentik.io/security/macmon-nac/) (Thanks to [@nicedevil007](https://github.com/nicedevil007)!)
- [Microsoft365](https://integrations.goauthentik.io/platforms/microsoft/) (Thanks to [@nicedevil007](https://github.com/nicedevil007)!)
- [Placetel](https://integrations.goauthentik.io/chat-communication-collaboration/placetel/) (Thanks to [@TimoReusch](https://github.com/TimoReusch)!)
- [Pulse](https://integrations.goauthentik.io/monitoring/pulse/) (Thanks to [@0skater0](https://github.com/0skater0)!)
- [Salesforce](https://integrations.goauthentik.io/platforms/salesforce/)
- [SeaTable](https://integrations.goauthentik.io/chat-communication-collaboration/seatable/) (Thanks to [@christophdb](https://github.com/christophdb)!)
- [Wallos](https://integrations.goauthentik.io/miscellaneous/wallos/) (Thanks to [@0skater0](https://github.com/0skater0)!)

## Upgrading

This release does not introduce any new requirements, but be sure to read about any breaking changes. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2025.12/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.12
```

## Minor changes/fixes

- \*: convert slugfields to textfields (#17411)
- admin/files: add check for /media existence (#18636)
- admin/files: cache expensive generated URLs (#18784)
- admin/files: delete applications cache on migration (#18565)
- api: add decorator to validate serializer in @action endpoints (#17435)
- api: allow configuring default page_size and max_page_size (#18165)
- api: fix IPC auth (#18612)
- api: test action decorator (#18583)
- blueprints: remove pk from recovery example (#18712)
- brands: add more matching tests (#16185)
- brands: sort matched brand by match length (#17920)
- cmd/server/healthcheck: remove worker HTTP healthcheck (#18090)
- core, web: unified locales (#18502)
- core/sessions: remove django groups prefetch (#18704)
- core: Add example invitation blueprint (#17661)
- core: add digraph group hierarchy (#17050)
- core: custom avatar url improvements (#10525)
- core: deduplicate user attribute constant definitions (#18138)
- core: improve app launch URL formatting (#18076)
- core: optimize list applications (#18330)
- core: propagate `ModuleNotFoundError` in `import_relative` (#18683)
- crypto: only generate managed keypair if non-existent (#18457)
- crypto: separate permissions for certificate and private keydownload (#18588)
- crypto: update certificate api and component (#17921)
- crypto: update certificates on fs event (#18129)
- endpoints/stage: v2, better error handling, more settings (#18545)
- endpoints/stage: v2.1, fix asymmetric token exchange and missing form input (#18547)
- endpoints: AuthN and AuthZ (#18350)
- endpoints: fix UI bugs, add user binding, etc (#18609)
- endpoints: fix device access group missing from blueprint (#18703)
- endpoints: implement endpoint stage (#18468)
- endpoints: include device ID in agent config (#18414)
- endpoints: initial data structure + agent (#11499)
- endpoints: rework perms (#18422)
- enterprise/endpoints/connectors/agent: fix Apple JWE encryption when FIPS is enabled (#18464)
- enterprise/providers/scim: fix OAuth (#18358)
- enterprise/reports: add users and events export (#18088)
- enterprise/stages/mtls: fix traefik certificate parsing (#18607)
- enterprise: Apple Platform SSO (#15318)
- enterprise: add prometheus metrics for license usage and expiry (#17606)
- enterprise: handle cached naive timezone (#17695)
- events: fix timezone not set for log events (#18067)
- files: rework (#17535)
- flows: keep ?next url when using cancel (#18619)
- flows: refresh unauthenticated tabs (#18621)
- flows: remove SESSION_KEY_APPLICATION_PRE (#18388)
- internal/web/proxy: fix return status code during startup (#17827)
- internal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.10 (#18258)
- internal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-main (#18264)
- internal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.10 (#18259)
- internal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-main (#18265)
- internal: Automated internal backport: 5000-sidebar.sec.patch to authentik-2025.10 (#18260)
- internal: Automated internal backport: 5000-sidebar.sec.patch to authentik-main (#18266)
- internal: add default go http server timeouts (#17858)
- internal: fix go deprecation for +build (#17806)
- internal: full openssl path (#17856)
- lib/sync/outgoing: check if there is a provider before creating tasks (#18394)
- lib/sync/outgoing: store sync settings in database (#17630)
- lib: add ak_create_jwt_raw (#18676)
- lib: do not strip and re-add curly braces from raw JSON config (#13769)
- lifecycle/migrate: remove tenant_files migration (#18729)
- lifecycle: set search_path in system migrations (#17721)
- outpost/proxyv2: more tests, fix pg password with spaces, and existing session on restart (#18211)
- outpost: revert breaking signals change (#17847)
- outposts: set container healthcheck inline (#18298)
- outposts: update permissions more eagerly (#17783)
- packages/django-channels-postgres/layer: fix query when subscribed to multiple channels (#18152)
- packages/django-channels-postgres: fix notify size check (#18347)
- packages/django-dramatiq-postgres: broker: ensure locking happens with the same connection (#18095)
- packages/django-postgres-cache: use upsert instead of select/update in a transaction (#17760)
- policies: use flow planner directly in PolicyAccessView to directly set flow context (#18372)
- provider/saml: make signing kp singleton (#17703)
- providers/oauth2: fix kid always required for federation (#17914)
- providers/oauth2: move encryption key field (#17722)
- providers/oauth2: optimize JWKS endpoint queries (#18405)
- providers/proxy: add gorm logging (#17758)
- providers/proxy: drop headers with underscores (#17650)
- providers/proxy: fix missing JWT/claims header (#17759)
- providers/radius: fix inverted message authenticator validation (#17855)
- providers/radius: fix panic when no cert is configured (#17762)
- providers/radius: revert fix inverted message authenticator validation (#17855) (#17915)
- providers/saml: fix front-end saml binding defaults (#18189)
- providers/saml: move sp binding location and default value (#17609)
- providers/scim: allow custom schema data (#18073)
- providers/scim: cache ServiceProviderConfig (#18047)
- providers/scim: compare users/groups before sending update request (#18456)
- providers/scim: fix PATCH for AWS (#18230)
- root: Add Dockerfile label org.opencontainers.image.source (#17756)
- root: fix missing authentik_device cookie causing error (#18642)
- root: skip current tab when refreshing others (#18674)
- root: use hashes for dockerfile FROM (#17795)
- sources/ldap: make server info optional (#18648)
- sources/oauth: Make PKCE verifier 128 characters (#17763)
- sources/oauth: add WeChat type (#18086)
- sources/oauth: save returned oauth refresh tokens and add slack provider (#18501)
- sources/sync: configuration for outgoing sync trigger mode (#17669)
- sources/telegram: implement connecting existing user to a Telegram account (#18517)
- stages/captcha: Make stage more managed with provider-specific defaults (#16129)
- stages/captcha: allow dynamic public/private key (#18346)
- stages/identification: Add WebAuthn conditional UI (passkey autofill) support (#18377)
- stages/mtls: always include cert in flow plan (#18657)
- stages/prompt: fix choices with labels causing error on submit (#18183)
- stages/prompt: set allow_blank for \_read_only fields (#18297)
- stages/user_write: Fix user attributes are not sanitized under certain conditions (#17890)
- tasks/schedules: fix rel obj not being associated or updated (#17934)
- tasks: delay startup signals (#17769)
- tasks: sanitize log attributes (#17833)
- tenants: remove extra query for each request (#18705)
- translate: add cs_CZ (#17632)
- web/a11y: Isolated Outpost Error Page (#17683)
- web/a11y: Prefers more field contrast (#17279)
- web/a11y: Update wizard form labels, placeholders. (#17811)
- web/a11y: User library -- fix issues surrounding element focus, ARIA labeling. (#17522)
- web/admin: Add SAML metadata form to wizard (#17690)
- web/admin: add entitlement search (#18291)
- web/admin: change s to S in "Stage" (#18632)
- web/admin: fix brands default switch label (#18518)
- web/admin: fix event volume chart not updating with query (#18649)
- web/admin: fix scim provider form (#17831)
- web/admin: fix scim provider form (cherry-pick #17831 to version-2025.10) (#17834)
- web/admin: fix typo in PolicyAccessView (#18789)
- web/admin: fix wording in password stage (#18393)
- web/admin: fixes capitalization in application wizard title (#17959)
- web/admin: link to user on invitation list page (#18132)
- web/admin: link to user on invitation list page (cherry-pick #18132 to version-2025.10) (#18134)
- web/admin: make empty table message configurable (#18763)
- web/admin: update stage descriptions (#18118)
- web/elements: update AppIcon story with files change (#18608)
- web/flows: improvements for hCaptcha (#16882)
- web/flows: improvements for hCaptcha (cherry-pick #16882 to version-2025.10) (#18128)
- web/flows: update default background image (#18540)
- web/i18n: Clean up locale scripts (#18163)
- web/i18n: Japanese Locale（日本語ロケール） (#17938)
- web/i18n: Locale Context Merge Branch (#18426)
- web/i18n: Locale message fixes (#17913)
- web/i18n: Remove English Locale (#18164)
- web/integrations: add information for slo supported integrations (#17836)
- web/integrations: add slo supported integrations (#17810)
- web/sfe: downgrade bootstrap that was accidentally upgraded (#18157)
- web/sfe: downgrade bootstrap that was accidentally upgraded (cherry-pick #18157 to version-2025.10) (#18171)
- web/sources: Add promoted source (#18334)
- web: 2025.12 UI tidy (#18650)
- web: Abstract Wizard Lifecycle (#17658)
- web: Adjust colors (#18427)
- web: Codemirror fixes (#18610)
- web: Consistent Tab Panel URL Parameters (#17804)
- web: Disable library `<datalist>` on Firefox. (#18103)
- web: Fix RAC modal visibility. (#17941)
- web: Fix application of global styles in style roots. (#17444)
- web: Fix background refreshing too frequently. (#18764)
- web: Fix row expansion on modal trigger buttons. (#18412)
- web: Fix stale table rows (#17940)
- web: Fix switch labels (#18741)
- web: Fix tab activation, blank provider URLs (#18031)
- web: Fix table row click handler. (#17697)
- web: Hide avatars when set to "none" (#17911)
- web: Hide device picker when challenges are not present. (#18611)
- web: Improve user display in modals by falling back to username (#18243)
- web: Improved Timestamps (#18300)
- web: Improved table selection behavior (#18622)
- web: Lit Session Context (#17903)
- web: Locale selector (#18560)
- web: Make Spotlight optional. (#17904)
- web: Make action field search case insensitive in Event Matcher Policy Form (#17680)
- web: Patternfly 5 Prep: Part 2 (#18085)
- web: Prettier Config 3.2 (#18305)
- web: Render Markdown in Blueprints descriptions (#17746)
- web: Table row refinements (#17659)
- web: Update Deprecated NPM Packages (#18335)
- web: re-add en.xlf locale (#18469)
- web: sync web/package-lock.json (#17611)

## Fixed in 2025.12.1

- outposts/ldap: fix build by @BeryJu in https://github.com/goauthentik/authentik/pull/19403
- web/startup: deprecated theme names break theming (cherry-pick #19431 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19433
- ci: fix checkout stable (for 2025.12) (#19448) by @BeryJu in https://github.com/goauthentik/authentik/pull/19481
- providers/oauth2: allow property mappings to override scope claim in access tokens (cherry-pick #19226 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19480
- core: bump aiohttp from 3.13.2 to v3.13.3 (cherry-pick #19257 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19484
- endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (cherry-pick #19482 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19486
- website/docs: limiting permissions of AD service account (cherry-pick #19483 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19489
- endpoints/connectors/agent: add tests for IA endpoint stage (cherry-pick #19487 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19490
- web: Z-Index Fixes, Mobile Sidebar Behavior. (cherry-pick #19460 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19492
- web/admin: fix switches (cherry-pick #19493 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19496

## Fixed in 2025.12.2

- sources/kerberos: update to new python-kadmin-rs (cherry-pick #19491 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19523
- tests/e2e: Add delay and serialized rollback to saml e2e test (cherry-pick #18840 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19532
- admin/files: fix manageable check blocking file creation on fresh installs (cherry-pick #19547 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19553
- admin/files: fix duplicate bucket name in presigned URLs with custom domain (cherry-pick #19537 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19575
- core: Update supported versions in SECURITY.md (cherry-pick #19385 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19578
- web: update @goauthentik/api (cherry-pick #19542 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19589
- web/forms: fix invalid date error for empty datetime-local inputs (cherry-pick #19561 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19582
- endpoints: fix endpoints stage marked as enterprise (cherry-pick #19607 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19610
- policies: fix Providers authentication_flow not used when set (cherry-pick #19609 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19615
- providers/saml: fix structure of encrypted saml assertion (cherry-pick #19592 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19613
- providers/saml: allow encryption certificates without private keys (cherry-pick #19526 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19612
- sources/saml: Fix signature verification order to accommodate encrypted assertions (cherry-pick #19593 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19614
- tests: improve e2e/integration test reliability (cherry-pick #19540 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19611
- lib/sync/outgoing: handle deletions even if object does not exist in database (cherry-pick #18968 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19617
- web/user: fix Firefox for Android infinite render loop in user library (cherry-pick #19379 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19626
- web/maintenance: fix missing custom web component imports (cherry-pick #18942 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19636
- web/a11y: Locale selector select styles, contrast. (cherry-pick #19634 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19651
- web/maintenance: no unknown tag names (cherry-pick #18944 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19637
- providers/oauth2: add `logout+jwt` token type for oidc logout token. (cherry-pick #19554 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19675
- web/maintenance: no missing element type definitions (cherry-pick #18950 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19638
- web/maintenance/no unknown attributes (part 1) (cherry-pick #18970 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19639
- sources/saml: Set AuthnRequest ProtocolBinding to HTTP-POST instead of HTTP-Redirect (cherry-pick #17378 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19649
- web/forms: fix forms not resetting state when modal closes (cherry-pick #19562 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19635
- web/admin: fix brand form sending "undefined" string for blank default application (cherry-pick #19658 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19682
- internal: fix incorrect metric calculation (cherry-pick #19701 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19703
- sources/oauth: add fallback for id_token when profile URL is not available (cherry-pick #19311 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19704
- core: return bad request when user is authenticated and not active (cherry-pick #19706 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19710
- web/admin: fix impersonation form requesting data without being opened (cherry-pick #19673 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19712
- web/sfe: downgrade bootstrap, add access denied test (cherry-pick #19763 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19765
- root: update client-go generation (cherry-pick #19762 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19791
- web/elements: reduce spacing between collapsible form groups (cherry-pick #19627 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19640
- web/elements: stabilize dual-select status height (cherry-pick #19734 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19776
- providers/scim: fix email validation mismatch (cherry-pick #19848 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19853
- sources/saml: properly catch InvalidSignature exception (cherry-pick #19641 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19650
- sources/oauth: Fix an issue where wechat may crash during login. (cherry-pick #18973 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19854
- admin/files: add centralized theme variable support for file URLs (cherry-pick #19657 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19793
- web/table: align row action icons and tooltip color (cherry-pick #19736 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19773
- web/admin: fix file upload not preserving extension for custom names with dots (cherry-pick #19548 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19685
- web/admin: fix captcha stage provider selector not showing saved value (cherry-pick #19555 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19656
- web: Session UI Config Lifecycle (cherry-pick #19788 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19821
- web: Enforce `challenge` nullish types. (cherry-pick #19768 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19777

## Fixed in 2025.12.3

- 2025.12: Revert bulk revoke added by accident in release branch by @dominic-r in https://github.com/goauthentik/authentik/pull/19870
- web/admin: fix toggle-group for bindings now showing up (cherry-pick #19820 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19895
- web: fix Brand CSS not applied to nested Shadow DOM components (cherry-pick #19892 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19900
- ci: always generate API clients (#19906) by @BeryJu in https://github.com/goauthentik/authentik/pull/19932
- lifecycle/ak: make sure /data has the correct permissions (cherry-pick #19935 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19940
- lifecycle/aws: add /data volume (cherry-pick #19936 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19938
- core: fix non-expiring service accounts and app passwords (cherry-pick #19913 to version-2025.12) by @authentik-automation[bot] in https://github.com/goauthentik/authentik/pull/19941

## Fixed in 2025.12.4

- core: bump django from 5.2.10 to 5.2.11 (cherry-pick #19988 to version-2025.12) (#19992)
- outpost/proxyv2: revalidate auth if session fails to load (cherry-pick #18063 to version-2025.12) (#20059)
- outposts: fix docker_tls created files permission (cherry-pick #19978 to version-2025.12) (#19993)
- providers/oauth2: use compare_digest for client_secret comparison (cherry-pick #19979 to version-2025.12) (#19987)
- recovery: consume token in transaction (cherry-pick #19967 to version-2025.12) (#19986)
- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227) (#20230)
- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748) (#20231)
- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922) (#20232)
- sources/oauth: Fix InvalidAudienceError in id_token fallback (cherry-pick #20096 to version-2025.12) (#20122)
- web/admin: fix default binding order (cherry-pick #19943 to version-2025.12) (#19945)

## Fixed in 2025.12.5

- core: bump cbor2 from 5.8.0 to 5.9.0 (cherry-pick #21094 to version-2025.12) (#21095)
- core: bump django from 5.2.11 to 5.2.12 (cherry-pick #20719 to version-2025.12) (#20737)
- core: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2025.12) (#21525)
- docs: Add note on skipping object syncing (cherry-pick #20882 to version-2025.12) (#20893)
- endpoints: fix infinite recursion in stage with unsupported connector (cherry-pick #20485 to version-2025.12) (#20513)
- enterprise: add `ES384` to enterprise license algorithms (cherry-pick #20507 to version-2025.12) (#20509)
- events: avoid implicitly setting context from login_failed event (cherry-pick #21045 to version-2025.12) (#21049)
- flows: continuous login debug 2025.12 (#21044)
- security: [CVE-2026-40165](../../security/cves/CVE-2026-40165) (#22275)
- security: [CVE-2026-40166](../../security/cves/CVE-2026-40166) (#22276)
- security: [CVE-2026-40172](https://github.com/goauthentik/authentik/security/advisories/GHSA-h6x7-hjjc-wjc9) (#22277)
- security: [CVE-2026-41577](https://github.com/goauthentik/authentik/security/advisories/GHSA-4v4x-x5pr-8gp2) (#22278)
- security: [CVE-2026-42849](../../security/cves/CVE-2026-42849) (#22279)
- internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2025.12 (#22280)
- internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2025.12 (#22281)
- internal: fix lint (cherry-pick #22263 to version-2025.12) (#22306)
- internal: make http timeouts configurable (cherry-pick #20472 to version-2025.12) (#20566)
- policies: fix PolicyEngineMode ALL with static binding optimization (cherry-pick #20430 to version-2025.12) (#20523)
- policies: measure policy process from manager (cherry-pick #20477 to version-2025.12) (#20480)
- providers/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2025.12) (#21747)
- providers/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2025.12) (#21798)
- providers/oauth2: deactivate locale after testing (cherry-pick #20518 to version-2025.12) (#20525)
- providers/oauth2: device code flow client id via auth header (cherry-pick #20457 to version-2025.12) (#21803)
- providers/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2025.12) (#21749)
- providers/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2025.12) (#20692)
- providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12) (#21827)
- providers/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12) (#21283)
- proviers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2025.12) (#21227)
- root: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12) (#20320)
- root: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12) (#21354)
- root: update django to 5.2.14 (cherry-pick #22064 to version-2025.12) (#22065)
- sources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2025.12) (#21220)
- sources/saml: update handling statusmessage (cherry-pick #19739 to version-2025.12) (#20066)
- stages/user_login: log correct user when session binding is broken (cherry-pick #20094 to version-2025.12) (#20452)
- web: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2025.12) (#21472)
- web: Fix locale selector in compatibility mode. (cherry-pick #19946 to version-2025.12) (#20088)
- web: re-update package-lock.json to include missing tree-sitter references
- web/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2025.12) (#20989)
- web/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2025.12) (#20928)
- web/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2025.12) (#21051)
- web/flows: add continuous flow 2025.12 (#20362)
- web/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2025.12) (#21626)
- web/packages: Rework SFE rendering (cherry-pick #21833 to version-2025.12) (#21851)
- web/sfe: bug: polyfill needed to supply Object.assign() to IE11. (cherry-pick #20126 to version-2025.12) (#20136)

## Fixed in 2025.12.6

- outposts: fix stale version in OutpostState (cherry-pick #22487 to version-2025.12) (#22503)
- security: CVE-2026-47201
- security: GHSA-wr38-7xg8-fqxr
- security: GHSA-xp7f-xjjx-gwm8

## API Changes

### authentik (v 2025.12.0-rc1)

---

#### What's New

---

##### `GET` /admin/file/

##### `POST` /admin/file/

##### `DELETE` /admin/file/

##### `GET` /admin/file/used_by/

##### `POST` /core/users/export/

##### `GET` /endpoints/agents/connectors/

##### `POST` /endpoints/agents/connectors/

##### `GET` /endpoints/agents/connectors/{#123;connector_uuid}#125;/

##### `PUT` /endpoints/agents/connectors/{#123;connector_uuid}#125;/

##### `DELETE` /endpoints/agents/connectors/{#123;connector_uuid}#125;/

##### `PATCH` /endpoints/agents/connectors/{#123;connector_uuid}#125;/

##### `POST` /endpoints/agents/connectors/{#123;connector_uuid}#125;/mdm_config/

##### `GET` /endpoints/agents/connectors/{#123;connector_uuid}#125;/used_by/

##### `GET` /endpoints/agents/connectors/agent_config/

##### `POST` /endpoints/agents/connectors/auth_fed/

##### `POST` /endpoints/agents/connectors/auth_ia/

##### `POST` /endpoints/agents/connectors/check_in/

##### `POST` /endpoints/agents/connectors/enroll/

##### `GET` /endpoints/agents/enrollment_tokens/

##### `POST` /endpoints/agents/enrollment_tokens/

##### `GET` /endpoints/agents/enrollment_tokens/{#123;token_uuid}#125;/

##### `PUT` /endpoints/agents/enrollment_tokens/{#123;token_uuid}#125;/

##### `DELETE` /endpoints/agents/enrollment_tokens/{#123;token_uuid}#125;/

##### `PATCH` /endpoints/agents/enrollment_tokens/{#123;token_uuid}#125;/

##### `GET` /endpoints/agents/enrollment_tokens/{#123;token_uuid}#125;/used_by/

##### `GET` /endpoints/agents/enrollment_tokens/{#123;token_uuid}#125;/view_key/

##### `POST` /endpoints/agents/psso/register/device/

##### `POST` /endpoints/agents/psso/register/user/

##### `GET` /endpoints/connectors/

##### `GET` /endpoints/connectors/{#123;connector_uuid}#125;/

##### `DELETE` /endpoints/connectors/{#123;connector_uuid}#125;/

##### `GET` /endpoints/connectors/{#123;connector_uuid}#125;/used_by/

##### `GET` /endpoints/connectors/types/

##### `GET` /endpoints/device_access_groups/

##### `POST` /endpoints/device_access_groups/

##### `GET` /endpoints/device_access_groups/{#123;pbm_uuid}#125;/

##### `PUT` /endpoints/device_access_groups/{#123;pbm_uuid}#125;/

##### `DELETE` /endpoints/device_access_groups/{#123;pbm_uuid}#125;/

##### `PATCH` /endpoints/device_access_groups/{#123;pbm_uuid}#125;/

##### `GET` /endpoints/device_access_groups/{#123;pbm_uuid}#125;/used_by/

##### `GET` /endpoints/device_bindings/

##### `POST` /endpoints/device_bindings/

##### `GET` /endpoints/device_bindings/{#123;policy_binding_uuid}#125;/

##### `PUT` /endpoints/device_bindings/{#123;policy_binding_uuid}#125;/

##### `DELETE` /endpoints/device_bindings/{#123;policy_binding_uuid}#125;/

##### `PATCH` /endpoints/device_bindings/{#123;policy_binding_uuid}#125;/

##### `GET` /endpoints/device_bindings/{#123;policy_binding_uuid}#125;/used_by/

##### `GET` /endpoints/devices/

##### `GET` /endpoints/devices/{#123;device_uuid}#125;/

##### `PUT` /endpoints/devices/{#123;device_uuid}#125;/

##### `DELETE` /endpoints/devices/{#123;device_uuid}#125;/

##### `PATCH` /endpoints/devices/{#123;device_uuid}#125;/

##### `GET` /endpoints/devices/{#123;device_uuid}#125;/used_by/

##### `GET` /endpoints/devices/summary/

##### `POST` /events/events/export/

##### `POST` /rbac/roles/{#123;uuid}#125;/add_user/

##### `POST` /rbac/roles/{#123;uuid}#125;/remove_user/

##### `GET` /reports/exports/

##### `GET` /reports/exports/{#123;id}#125;/

##### `DELETE` /reports/exports/{#123;id}#125;/

##### `POST` /sources/telegram/{#123;slug}#125;/connect_user/

##### `GET` /stages/endpoints/

##### `POST` /stages/endpoints/

##### `GET` /stages/endpoints/{#123;stage_uuid}#125;/

##### `PUT` /stages/endpoints/{#123;stage_uuid}#125;/

##### `DELETE` /stages/endpoints/{#123;stage_uuid}#125;/

##### `PATCH` /stages/endpoints/{#123;stage_uuid}#125;/

##### `GET` /stages/endpoints/{#123;stage_uuid}#125;/used_by/

#### What's Deleted

---

##### `POST` /core/applications/{#123;slug}#125;/set_icon/

##### `POST` /core/applications/{#123;slug}#125;/set_icon_url/

##### `POST` /flows/instances/{#123;slug}#125;/set_background/

##### `POST` /flows/instances/{#123;slug}#125;/set_background_url/

##### `GET` /rbac/permissions/assigned_by_users/

##### `POST` /rbac/permissions/assigned_by_users/{#123;id}#125;/assign/

##### `PATCH` /rbac/permissions/assigned_by_users/{#123;id}#125;/unassign/

##### `GET` /rbac/permissions/roles/{#123;id}#125;/

##### `PUT` /rbac/permissions/roles/{#123;id}#125;/

##### `DELETE` /rbac/permissions/roles/{#123;id}#125;/

##### `PATCH` /rbac/permissions/roles/{#123;id}#125;/

##### `GET` /rbac/permissions/users/

##### `GET` /rbac/permissions/users/{#123;id}#125;/

##### `PUT` /rbac/permissions/users/{#123;id}#125;/

##### `DELETE` /rbac/permissions/users/{#123;id}#125;/

##### `PATCH` /rbac/permissions/users/{#123;id}#125;/

##### `POST` /sources/all/{#123;slug}#125;/set_icon/

##### `POST` /sources/all/{#123;slug}#125;/set_icon_url/

#### What's Changed

---

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `pagination_default_page_size` (integer)

        > Default page size for API responses, if no size was requested.

    - Added property `pagination_max_page_size` (integer)

        > Maximum page size

    - Changed property `flags` (object)

        New required properties:
        - `flows_refresh_others`
        * Added property `flows_refresh_others` (boolean)

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `pagination_default_page_size` (integer)

    > Default page size for API responses, if no size was requested.

- Added property `pagination_max_page_size` (integer)

    > Maximum page size

- Changed property `flags` (object)

    New required properties:
    - `flows_refresh_others`
    * Added property `flows_refresh_others` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `pagination_default_page_size` (integer)

        > Default page size for API responses, if no size was requested.

    - Added property `pagination_max_page_size` (integer)

        > Maximum page size

    - Changed property `flags` (object)

        New required properties:
        - `flows_refresh_others`
        * Added property `flows_refresh_others` (boolean)

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `pagination_default_page_size` (integer)

    > Default page size for API responses, if no size was requested.

- Added property `pagination_max_page_size` (integer)

    > Maximum page size

- Changed property `flags` (object)

    New required properties:
    - `flows_refresh_others`
    * Added property `flows_refresh_others` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `pagination_default_page_size` (integer)

        > Default page size for API responses, if no size was requested.

    - Added property `pagination_max_page_size` (integer)

        > Maximum page size

    - Changed property `flags` (object)

        New required properties:
        - `flows_refresh_others`
        * Added property `flows_refresh_others` (boolean)

##### `POST` /core/tokens/{#123;identifier}#125;/set_key/

###### Request:

Changed content type : `application/json`

##### `GET` /crypto/certificatekeypairs/{#123;kp_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `key_type`

    New optional properties:
    - `private_key_type`
    * Added property `key_type` (object)

        Enum values:
        - `rsa`
        - `ec`
        - `dsa`
        - `ed25519`
        - `ed448`

    * Deleted property `private_key_type` (string)
        > Get the private key's type, if set

##### `PUT` /crypto/certificatekeypairs/{#123;kp_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `key_type`

    New optional properties:
    - `private_key_type`
    * Added property `key_type` (object)

    * Deleted property `private_key_type` (string)
        > Get the private key's type, if set

##### `PATCH` /crypto/certificatekeypairs/{#123;kp_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `key_type`

    New optional properties:
    - `private_key_type`
    * Added property `key_type` (object)

    * Deleted property `private_key_type` (string)
        > Get the private key's type, if set

##### `POST` /crypto/certificatekeypairs/generate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `key_type`

    New optional properties:
    - `private_key_type`
    * Added property `key_type` (object)

    * Deleted property `private_key_type` (string)
        > Get the private key's type, if set

##### `GET` /events/events/actions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /outposts/service_connections/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /policies/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /policies/bindings/{#123;policy_binding_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `PUT` /policies/bindings/{#123;policy_binding_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `PATCH` /policies/bindings/{#123;policy_binding_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /policies/event_matcher/{#123;policy_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum value:
        - `export_ready`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.endpoints`
        - `authentik.endpoints.connectors.agent`
        - `authentik.admin.files`
        - `authentik.enterprise.endpoints.connectors.agent`
        - `authentik.enterprise.reports`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints.deviceuserbinding`
        - `authentik_endpoints.deviceaccessgroup`
        - `authentik_endpoints.endpointstage`
        - `authentik_endpoints_connectors_agent.agentconnector`
        - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
        - `authentik_endpoints_connectors_agent.enrollmenttoken`
        - `authentik_reports.dataexport`

##### `PUT` /policies/event_matcher/{#123;policy_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum value:
    - `export_ready`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.endpoints`
    - `authentik.endpoints.connectors.agent`
    - `authentik.admin.files`
    - `authentik.enterprise.endpoints.connectors.agent`
    - `authentik.enterprise.reports`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints.deviceuserbinding`
    - `authentik_endpoints.deviceaccessgroup`
    - `authentik_endpoints.endpointstage`
    - `authentik_endpoints_connectors_agent.agentconnector`
    - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
    - `authentik_endpoints_connectors_agent.enrollmenttoken`
    - `authentik_reports.dataexport`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum value:
        - `export_ready`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.endpoints`
        - `authentik.endpoints.connectors.agent`
        - `authentik.admin.files`
        - `authentik.enterprise.endpoints.connectors.agent`
        - `authentik.enterprise.reports`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints.deviceuserbinding`
        - `authentik_endpoints.deviceaccessgroup`
        - `authentik_endpoints.endpointstage`
        - `authentik_endpoints_connectors_agent.agentconnector`
        - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
        - `authentik_endpoints_connectors_agent.enrollmenttoken`
        - `authentik_reports.dataexport`

##### `PATCH` /policies/event_matcher/{#123;policy_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum value:
    - `export_ready`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.endpoints`
    - `authentik.endpoints.connectors.agent`
    - `authentik.admin.files`
    - `authentik.enterprise.endpoints.connectors.agent`
    - `authentik.enterprise.reports`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints.deviceuserbinding`
    - `authentik_endpoints.deviceaccessgroup`
    - `authentik_endpoints.endpointstage`
    - `authentik_endpoints_connectors_agent.agentconnector`
    - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
    - `authentik_endpoints_connectors_agent.enrollmenttoken`
    - `authentik_reports.dataexport`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum value:
        - `export_ready`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.endpoints`
        - `authentik.endpoints.connectors.agent`
        - `authentik.admin.files`
        - `authentik.enterprise.endpoints.connectors.agent`
        - `authentik.enterprise.reports`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints.deviceuserbinding`
        - `authentik_endpoints.deviceaccessgroup`
        - `authentik_endpoints.endpointstage`
        - `authentik_endpoints_connectors_agent.agentconnector`
        - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
        - `authentik_endpoints_connectors_agent.enrollmenttoken`
        - `authentik_reports.dataexport`

##### `GET` /propertymappings/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /providers/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /providers/google_workspace_groups/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /providers/microsoft_entra_groups/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `POST` /providers/saml/import_metadata/

###### Return Type:

New response : **201 Created**
Deleted response : **204 No Content**

> Successfully imported provider

##### `GET` /providers/scim_groups/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /sources/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /sources/scim_groups/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `PUT` /sources/scim_groups/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `PATCH` /sources/scim_groups/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /stages/all/types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /stages/email/templates/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Types of an object that can be created
    - Added property `deprecated` (boolean)

##### `GET` /authenticators/duo/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /authenticators/email/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /authenticators/endpoint/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /authenticators/sms/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /authenticators/static/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /authenticators/totp/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /authenticators/webauthn/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/application_entitlements/{#123;pbm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/applications/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `meta_icon_url`

    New optional properties:
    - `meta_icon`
    * Added property `meta_icon_url` (string)

        > Get the URL to the App Icon image

    * Changed property `slug` (string)

        > Internal application name, used in URLs.

    * Changed property `meta_icon` (string)

##### `PUT` /core/applications/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `meta_icon` (string)

- Changed property `slug` (string)
    > Internal application name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `meta_icon_url`

    New optional properties:
    - `meta_icon`
    * Added property `meta_icon_url` (string)

        > Get the URL to the App Icon image

    * Changed property `slug` (string)

        > Internal application name, used in URLs.

    * Changed property `meta_icon` (string)

##### `PATCH` /core/applications/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `meta_icon` (string)

- Changed property `slug` (string)
    > Internal application name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `meta_icon_url`

    New optional properties:
    - `meta_icon`
    * Added property `meta_icon_url` (string)

        > Get the URL to the App Icon image

    * Changed property `slug` (string)

        > Internal application name, used in URLs.

    * Changed property `meta_icon` (string)

##### `GET` /core/applications/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/authenticated_sessions/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/brands/{#123;brand_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `flows_refresh_others`
        * Added property `flows_refresh_others` (boolean)

##### `GET` /core/groups/{#123;group_uuid}#125;/

###### Parameters:

Added: `include_parents` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `children`
    - `parents_obj`

    New optional properties:
    - `parent_name`
    * Added property `parents` (array)

        Items (string):

    * Added property `parents_obj` (array)

        Items (object): > Stripped down group serializer to show relevant children/parents for groups
        - Property `pk` (string)

        - Property `name` (string)

        - Property `is_superuser` (boolean)

            > Users added to this group will be superusers.

        - Property `attributes` (object)

        - Property `group_uuid` (string)

    * Deleted property `parent` (string)

    * Deleted property `parent_name` (string)

    * Changed property `children` (array)

    * Changed property `children_obj` (array)

        Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `PUT` /core/groups/{#123;group_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Added property `parents` (array)

- Deleted property `parent` (string)

- Deleted property `children` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `children`
    - `parents_obj`

    New optional properties:
    - `parent_name`
    * Added property `parents` (array)

    * Added property `parents_obj` (array)

    * Deleted property `parent` (string)

    * Deleted property `parent_name` (string)

    * Changed property `children` (array)

    * Changed property `children_obj` (array)

        Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `PATCH` /core/groups/{#123;group_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Added property `parents` (array)

- Deleted property `parent` (string)

- Deleted property `children` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `children`
    - `parents_obj`

    New optional properties:
    - `parent_name`
    * Added property `parents` (array)

    * Added property `parents_obj` (array)

    * Deleted property `parent` (string)

    * Deleted property `parent_name` (string)

    * Changed property `children` (array)

    * Changed property `children_obj` (array)

        Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `GET` /core/groups/{#123;group_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/tokens/{#123;identifier}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

            Items (object): > Role serializer
            - Property `pk` (string)

            - Property `name` (string)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `PUT` /core/tokens/{#123;identifier}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `PATCH` /core/tokens/{#123;identifier}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /core/tokens/{#123;identifier}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/user_consent/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /core/users/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `roles_obj`
    * Added property `roles` (array)

    * Added property `roles_obj` (array)

    * Changed property `groups_obj` (array)

        Changed items (object): > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `PUT` /core/users/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `roles` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `roles_obj`
    * Added property `roles` (array)

    * Added property `roles_obj` (array)

    * Changed property `groups_obj` (array)

        Changed items (object): > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `PATCH` /core/users/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `roles` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `roles_obj`
    * Added property `roles` (array)

    * Added property `roles_obj` (array)

    * Changed property `groups_obj` (array)

        Changed items (object): > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /core/users/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /crypto/certificatekeypairs/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `key_type`

    New optional properties:
    - `private_key_type`
    * Added property `key_type` (object)

    * Deleted property `private_key_type` (string)
        > Get the private key's type, if set

##### `GET` /crypto/certificatekeypairs/

###### Parameters:

Added: `key_type` in `query`

> Filter by key algorithm type (RSA, EC, DSA, etc). Can be specified multiple times (e.g. '?key_type=rsa&key_type=ec')

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > CertificateKeyPair Serializer

        New required properties:
        - `key_type`

        New optional properties:
        - `private_key_type`
        * Added property `key_type` (object)

        * Deleted property `private_key_type` (string)
            > Get the private key's type, if set

##### `GET` /crypto/certificatekeypairs/{#123;kp_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /enterprise/license/{#123;license_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /events/events/{#123;event_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

##### `PUT` /events/events/{#123;event_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    Added enum value:
    - `export_ready`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

##### `PATCH` /events/events/{#123;event_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    Added enum value:
    - `export_ready`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

##### `GET` /events/events/volume/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Count of events of action created on day
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

##### `GET` /events/notifications/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /events/rules/{#123;pbm_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer

        New required properties:
        - `children`
        - `parents_obj`

        New optional properties:
        - `parent_name`
        * Added property `parents` (array)

        * Added property `parents_obj` (array)

        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

        * Changed property `children` (array)

        * Changed property `children_obj` (array)

            Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `PUT` /events/rules/{#123;pbm_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer

        New required properties:
        - `children`
        - `parents_obj`

        New optional properties:
        - `parent_name`
        * Added property `parents` (array)

        * Added property `parents_obj` (array)

        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

        * Changed property `children` (array)

        * Changed property `children_obj` (array)

            Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `PATCH` /events/rules/{#123;pbm_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer

        New required properties:
        - `children`
        - `parents_obj`

        New optional properties:
        - `parent_name`
        * Added property `parents` (array)

        * Added property `parents_obj` (array)

        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

        * Changed property `children` (array)

        * Changed property `children_obj` (array)

            Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `GET` /events/rules/{#123;pbm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /events/transports/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /flows/bindings/{#123;fsb_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /flows/instances/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `background_url`

    New optional properties:
    - `background`
    * Added property `background_url` (string)

        > Get the URL to the background image

    * Changed property `slug` (string)

        > Visible in the URL.

    * Changed property `background` (string)
        > Background shown during execution

##### `PUT` /flows/instances/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `background` (string)

    > Background shown during execution

- Changed property `slug` (string)
    > Visible in the URL.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `background_url`

    New optional properties:
    - `background`
    * Added property `background_url` (string)

        > Get the URL to the background image

    * Changed property `slug` (string)

        > Visible in the URL.

    * Changed property `background` (string)
        > Background shown during execution

##### `PATCH` /flows/instances/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `background` (string)

    > Background shown during execution

- Changed property `slug` (string)
    > Visible in the URL.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `background_url`

    New optional properties:
    - `background`
    * Added property `background_url` (string)

        > Get the URL to the background image

    * Changed property `slug` (string)

        > Visible in the URL.

    * Changed property `background` (string)
        > Background shown during execution

##### `GET` /flows/instances/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /managed/blueprints/{#123;instance_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /oauth2/access_tokens/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /oauth2/authorization_codes/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /oauth2/refresh_tokens/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /outposts/instances/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /outposts/service_connections/all/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /outposts/service_connections/docker/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /outposts/service_connections/kubernetes/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/all/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PolicyBinding Serializer
        - Changed property `group_obj` (object)

            > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /policies/bindings/{#123;policy_binding_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/dummy/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum value:
    - `export_ready`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.endpoints`
    - `authentik.endpoints.connectors.agent`
    - `authentik.admin.files`
    - `authentik.enterprise.endpoints.connectors.agent`
    - `authentik.enterprise.reports`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints.deviceuserbinding`
    - `authentik_endpoints.deviceaccessgroup`
    - `authentik_endpoints.endpointstage`
    - `authentik_endpoints_connectors_agent.agentconnector`
    - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
    - `authentik_endpoints_connectors_agent.enrollmenttoken`
    - `authentik_reports.dataexport`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum value:
        - `export_ready`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.endpoints`
        - `authentik.endpoints.connectors.agent`
        - `authentik.admin.files`
        - `authentik.enterprise.endpoints.connectors.agent`
        - `authentik.enterprise.reports`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints.deviceuserbinding`
        - `authentik_endpoints.deviceaccessgroup`
        - `authentik_endpoints.endpointstage`
        - `authentik_endpoints_connectors_agent.agentconnector`
        - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
        - `authentik_endpoints_connectors_agent.enrollmenttoken`
        - `authentik_reports.dataexport`

##### `GET` /policies/event_matcher/

###### Parameters:

Changed: `action` in `query`

> Match created events with this action type. When left empty, all action types will be matched.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Changed property `action` (string)

            > Match created events with this action type. When left empty, all action types will be matched.

            Added enum value:
            - `export_ready`

        - Changed property `app` (string)

            > Match events created by selected application. When left empty, all applications are matched.

            Added enum values:
            - `authentik.endpoints`
            - `authentik.endpoints.connectors.agent`
            - `authentik.admin.files`
            - `authentik.enterprise.endpoints.connectors.agent`
            - `authentik.enterprise.reports`

        - Changed property `model` (string)

            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

            Added enum values:
            - `authentik_endpoints.deviceuserbinding`
            - `authentik_endpoints.deviceaccessgroup`
            - `authentik_endpoints.endpointstage`
            - `authentik_endpoints_connectors_agent.agentconnector`
            - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
            - `authentik_endpoints_connectors_agent.enrollmenttoken`
            - `authentik_reports.dataexport`

##### `GET` /policies/event_matcher/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/expression/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/geoip/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/password/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/password_expiry/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/reputation/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/reputation/scores/{#123;reputation_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /policies/unique_password/{#123;policy_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/all/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/notification/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/google_workspace/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/microsoft_entra/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/rac/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/radius/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/saml/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/scim/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/provider/scope/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/kerberos/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/ldap/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/oauth/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/plex/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/saml/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/scim/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /propertymappings/source/telegram/{#123;pm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/all/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/google_workspace/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `PUT` /providers/google_workspace/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `PATCH` /providers/google_workspace/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /providers/google_workspace/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /providers/google_workspace_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /providers/google_workspace_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > GoogleWorkspaceProviderGroup Serializer
        - Changed property `group_obj` (object)

            > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /providers/google_workspace_groups/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/google_workspace_users/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/ldap/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/microsoft_entra/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `PUT` /providers/microsoft_entra/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `PATCH` /providers/microsoft_entra/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /providers/microsoft_entra/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /providers/microsoft_entra_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /providers/microsoft_entra_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > MicrosoftEntraProviderGroup Serializer
        - Changed property `group_obj` (object)

            > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /providers/microsoft_entra_groups/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/microsoft_entra_users/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/oauth2/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/proxy/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/rac/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/radius/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/saml/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/scim/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `service_provider_config_cache_timeout` (string)

        > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `PUT` /providers/scim/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `service_provider_config_cache_timeout` (string)

    > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `service_provider_config_cache_timeout` (string)

        > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `PATCH` /providers/scim/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Added property `service_provider_config_cache_timeout` (string)

    > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `service_provider_config_cache_timeout` (string)

        > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /providers/scim/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /providers/scim_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /providers/scim_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProviderGroup Serializer
        - Changed property `group_obj` (object)

            > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /providers/scim_groups/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/scim_users/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /providers/ssf/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `PUT` /providers/ssf/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `PATCH` /providers/ssf/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /providers/ssf/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /rac/connection_tokens/{#123;connection_token_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /rac/endpoints/{#123;pbm_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /rbac/initial_permissions/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `mode`
    * Deleted property `mode` (object)

##### `PUT` /rbac/initial_permissions/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

New optional properties:

- `mode`

* Deleted property `mode` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `mode`
    * Deleted property `mode` (object)

##### `PATCH` /rbac/initial_permissions/{#123;id}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `mode` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New optional properties:
    - `mode`
    * Deleted property `mode` (object)

##### `GET` /rbac/initial_permissions/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /rbac/permissions/assigned_by_roles/

###### Parameters:

Changed: `model` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Roles assigned object permission serializer

        New required properties:
        - `model_permissions`
        - `object_permissions`

        New optional properties:
        - `permissions`
        * Added property `object_permissions` (array)

            Items (object): > Role-bound object level permission
            - Property `id` (integer)

            - Property `codename` (string)

            - Property `model` (string)

            - Property `app_label` (string)

            - Property `object_pk` (string)

            - Property `name` (string)

        * Added property `model_permissions` (array)

            Items (object): > Role-bound object level permission
            - Property `id` (integer)

            - Property `codename` (string)

            - Property `model` (string)

            - Property `app_label` (string)

            - Property `name` (string)

        * Deleted property `permissions` (array)

##### `POST` /rbac/permissions/assigned_by_roles/{#123;uuid}#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_endpoints.deviceuserbinding`
    - `authentik_endpoints.deviceaccessgroup`
    - `authentik_endpoints.endpointstage`
    - `authentik_endpoints_connectors_agent.agentconnector`
    - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
    - `authentik_endpoints_connectors_agent.enrollmenttoken`
    - `authentik_reports.dataexport`

##### `PATCH` /rbac/permissions/assigned_by_roles/{#123;uuid}#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_endpoints.deviceuserbinding`
    - `authentik_endpoints.deviceaccessgroup`
    - `authentik_endpoints.endpointstage`
    - `authentik_endpoints_connectors_agent.agentconnector`
    - `authentik_endpoints_connectors_agent.agentdeviceuserbinding`
    - `authentik_endpoints_connectors_agent.enrollmenttoken`
    - `authentik_reports.dataexport`

##### `GET` /rbac/permissions/roles/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Role permission with additional object-related data
        - Changed property `object_description` (string)
            > Get model description from attached model. This operation takes at least
            > one additional query, and the description is only shown if the role has the
            > view\_ permission on the object

##### `GET` /rbac/roles/

###### Parameters:

Added: `managed` in `query`

Added: `managed__isnull` in `query`

Added: `users` in `query`

##### `GET` /rbac/roles/{#123;uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/all/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

        > Get the URL to the source icon

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/all/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/all/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/all/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/all/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/all/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/kerberos/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/kerberos/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/kerberos/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/kerberos/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/ldap/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/ldap/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/ldap/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/ldap/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/oauth/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/oauth/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/oauth/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/oauth/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/plex/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/plex/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/plex/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/plex/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/saml/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/saml/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/saml/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/saml/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/group_connections/telegram/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/group_connections/telegram/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/group_connections/telegram/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/telegram/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/kerberos/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

        Enum values:
        - `none`
        - `immediate`
        - `deferred_end`

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PUT` /sources/kerberos/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Added property `sync_outgoing_trigger_mode` (object)

    > When to trigger sync for outgoing providers

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PATCH` /sources/kerberos/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Added property `sync_outgoing_trigger_mode` (object)

    > When to trigger sync for outgoing providers

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/kerberos/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/ldap/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PUT` /sources/ldap/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Added property `sync_outgoing_trigger_mode` (object)

    > When to trigger sync for outgoing providers

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PATCH` /sources/ldap/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Added property `sync_outgoing_trigger_mode` (object)

    > When to trigger sync for outgoing providers

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/ldap/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/oauth/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

    * Changed property `provider_type` (string)

        Added enum values:
        - `slack`
        - `wechat`

##### `PUT` /sources/oauth/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)

    > Internal source name, used in URLs.

- Changed property `provider_type` (string)

    Added enum values:
    - `slack`
    - `wechat`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

    * Changed property `provider_type` (string)

        Added enum values:
        - `slack`
        - `wechat`

##### `PATCH` /sources/oauth/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)

    > Internal source name, used in URLs.

- Changed property `provider_type` (string)

    Added enum values:
    - `slack`
    - `wechat`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

    * Changed property `provider_type` (string)

        Added enum values:
        - `slack`
        - `wechat`

##### `GET` /sources/oauth/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/plex/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PUT` /sources/plex/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PATCH` /sources/plex/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/plex/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/saml/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PUT` /sources/saml/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PATCH` /sources/saml/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/saml/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/scim/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `slug` (string)

        > Internal source name, used in URLs.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `PUT` /sources/scim/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `slug` (string)

        > Internal source name, used in URLs.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `PATCH` /sources/scim/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `slug` (string)

        > Internal source name, used in URLs.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /sources/scim/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /sources/scim_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `group_obj` (object)

        > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /sources/scim_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMSourceGroup Serializer
        - Changed property `group_obj` (object)

            > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /sources/scim_groups/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/scim_users/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/telegram/{#123;slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PUT` /sources/telegram/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `PATCH` /sources/telegram/{#123;slug}#125;/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/telegram/{#123;slug}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/all/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/all/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/all/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/all/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/kerberos/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/kerberos/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/kerberos/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/kerberos/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/ldap/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/ldap/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/ldap/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/ldap/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/oauth/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/oauth/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/oauth/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/oauth/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/plex/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/plex/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/plex/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/plex/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/saml/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/saml/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/saml/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/saml/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /sources/user_connections/telegram/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PUT` /sources/user_connections/telegram/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `PATCH` /sources/user_connections/telegram/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/telegram/{#123;id}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /ssf/streams/{#123;uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider_obj` (object)

        > SSFProvider Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer

                New required properties:
                - `roles_obj`
                * Added property `roles` (array)

                * Added property `roles_obj` (array)

                * Changed property `groups_obj` (array)

                    Changed items (object): > Partial Group Serializer, does not include child relations.

                    New optional properties:
                    - `parent_name`
                    * Deleted property `parent` (string)

                    * Deleted property `parent_name` (string)

##### `GET` /stages/all/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/duo/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/email/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/endpoint_gdtc/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/sms/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/static/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/totp/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/validate/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/authenticator/webauthn/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/captcha/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/consent/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/deny/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/dummy/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/email/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/identification/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/invitation/invitations/{#123;invite_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

    - Changed property `flow_obj` (object)

        > Flow Serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Changed property `slug` (string)

            > Visible in the URL.

        * Changed property `background` (string)
            > Background shown during execution

##### `PUT` /stages/invitation/invitations/{#123;invite_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

    - Changed property `flow_obj` (object)

        > Flow Serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Changed property `slug` (string)

            > Visible in the URL.

        * Changed property `background` (string)
            > Background shown during execution

##### `PATCH` /stages/invitation/invitations/{#123;invite_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

    - Changed property `flow_obj` (object)

        > Flow Serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Changed property `slug` (string)

            > Visible in the URL.

        * Changed property `background` (string)
            > Background shown during execution

##### `GET` /stages/invitation/invitations/{#123;invite_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/invitation/stages/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/mtls/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/password/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/prompt/prompts/{#123;prompt_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/prompt/stages/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/redirect/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/source/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/user_delete/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/user_login/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/user_logout/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `GET` /stages/user_write/{#123;stage_uuid}#125;/used_by/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > A list of all objects referencing the queried object
    - Changed property `action` (string)

        Added enum value:
        - `left_dangling`

##### `POST` /core/applications/

###### Request:

Changed content type : `application/json`

- Added property `meta_icon` (string)

- Changed property `slug` (string)
    > Internal application name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `meta_icon_url`

    New optional properties:
    - `meta_icon`
    * Added property `meta_icon_url` (string)

        > Get the URL to the App Icon image

    * Changed property `slug` (string)

        > Internal application name, used in URLs.

    * Changed property `meta_icon` (string)

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Application Serializer

        New required properties:
        - `meta_icon_url`

        New optional properties:
        - `meta_icon`
        * Added property `meta_icon_url` (string)

            > Get the URL to the App Icon image

        * Changed property `slug` (string)

            > Internal application name, used in URLs.

        * Changed property `meta_icon` (string)

##### `POST` /core/groups/

###### Request:

Changed content type : `application/json`

- Added property `parents` (array)

- Deleted property `parent` (string)

- Deleted property `children` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `children`
    - `parents_obj`

    New optional properties:
    - `parent_name`
    * Added property `parents` (array)

    * Added property `parents_obj` (array)

    * Deleted property `parent` (string)

    * Deleted property `parent_name` (string)

    * Changed property `children` (array)

    * Changed property `children_obj` (array)

        Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `GET` /core/groups/

###### Parameters:

Added: `include_parents` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Serializer

        New required properties:
        - `children`
        - `parents_obj`

        New optional properties:
        - `parent_name`
        * Added property `parents` (array)

        * Added property `parents_obj` (array)

        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

        * Changed property `children` (array)

        * Changed property `children_obj` (array)

            Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /core/user_consent/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

    - Changed property `application` (object)

        > Application Serializer

        New required properties:
        - `meta_icon_url`

        New optional properties:
        - `meta_icon`
        * Added property `meta_icon_url` (string)

            > Get the URL to the App Icon image

        * Changed property `slug` (string)

            > Internal application name, used in URLs.

        * Changed property `meta_icon` (string)

##### `POST` /core/users/

###### Request:

Changed content type : `application/json`

- Added property `roles` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `roles_obj`
    * Added property `roles` (array)

    * Added property `roles_obj` (array)

    * Changed property `groups_obj` (array)

        Changed items (object): > Partial Group Serializer, does not include child relations.

        New optional properties:
        - `parent_name`
        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

##### `GET` /core/users/

###### Parameters:

Added: `include_roles` in `query`

Added: `roles_by_name` in `query`

Added: `roles_by_pk` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /core/users/me/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer for information a user can retrieve about themselves

        New required properties:
        - `roles`
        * Added property `roles` (array)

            Items (object):
            - Property `name` (string)

            - Property `pk` (string)

##### `POST` /events/events/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    Added enum value:
    - `export_ready`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

##### `GET` /events/events/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Serializer
        - Changed property `action` (string)

            Added enum value:
            - `export_ready`

##### `GET` /events/notifications/{#123;uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `hyperlink` (string)

    - Added property `hyperlink_label` (string)

    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

            Added enum value:
            - `export_ready`

##### `PUT` /events/notifications/{#123;uuid}#125;/

###### Request:

Changed content type : `application/json`

- Added property `hyperlink` (string)

- Added property `hyperlink_label` (string)

- Changed property `event` (object)

    > Event Serializer
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `hyperlink` (string)

    - Added property `hyperlink_label` (string)

    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

            Added enum value:
            - `export_ready`

##### `PATCH` /events/notifications/{#123;uuid}#125;/

###### Request:

Changed content type : `application/json`

- Added property `hyperlink` (string)

- Added property `hyperlink_label` (string)

- Changed property `event` (object)

    > Event Serializer
    - Changed property `action` (string)

        Added enum value:
        - `export_ready`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `hyperlink` (string)

    - Added property `hyperlink_label` (string)

    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

            Added enum value:
            - `export_ready`

##### `POST` /events/rules/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer

        New required properties:
        - `children`
        - `parents_obj`

        New optional properties:
        - `parent_name`
        * Added property `parents` (array)

        * Added property `parents_obj` (array)

        * Deleted property `parent` (string)

        * Deleted property `parent_name` (string)

        * Changed property `children` (array)

        * Changed property `children_obj` (array)

            Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `GET` /events/rules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationRule Serializer
        - Changed property `destination_group_obj` (object)

            > Group Serializer

            New required properties:
            - `children`
            - `parents_obj`

            New optional properties:
            - `parent_name`
            * Added property `parents` (array)

            * Added property `parents_obj` (array)

            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

            * Changed property `children` (array)

            * Changed property `children_obj` (array)

                Changed items (object): > Stripped down group serializer to show relevant children/parents for groups

##### `GET` /flows/bindings/{#123;fsb_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `PUT` /flows/bindings/{#123;fsb_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `PATCH` /flows/bindings/{#123;fsb_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Added property `background` (string)

    > Background shown during execution

- Changed property `slug` (string)
    > Visible in the URL.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `background_url`

    New optional properties:
    - `background`
    * Added property `background_url` (string)

        > Get the URL to the background image

    * Changed property `slug` (string)

        > Visible in the URL.

    * Changed property `background` (string)
        > Background shown during execution

##### `GET` /flows/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Flow Serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Changed property `slug` (string)

            > Visible in the URL.

        * Changed property `background` (string)
            > Background shown during execution

##### `POST` /providers/google_workspace/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /providers/google_workspace/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > GoogleWorkspaceProvider Serializer
        - Added property `sync_page_size` (integer)

            > Controls the number of objects synced in a single task

        - Added property `sync_page_timeout` (string)
            > Timeout for synchronization of a single page

##### `POST` /providers/microsoft_entra/

###### Request:

Changed content type : `application/json`

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /providers/microsoft_entra/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > MicrosoftEntraProvider Serializer
        - Added property `sync_page_size` (integer)

            > Controls the number of objects synced in a single task

        - Added property `sync_page_timeout` (string)
            > Timeout for synchronization of a single page

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Added property `service_provider_config_cache_timeout` (string)

    > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

- Added property `sync_page_size` (integer)

    > Controls the number of objects synced in a single task

- Added property `sync_page_timeout` (string)
    > Timeout for synchronization of a single page

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `service_provider_config_cache_timeout` (string)

        > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProvider Serializer
        - Added property `service_provider_config_cache_timeout` (string)

            > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

        - Added property `sync_page_size` (integer)

            > Controls the number of objects synced in a single task

        - Added property `sync_page_timeout` (string)
            > Timeout for synchronization of a single page

##### `POST` /providers/ssf/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /providers/ssf/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFProvider Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer

                New required properties:
                - `roles_obj`
                * Added property `roles` (array)

                * Added property `roles_obj` (array)

                * Changed property `groups_obj` (array)

                    Changed items (object): > Partial Group Serializer, does not include child relations.

                    New optional properties:
                    - `parent_name`
                    * Deleted property `parent` (string)

                    * Deleted property `parent_name` (string)

##### `POST` /rbac/initial_permissions/

###### Request:

Changed content type : `application/json`

New optional properties:

- `mode`

* Deleted property `mode` (object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New optional properties:
    - `mode`
    * Deleted property `mode` (object)

##### `GET` /rbac/initial_permissions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > InitialPermissions serializer

        New optional properties:
        - `mode`
        * Deleted property `mode` (object)

##### `GET` /sources/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/group_connections/kerberos/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/group_connections/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/group_connections/oauth/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/group_connections/plex/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/group_connections/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/group_connections/telegram/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/group_connections/telegram/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/kerberos/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Added property `sync_outgoing_trigger_mode` (object)

    > When to trigger sync for outgoing providers

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Kerberos Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

        * Added property `sync_outgoing_trigger_mode` (object)

            > When to trigger sync for outgoing providers

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Added property `sync_outgoing_trigger_mode` (object)

    > When to trigger sync for outgoing providers

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Added property `sync_outgoing_trigger_mode` (object)

        > When to trigger sync for outgoing providers

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAP Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

        * Added property `sync_outgoing_trigger_mode` (object)

            > When to trigger sync for outgoing providers

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)

    > Internal source name, used in URLs.

- Changed property `provider_type` (string)

    Added enum values:
    - `slack`
    - `wechat`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

    * Changed property `provider_type` (string)

        Added enum values:
        - `slack`
        - `wechat`

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

        * Changed property `provider_type` (string)

            Added enum values:
            - `slack`
            - `wechat`

##### `POST` /sources/plex/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Plex Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLSource Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `POST` /sources/scim/

###### Request:

Changed content type : `application/json`

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `slug` (string)

        > Internal source name, used in URLs.

    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /sources/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMSource Serializer
        - Changed property `slug` (string)

            > Internal source name, used in URLs.

        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer

                New required properties:
                - `roles_obj`
                * Added property `roles` (array)

                * Added property `roles_obj` (array)

                * Changed property `groups_obj` (array)

                    Changed items (object): > Partial Group Serializer, does not include child relations.

                    New optional properties:
                    - `parent_name`
                    * Deleted property `parent` (string)

                    * Deleted property `parent_name` (string)

##### `POST` /sources/telegram/

###### Request:

Changed content type : `application/json`

- Added property `promoted` (boolean)

    > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

- Added property `icon` (string)

- Changed property `slug` (string)
    > Internal source name, used in URLs.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `icon_url`

    New optional properties:
    - `icon`
    * Added property `promoted` (boolean)

        > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

    * Added property `icon_url` (string)

    * Changed property `slug` (string)

        > Internal source name, used in URLs.

    * Changed property `icon` (string)

##### `GET` /sources/telegram/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/user_connections/kerberos/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/user_connections/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/user_connections/oauth/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/user_connections/plex/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/user_connections/saml/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `POST` /sources/user_connections/telegram/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `source_obj` (object)

        > Source Serializer

        New required properties:
        - `icon_url`

        New optional properties:
        - `icon`
        * Added property `promoted` (boolean)

            > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

        * Added property `icon_url` (string)

            > Get the URL to the source icon

        * Changed property `slug` (string)

            > Internal source name, used in URLs.

        * Changed property `icon` (string)

##### `GET` /sources/user_connections/telegram/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection
        - Changed property `source_obj` (object)

            > Source Serializer

            New required properties:
            - `icon_url`

            New optional properties:
            - `icon`
            * Added property `promoted` (boolean)

                > When enabled, this source will be displayed as a prominent button on the login page, instead of a small icon.

            * Added property `icon_url` (string)

                > Get the URL to the source icon

            * Changed property `slug` (string)

                > Internal source name, used in URLs.

            * Changed property `icon` (string)

##### `GET` /ssf/streams/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFStream Serializer
        - Changed property `provider_obj` (object)

            > SSFProvider Serializer
            - Changed property `token_obj` (object)

                > Token Serializer
                - Changed property `user_obj` (object)

                    > User Serializer

                    New required properties:
                    - `roles_obj`
                    * Added property `roles` (array)

                    * Added property `roles_obj` (array)

                    * Changed property `groups_obj` (array)

                        Changed items (object): > Partial Group Serializer, does not include child relations.

                        New optional properties:
                        - `parent_name`
                        * Deleted property `parent` (string)

                        * Deleted property `parent_name` (string)

##### `GET` /stages/all/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/duo/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/duo/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/duo/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/email/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/email/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/email/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/endpoint_gdtc/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/endpoint_gdtc/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/endpoint_gdtc/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/sms/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/sms/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/sms/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/static/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/static/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/static/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/totp/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/totp/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/totp/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/validate/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/validate/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/validate/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/webauthn/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/authenticator/webauthn/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/authenticator/webauthn/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/captcha/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/captcha/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/captcha/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/consent/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/consent/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/consent/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/deny/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/deny/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/deny/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/dummy/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/dummy/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/dummy/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/email/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/email/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/email/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/identification/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Added property `webauthn_stage` (string)

        > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/identification/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_stage` (string)

    > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Added property `webauthn_stage` (string)

        > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/identification/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_stage` (string)

    > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Added property `webauthn_stage` (string)

        > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `POST` /stages/invitation/invitations/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `name` (string)

    - Changed property `flow_obj` (object)

        > Flow Serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Changed property `slug` (string)

            > Visible in the URL.

        * Changed property `background` (string)
            > Background shown during execution

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Invitation Serializer
        - Changed property `name` (string)

        - Changed property `flow_obj` (object)

            > Flow Serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Changed property `slug` (string)

                > Visible in the URL.

            * Changed property `background` (string)
                > Background shown during execution

##### `GET` /stages/invitation/stages/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/invitation/stages/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/invitation/stages/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/mtls/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/mtls/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/mtls/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/password/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/password/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/password/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/prompt/stages/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/prompt/stages/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/prompt/stages/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/redirect/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/redirect/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/redirect/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/source/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/source/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/source/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_delete/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/user_delete/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/user_delete/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_login/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/user_login/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/user_login/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_logout/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/user_logout/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/user_logout/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_write/{#123;stage_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PUT` /stages/user_write/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `PATCH` /stages/user_write/{#123;stage_uuid}#125;/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /core/user_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserConsent Serializer
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

        - Changed property `application` (object)

            > Application Serializer

            New required properties:
            - `meta_icon_url`

            New optional properties:
            - `meta_icon`
            * Added property `meta_icon_url` (string)

                > Get the URL to the App Icon image

            * Changed property `slug` (string)

                > Internal application name, used in URLs.

            * Changed property `meta_icon` (string)

##### `GET` /events/notifications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Notification Serializer
        - Added property `hyperlink` (string)

        - Added property `hyperlink_label` (string)

        - Changed property `event` (object)

            > Event Serializer
            - Changed property `action` (string)

                Added enum value:
                - `export_ready`

##### `POST` /flows/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > FlowStageBinding Serializer
        - Changed property `stage_obj` (object)

            > Stage Serializer

            New required properties:
            - `flow_set`
            * Changed property `flow_set` (array)

                Changed items (object): > Stripped down flow serializer

                New required properties:
                - `background_url`

                New optional properties:
                - `background`
                * Added property `background_url` (string)

                    > Get the URL to the background image

                * Deleted property `background` (string)

                    > Get the URL to the background image. If the name is /static or starts with http
                    > it is returned as-is

                * Changed property `slug` (string)
                    > Visible in the URL.

##### `GET` /flows/executor/{#123;flow_slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Added 'ak-stage-endpoint-agent' component:
    - Property `flow_info` (object)

        > Contextual flow information for a challenge
        - Property `title` (string)

        - Property `background` (string)

        - Property `cancel_url` (string)

        - Property `layout` (string)

            Enum values:
            - `stacked`
            - `content_left`
            - `content_right`
            - `sidebar_left`
            - `sidebar_right`

    - Property `component` (string)

    - Property `response_errors` (object)

    - Property `challenge` (string)

    - Property `challenge_idle_timeout` (integer)

    Updated `ak-stage-identification` component:
    - Added property `passkey_challenge` (object)

    - Changed property `sources` (array)

        Changed items (object): > Serializer for Login buttons of sources
        - Added property `promoted` (boolean)

##### `POST` /flows/executor/{#123;flow_slug}#125;/

###### Request:

Changed content type : `application/json`

Added 'ak-stage-endpoint-agent' component:

- Property `component` (string)

- Property `response` (string)

Updated `ak-stage-identification` component:
New optional properties:

- `uid_field`

* Added property `passkey` (object)

* Changed property `uid_field` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Added 'ak-stage-endpoint-agent' component:
    Updated `ak-stage-identification` component:
    - Added property `passkey_challenge` (object)

    - Changed property `sources` (array)

        Changed items (object): > Serializer for Login buttons of sources
        - Added property `promoted` (boolean)

##### `GET` /flows/inspector/{#123;flow_slug}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `plans` (array)

        Changed items (object): > Serializer for an active FlowPlan
        - Changed property `next_planned_stage` (object)

            > FlowStageBinding Serializer
            - Changed property `stage_obj` (object)

                > Stage Serializer

                New required properties:
                - `flow_set`
                * Changed property `flow_set` (array)

        - Changed property `current_stage` (object)

            > FlowStageBinding Serializer
            - Changed property `stage_obj` (object)

                > Stage Serializer

                New required properties:
                - `flow_set`
                * Changed property `flow_set` (array)

                    Changed items (object): > Stripped down flow serializer

                    New required properties:
                    - `background_url`

                    New optional properties:
                    - `background`
                    * Added property `background_url` (string)

                        > Get the URL to the background image

                    * Deleted property `background` (string)

                        > Get the URL to the background image. If the name is /static or starts with http
                        > it is returned as-is

                    * Changed property `slug` (string)
                        > Visible in the URL.

##### `GET` /oauth2/access_tokens/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /oauth2/authorization_codes/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /oauth2/refresh_tokens/{#123;id}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `roles_obj`
        * Added property `roles` (array)

        * Added property `roles_obj` (array)

        * Changed property `groups_obj` (array)

            Changed items (object): > Partial Group Serializer, does not include child relations.

            New optional properties:
            - `parent_name`
            * Deleted property `parent` (string)

            * Deleted property `parent_name` (string)

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Stage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/duo/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorDuoStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/email/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorEmailStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/endpoint_gdtc/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/endpoint_gdtc/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorEndpointGDTCStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/sms/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorSMSStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/static/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorStaticStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/totp/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorTOTPStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorValidateStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorWebAuthnStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > CaptchaStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/consent/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > ConsentStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/deny/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > DenyStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/dummy/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > DummyStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > EmailStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_stage` (string)

    > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Added property `webauthn_stage` (string)

        > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/identification/

###### Parameters:

Added: `webauthn_stage` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > IdentificationStage Serializer

        New required properties:
        - `flow_set`
        * Added property `webauthn_stage` (string)

            > When set, and conditional WebAuthn is available, allow the user to use their passkey as a first factor.

        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/invitation/stages/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > InvitationStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/mtls/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/mtls/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > MutualTLSStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/password/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PasswordStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `GET` /stages/prompt/prompts/{#123;prompt_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `PUT` /stages/prompt/prompts/{#123;prompt_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `PATCH` /stages/prompt/prompts/{#123;prompt_uuid}#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/prompt/stages/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PromptStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/redirect/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/redirect/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > RedirectStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/source/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/source/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SourceStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/user_delete/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserDeleteStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/user_login/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_login/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserLoginStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/user_logout/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserLogoutStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `POST` /stages/user_write/

###### Request:

Changed content type : `application/json`

- Deleted property `flow_set` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `flow_set`
    * Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer

        New required properties:
        - `background_url`

        New optional properties:
        - `background`
        * Added property `background_url` (string)

            > Get the URL to the background image

        * Deleted property `background` (string)

            > Get the URL to the background image. If the name is /static or starts with http
            > it is returned as-is

        * Changed property `slug` (string)
            > Visible in the URL.

##### `GET` /stages/user_write/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserWriteStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `app` (object)

    > Application Serializer
    - Added property `meta_icon` (string)

    - Changed property `slug` (string)
        > Internal application name, used in URLs.

- Changed property `provider` (object)

    Updated `authentik_providers_microsoft_entra.microsoftentraprovider` provider_model:
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

    Updated `authentik_providers_google_workspace.googleworkspaceprovider` provider_model:
    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

    Updated `authentik_providers_scim.scimprovider` provider_model:
    - Added property `service_provider_config_cache_timeout` (string)

        > Cache duration for ServiceProviderConfig responses. Set minutes=0 to disable.

    - Added property `sync_page_size` (integer)

        > Controls the number of objects synced in a single task

    - Added property `sync_page_timeout` (string)
        > Timeout for synchronization of a single page

##### `GET` /oauth2/access_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /oauth2/authorization_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `GET` /oauth2/refresh_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `roles_obj`
            * Added property `roles` (array)

            * Added property `roles_obj` (array)

            * Changed property `groups_obj` (array)

                Changed items (object): > Partial Group Serializer, does not include child relations.

                New optional properties:
                - `parent_name`
                * Deleted property `parent` (string)

                * Deleted property `parent_name` (string)

##### `POST` /stages/prompt/prompts/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer

        New required properties:
        - `flow_set`
        * Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer

            New required properties:
            - `background_url`

            New optional properties:
            - `background`
            * Added property `background_url` (string)

                > Get the URL to the background image

            * Deleted property `background` (string)

                > Get the URL to the background image. If the name is /static or starts with http
                > it is returned as-is

            * Changed property `slug` (string)
                > Visible in the URL.

##### `GET` /stages/prompt/prompts/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Prompt Serializer
        - Changed property `prompt_stages_obj` (array)

            Changed items (object): > PromptStage Serializer

            New required properties:
            - `flow_set`
            * Changed property `flow_set` (array)

                Changed items (object): > Stripped down flow serializer

                New required properties:
                - `background_url`

                New optional properties:
                - `background`
                * Added property `background_url` (string)

                    > Get the URL to the background image

                * Deleted property `background` (string)

                    > Get the URL to the background image. If the name is /static or starts with http
                    > it is returned as-is

                * Changed property `slug` (string)
                    > Visible in the URL.

#### Result

---

API changes broke backward compatibility

---

## Release 2025.2

## Highlights

- **SSF Provider &#x20;**&#x20;Add support for Shared Signals Framework.
- **RAC moved open source** Remote access is now available to everyone!
- **GeoIP distance and impossible travel checks** Add the ability to check for the distance a user has moved compared to a previous login, and if the user could have travelled the distance.
- **Email OTP Stage** Allow users to use their email accounts as a one-time-password during authentication.
- **Fine-grained permission for superuser toggle on groups** Setting the **Is superuser** toggle on a group now requires a separate permission.

## Breaking changes

- **Fixed behavior in Source stage&#x20;**

  In previous versions, the Source stage would incorrectly continue with the initial flow after returning from the source, which didn't match the documented behavior.

  With this release this behavior has been corrected and the source stage will now correctly run the selected enrollment/authentication flow before returning to the flow from which the source stage was executed.

- **Deprecated and frozen `:latest` container image tag after 2025.2**

  Using the `:latest` tag with container images is not recommended as it can lead to unintentional updates and potentially broken setups.

  The tag will not be removed, however it will also not be updated past 2025.2.

  We strongly recommend using a specific version tag for authentik instances' container images, such as `:2025.2`.

## New features

- **SSF Provider** &#x20;

  [Shared Signals Framework](../../add-secure-apps/providers/ssf/index.mdx) allows applications to register a stream with authentik through which they can receive events from authentik, such as when a session is revoked or a credential is added, changed, or deleted, and execute actions based on these events.

  Using an SSF provider as a backchannel provider allows admins to integrate authentik with Apple Business Manager for federated Apple IDs.

- **RAC moved to open source**

  Remote access (RDP, VNC and SSH) has moved from enterprise to our free, open source code. We try our best to limit enterprise-specific functionality to features that would be non-essential to homelab users and far more valuable to enterprise use cases. We've had a variety of homelab users reach out with excellent use cases for RAC functionality, so while this will mean giving up some potential revenue, we think that opening up RAC to the community is the right thing to do!

- **GeoIP distance and impossible travel checks**

  Add the ability to check for the distance a user has moved compared to a previous login, and add the option to check impossible travel distances based on client IP.

  These options can be used to detect and prevent access from potentially stolen authentik sessions or stolen devices. Refer to our [documentation](../../customize/policies/types/geoip.mdx).

- **Email OTP Authenticator Setup Stage**

  Admins now have the ability to configure the option for users to use their email address as an authenticator. Users that already have an email address set on their account will be able to use that address to receive one-time-passwords. It is also possible to configure authentik to allow users to add additional email addresses as authenticators.

  See [Email Authenticator Setup Stage](../../add-secure-apps/flows-stages/stages/authenticator_email/index.mdx).

- **Application Wizard is the default way to create applications**

  The default way of creating an application now allows admins to configure the application and provider at the same time, and also add any kind of bindings without having to navigate through different sections of the UI. The previous way of creating a standalone application is and will stay available alongside the new and streamlined method.

- **Fine-grained permission for superuser toggle on groups**

  Setting the **Is superuser** toggle on a group now requires a separate permission, making it much easier to allow for delegated management of groups without risking the ability for users to self-elevate permissions. For details, refer to our [documentation](../../users-sources/groups/manage_groups.mdx#modify-a-group).

- **Improved debugging experience**

  For people developing authentik or building very complex, custom integrations, how to configure debugging in authentik is documented [here](../../developer-docs/setup/debugging.mdx).

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2025.2/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.2
```

## Minor changes/fixes

- admin: monitor worker version (#12463)
- api: cleanup owner permissions (#12598)
- blueprints: add REPL for blueprint YAML tags (#9223)
- blueprints: fix schema for meta models (#12421)
- core: add indexes on ExpiringModel (#12658)
- core: fix application entitlements not creatable with blueprints (#12673)
- core: fix error when creating new user with default path (#12609)
- core: fix generic sources not being fetchable by pk (#12896)
- core: fix permissions for admin device listing (#12787)
- core: search users' attributes (#12740)
- core: show last password change date (#12958)
- enterprise/providers: SSF (#12327)
- enterprise/providers/SSF: fix a couple of bugs after real world testing (#12987)
- enterprise/rac: Improve client connection status & bugfixes (#12684)
- events: make sure password set event has the correct IP (#12585)
- events: notification\_cleanup: avoid unnecessary loop (#12417)
- flows: clear flow state before redirecting to final URL (#12788)
- flows: fix history containing other plans (#12655)
- flows: fix inspector permission check (#12907)
- flows: more tests (#11587)
- flows: show policy messages in reevaluate marker (#12855)
- flows/inspector: add button to open flow inspector (#12656)
- internal: fix missing trailing slash in outpost websocket (#12470)
- internal: fix URL generation for websocket connection (#12439)
- lifecycle: update python to 3.12.8 (#12783)
- lifecycle/migrate: don't migrate tenants if not enabled (#12850)
- outposts: fix version label (#12486)
- providers/oauth2: include scope in token response (#12921)
- providers/oauth2: support token revocation for public clients (#12704)
- providers/saml: fix handle Accept: application/xml for SAML Metadata endpoint (#12483) (#12518)
- providers/saml: fix invalid SAML Response when assertion and response are signed (#12611)
- providers/saml: provide generic metadata url when possible (#12413)
- rbac: exclude permissions for internal models (#12803)
- rbac: permissions endpoint: allow authenticated users (#12608)
- root: backport version bump (#12426)
- root: docker: ensure apt packages are up-to-date (#12683)
- root: expose CONN\_MAX\_AGE, CONN\_HEALTH\_CHECKS and DISABLE\_SERVER\_SIDE\_CURSORS for PostgreSQL config (#10159)
- root: fix dev build version being invalid semver (#12472)
- root: redis, make sure tlscacert isn't an empty string (#12407)
- sources: allow uuid or slug to be used for retrieving a source (#12780)
- sources: allow uuid or slug to be used for retrieving a source (2024.12 fix) (#12772)
- sources/kerberos: authenticate with the user's username instead of the first username in authentik (#12497)
- sources/kerberos: handle principal expire time (#12748)
- sources/oauth: fix authentication only being sent in form body (#12713)
- sources/scim: fix user creation (duplicate userName) (#12547)
- stages/authenticator: add user field to devices (#12636)
- stages/prompt: always show policy messages (#12765)
- stages/redirect: fix query parameter when redirecting to flow (#12750)
- web, core: fix grammatical issue in stage bindings (#10799)
- web: fix build dev build (#12473)
- web: fix error handling bug in ApplicationWizard.RACProviderForm (#12640)
- web: Fix issue where Codemirror partially applies OneDark theme. (#12811)
- web: fix mobile scrolling bug (#12601)
- web: fix source selection and outpost integration health (#12530)
- web: fix source selection and outpost integration health (#12530)
- web: fixes broken docLinks - url missing s (#12789)
- web: housekeeping, optimizations and small fixes (#12450)
- web: improve notification and API drawers (#12659)
- web: misc fixes for admin and flow inspector (#12461)
- web: only load version context when authenticated (#12482)
- web: update gen-client-ts to OpenAPI 7.11.0 (#12756)
- web/admin: fix role changelog missing primary key filter (#12671)
- web/admin: improve user display view (#12988)
- web/admin: more cleanup and consistency (#12657)
- web/admin: Refine navigation (#12441)
- web/components: ak-number-input: add support for min (#12703)
- web/flows: fix `login` / `log in` inconsistency (#12526)

## Fixed in 2025.2.1

- core: add pre-hydrated relative URL (cherry-pick #13243) (#13246)
- stages/authenticator\_email: Email Authenticator Stage Documentation (cherry-pick #12853) (#13218)
- stages/authenticator\_email: fix session cleanup test b (cherry-pick #13264) (#13276)
- stages/email: Fix email stage serialization (cherry-pick #13256) (#13273)

## Fixed in 2025.2.2

- \*: fix stage incorrectly being inserted instead of appended (cherry-pick #13304) (#13327)
- enterprise/stages/source: fix dispatch method signature (cherry-pick #13321) (#13326)
- lib/config: fix conn\_max\_age parsing (cherry-pick #13370) (#13415)
- providers/SCIM: fix object exists error for users, attempt to look up user ID in remote system (#13437)
- providers/proxy: kubernetes outpost: fix reconcile when only annotations changed (cherry-pick #13372) (#13384)
- providers/rac: fix signals and Endpoint caching (cherry-pick #13529) (#13531)
- sources/oauth: fix duplicate authentication (cherry-pick #13322) (#13535)
- sources/oauth: ignore missing well-known keys (cherry-pick #13468) (#13470)
- stages/authenticator\_email: Fix Enroll dropdown in the MFA Devices page (cherry-pick #13404) (#13414)
- stages/identification: check captcha after checking authentication (cherry-pick #13533) (#13551)
- web/admin: fix display bug for assigned users in application bindings in the wizard (cherry-pick #13435) (#13452)
- web/flows: fix missing padding on authenticator\_validate card (cherry-pick #13420) (#13519)
- web/user: ensure modal container on user-settings page is min-height: 100% (cherry-pick #13402) (#13413)
- web/user: show admin interface button on mobile (cherry-pick #13421) (#13518)

## Fixed in 2025.2.3

- admin: fix system API when using bearer token (cherry-pick #13651) (#13654)
- core: fix core/user is\_superuser filter (cherry-pick #13693) (#13694)
- core: fix non-exploitable open redirect, reported by [@dominic-r](https://github.com/dominic-r) (cherry-pick #13696) (#13698)
- outposts/ldap: fix paginator going into infinite loop (cherry-pick #13677) (#13679)
- security: fix CVE-2025-29928 (cherry-pick #13695) (#13700)
- stages/email: Clean newline characters in TemplateEmailMessage (cherry-pick #13666) (#13667)
- stages/identification: refresh captcha on failure (cherry-pick #13697) (#13699)
- web/admin: reworked sync status card (cherry-pick #13625) (#13692)

## Fixed in 2025.2.4

- Revert "core: fix non-exploitable open redirect (#13696)" (cherry-pick #13824) (#13826)
- providers/scim: fix group membership check failing (cherry-pick #13644) (#13825)
- stages/email: fix for newlines in emails (#13712)

## API Changes

#### What's New

***

##### `GET` /authenticators/admin/email/

##### `POST` /authenticators/admin/email/

##### `GET` /authenticators/admin/email/\{id}/

##### `PUT` /authenticators/admin/email/\{id}/

##### `DELETE` /authenticators/admin/email/\{id}/

##### `PATCH` /authenticators/admin/email/\{id}/

##### `GET` /authenticators/email/

##### `GET` /authenticators/email/\{id}/

##### `PUT` /authenticators/email/\{id}/

##### `DELETE` /authenticators/email/\{id}/

##### `PATCH` /authenticators/email/\{id}/

##### `GET` /authenticators/email/\{id}/used\_by/

##### `GET` /providers/ssf/

##### `POST` /providers/ssf/

##### `GET` /providers/ssf/\{id}/

##### `PUT` /providers/ssf/\{id}/

##### `DELETE` /providers/ssf/\{id}/

##### `PATCH` /providers/ssf/\{id}/

##### `GET` /providers/ssf/\{id}/used\_by/

##### `GET` /ssf/streams/

##### `GET` /ssf/streams/\{uuid}/

##### `GET` /stages/authenticator/email/

##### `POST` /stages/authenticator/email/

##### `GET` /stages/authenticator/email/\{stage\_uuid}/

##### `PUT` /stages/authenticator/email/\{stage\_uuid}/

##### `DELETE` /stages/authenticator/email/\{stage\_uuid}/

##### `PATCH` /stages/authenticator/email/\{stage\_uuid}/

##### `GET` /stages/authenticator/email/\{stage\_uuid}/used\_by/

#### What's Changed

***

##### `GET` /admin/workers/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

##### `GET` /authenticators/admin/duo/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)
    - Property `pk` (integer)

    - Property `username` (string)

      > Required. 150 characters or fewer. Letters, digits and @/./+/-/\_ only.

    - Property `name` (string)

      > User's display name.

    - Property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    - Property `last_login` (string)

    - Property `email` (string)

    - Property `attributes` (object)

    - Property `uid` (string)

##### `PUT` /authenticators/admin/duo/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/admin/duo/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/sms/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/admin/sms/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/admin/sms/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/totp/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/admin/totp/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/admin/totp/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/webauthn/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/admin/webauthn/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/admin/webauthn/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/duo/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/duo/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/duo/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/sms/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/sms/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/sms/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/totp/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/totp/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/totp/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/webauthn/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/webauthn/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/webauthn/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.providers.rac`

    - `authentik.stages.authenticator_email`

    - `authentik.enterprise.providers.ssf`
      Removed enum value:

    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_authenticator_email.authenticatoremailstage`
    - `authentik_stages_authenticator_email.emaildevice`
    - `authentik_providers_ssf.ssfprovider`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.providers.rac`

  - `authentik.stages.authenticator_email`

  - `authentik.enterprise.providers.ssf`
    Removed enum value:

  - `authentik.enterprise.providers.rac`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.providers.rac`

    - `authentik.stages.authenticator_email`

    - `authentik.enterprise.providers.ssf`
      Removed enum value:

    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_authenticator_email.authenticatoremailstage`
    - `authentik_stages_authenticator_email.emaildevice`
    - `authentik_providers_ssf.ssfprovider`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.providers.rac`

  - `authentik.stages.authenticator_email`

  - `authentik.enterprise.providers.ssf`
    Removed enum value:

  - `authentik.enterprise.providers.rac`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.providers.rac`

    - `authentik.stages.authenticator_email`

    - `authentik.enterprise.providers.ssf`
      Removed enum value:

    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_authenticator_email.authenticatoremailstage`
    - `authentik_stages_authenticator_email.emaildevice`
    - `authentik_providers_ssf.ssfprovider`

##### `GET` /providers/saml/\{id}/metadata/

###### Return Type:

Changed response : **200 OK**

- New content type : `application/xml`

##### `POST` /authenticators/admin/duo/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for Duo authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `POST` /authenticators/admin/sms/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for sms authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /authenticators/admin/static/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/admin/static/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/admin/static/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `POST` /authenticators/admin/totp/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for totp authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `POST` /authenticators/admin/webauthn/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for WebAuthn authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /authenticators/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for Duo authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /authenticators/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for sms authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /authenticators/static/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PUT` /authenticators/static/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `PATCH` /authenticators/static/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for totp authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /authenticators/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for WebAuthn authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `PUT` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `PATCH` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `GET` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `password_change_date`

  * Added property `password_change_date` (string)

##### `PUT` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `password_change_date`

  * Added property `password_change_date` (string)

##### `PATCH` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `password_change_date`

  * Added property `password_change_date` (string)

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.providers.rac`

  - `authentik.stages.authenticator_email`

  - `authentik.enterprise.providers.ssf`
    Removed enum value:

  - `authentik.enterprise.providers.rac`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.providers.rac`

    - `authentik.stages.authenticator_email`

    - `authentik.enterprise.providers.ssf`
      Removed enum value:

    - `authentik.enterprise.providers.rac`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_stages_authenticator_email.authenticatoremailstage`
    - `authentik_stages_authenticator_email.emaildevice`
    - `authentik_providers_ssf.ssfprovider`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum values:

      - `authentik.providers.rac`

      - `authentik.stages.authenticator_email`

      - `authentik.enterprise.providers.ssf`
        Removed enum value:

      - `authentik.enterprise.providers.rac`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum values:

      - `authentik_stages_authenticator_email.authenticatoremailstage`
      - `authentik_stages_authenticator_email.emaildevice`
      - `authentik_providers_ssf.ssfprovider`

##### `GET` /policies/geoip/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `check_history_distance` (boolean)

  - Added property `history_max_distance_km` (integer)

  - Added property `distance_tolerance_km` (integer)

  - Added property `history_login_count` (integer)

  - Added property `check_impossible_travel` (boolean)

  - Added property `impossible_tolerance_km` (integer)

##### `PUT` /policies/geoip/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `check_history_distance` (boolean)

- Added property `history_max_distance_km` (integer)

- Added property `distance_tolerance_km` (integer)

- Added property `history_login_count` (integer)

- Added property `check_impossible_travel` (boolean)

- Added property `impossible_tolerance_km` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `check_history_distance` (boolean)

  - Added property `history_max_distance_km` (integer)

  - Added property `distance_tolerance_km` (integer)

  - Added property `history_login_count` (integer)

  - Added property `check_impossible_travel` (boolean)

  - Added property `impossible_tolerance_km` (integer)

##### `PATCH` /policies/geoip/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `check_history_distance` (boolean)

- Added property `history_max_distance_km` (integer)

- Added property `distance_tolerance_km` (integer)

- Added property `history_login_count` (integer)

- Added property `check_impossible_travel` (boolean)

- Added property `impossible_tolerance_km` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `check_history_distance` (boolean)

  - Added property `history_max_distance_km` (integer)

  - Added property `distance_tolerance_km` (integer)

  - Added property `history_login_count` (integer)

  - Added property `check_impossible_travel` (boolean)

  - Added property `impossible_tolerance_km` (integer)

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_stages_authenticator_email.authenticatoremailstage`
  - `authentik_stages_authenticator_email.emaildevice`
  - `authentik_providers_ssf.ssfprovider`

##### `GET` /sources/scim/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `PUT` /sources/scim/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `PATCH` /sources/scim/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `POST` /authenticators/admin/static/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `user`

  * Added property `user` (object)

##### `GET` /authenticators/admin/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for static authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `GET` /authenticators/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for static authenticator devices

    New required properties:

    - `user`

    * Added property `user` (object)

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `password_change_date`

  * Added property `password_change_date` (string)

##### `GET` /core/users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `GET` /flows/bindings/\{fsb\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `re_evaluate_policies` (boolean)
    > Evaluate policies when the Stage is presented to the user.

##### `PUT` /flows/bindings/\{fsb\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `re_evaluate_policies` (boolean)
  > Evaluate policies when the Stage is presented to the user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `re_evaluate_policies` (boolean)
    > Evaluate policies when the Stage is presented to the user.

##### `PATCH` /flows/bindings/\{fsb\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `re_evaluate_policies` (boolean)
  > Evaluate policies when the Stage is presented to the user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `re_evaluate_policies` (boolean)
    > Evaluate policies when the Stage is presented to the user.

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `POST` /policies/geoip/

###### Request:

Changed content type : `application/json`

- Added property `check_history_distance` (boolean)

- Added property `history_max_distance_km` (integer)

- Added property `distance_tolerance_km` (integer)

- Added property `history_login_count` (integer)

- Added property `check_impossible_travel` (boolean)

- Added property `impossible_tolerance_km` (integer)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `check_history_distance` (boolean)

  - Added property `history_max_distance_km` (integer)

  - Added property `distance_tolerance_km` (integer)

  - Added property `history_login_count` (integer)

  - Added property `check_impossible_travel` (boolean)

  - Added property `impossible_tolerance_km` (integer)

##### `GET` /policies/geoip/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > GeoIP Policy Serializer

    - Added property `check_history_distance` (boolean)

    - Added property `history_max_distance_km` (integer)

    - Added property `distance_tolerance_km` (integer)

    - Added property `history_login_count` (integer)

    - Added property `check_impossible_travel` (boolean)

    - Added property `impossible_tolerance_km` (integer)

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

##### `GET` /sources/all/

###### Parameters:

Added: `pbm_uuid` in `query`

##### `GET` /sources/kerberos/

###### Parameters:

Added: `pbm_uuid` in `query`

##### `GET` /sources/ldap/

###### Parameters:

Added: `pbm_uuid` in `query`

##### `GET` /sources/oauth/

###### Parameters:

Added: `pbm_uuid` in `query`

##### `GET` /sources/plex/

###### Parameters:

Added: `pbm_uuid` in `query`

##### `GET` /sources/saml/

###### Parameters:

Added: `pbm_uuid` in `query`

##### `POST` /sources/scim/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `GET` /sources/scim/

###### Parameters:

Added: `pbm_uuid` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SCIMSource Serializer

    - Changed property `token_obj` (object)

      > Token Serializer

      - Changed property `user_obj` (object)

        > User Serializer

        New required properties:

        - `password_change_date`

        * Added property `password_change_date` (string)

##### `GET` /stages/authenticator/validate/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

    Added enum value:

    - `email`

##### `PUT` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `device_classes` (array)

  > Device classes which can be used to authenticate

  Changed items (string):

  Added enum value:

  - `email`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

    Added enum value:

    - `email`

##### `PATCH` /stages/authenticator/validate/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `device_classes` (array)

  > Device classes which can be used to authenticate

  Changed items (string):

  Added enum value:

  - `email`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

    Added enum value:

    - `email`

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `POST` /flows/bindings/

###### Request:

Changed content type : `application/json`

- Changed property `re_evaluate_policies` (boolean)
  > Evaluate policies when the Stage is presented to the user.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `re_evaluate_policies` (boolean)
    > Evaluate policies when the Stage is presented to the user.

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > FlowStageBinding Serializer

    - Changed property `re_evaluate_policies` (boolean)
      > Evaluate policies when the Stage is presented to the user.

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'ak-stage-authenticator-email' component:

  - Property `flow_info` (object)

    > Contextual flow information for a challenge

    - Property `title` (string)

    - Property `background` (string)

    - Property `cancel_url` (string)

    - Property `layout` (string)

      Enum values:

      - `stacked`
      - `content_left`
      - `content_right`
      - `sidebar_left`
      - `sidebar_right`

  - Property `component` (string)

  - Property `response_errors` (object)

  - Property `pending_user` (string)

  - Property `pending_user_avatar` (string)

  - Property `email` (string)

  - Property `email_required` (boolean)

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Added 'ak-stage-authenticator-email' component:

- Property `component` (string)

- Property `code` (integer)

- Property `email` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Added 'ak-stage-authenticator-email' component:

##### `GET` /flows/inspector/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `plans` (array)

    Changed items (object): > Serializer for an active FlowPlan

    - Changed property `next_planned_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `re_evaluate_policies` (boolean)
        > Evaluate policies when the Stage is presented to the user.

    - Changed property `current_stage` (object)

      > FlowStageBinding Serializer

      - Changed property `re_evaluate_policies` (boolean)
        > Evaluate policies when the Stage is presented to the user.

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `password_change_date`

    * Added property `password_change_date` (string)

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Changed property `device_classes` (array)

  > Device classes which can be used to authenticate

  Changed items (string):

  Added enum value:

  - `email`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `device_classes` (array)

    > Device classes which can be used to authenticate

    Changed items (string):

    Added enum value:

    - `email`

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorValidateStage Serializer

    - Changed property `device_classes` (array)

      > Device classes which can be used to authenticate

      Changed items (string):

      Added enum value:

      - `email`

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider_model` (string)

  Added enum value:

  - `authentik_providers_ssf.ssfprovider`

- Changed property `provider` (object)

  Added 'authentik\_providers\_ssf.ssfprovider' provider\_model:

  - Property `name` (string)

  - Property `signing_key` (string)

    > Key used to sign the SSF Events.

  - Property `oidc_auth_providers` (array)

    Items (integer):

  - Property `event_retention` (string)

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `password_change_date`

      * Added property `password_change_date` (string)

---

## Release 2025.4

## Highlights

- **Improve membership resolution for the LDAP Source** Allow lookups of LDAP group memberships from user attributes as an alternative to lookups from group attributes. This also allows for nested group lookups in Active Directory.

<!-- TODO: Temporarily deactivated feature, see https://github.com/goauthentik/authentik/issues/14320 -->
<!-- - **Support for PostgreSQL Connection Pools** PostgreSQL Connection Pools provides a set of open connections in order to reduce latency. -->

- **RBAC: Initial Permissions** :ak-preview Provides more flexible access control by assigning permissions to the user/role creating a new object in authentik. Use **Initial Permissions** as a pragmatic way to implement the principle of least privilege.

- **Password History Policy** :ak-enterprise A new policy (the Password Uniqueness policy) can be implemented to prevent users from reusing previous passwords; admins are able to configure how many previous password hashes the system will store and evaluate. This new policy makes it easier to enforce password reuse requirements, such as for FedRAMP compliance.

- **Provider Sync Dry Run** :ak-preview Add the option for dry-run syncs for SCIM, Google Workspace, and Microsoft Entra providers to preview the results of a sync without affecting live accounts.

## Breaking changes

- **Reputation score limit**: The default values for the new upper and lower limits on Reputation score are `-5` and `5`. This could break custom policies that rely on the reputation scores decreasing or increasing beyond these limits. You can set your custom limits under **System > Settings**.

- **Deprecated and frozen `:latest` container image tag after 2025.2**

    Using the `:latest` tag with container images is not recommended as it can lead to unintentional updates and potentially broken setups.

    The tag will not be removed, however it will also not be updated past 2025.2.

    We strongly recommend using a specific version tag for authentik instances' container images, such as `:2025.4`.

- **Helm chart dependencies update**: Following [Bitnami's changes to only publish latest version of containers](https://github.com/bitnami/containers/issues/75671), the Helm chart dependencies (PostgreSQL and Redis) will now be updated with each release.

For this release:

- The Redis chart will be upgraded to the latest version. As the image is not pinned, it will also get upgraded.
- The PostgreSQL chart will be upgraded to the latest version, but the image will remain pinned to `15.8.0-debian-12-r18`.

For the next release:

- The Redis chart will be upgraded to the latest version again.
- The PostgreSQL chart will be upgraded to the latest version again, and the image will no longer be pinned, which will bring it to PostgreSQL major version `17`. This will require following PostgreSQL major upgrade steps, for which we provide [documentation](../../troubleshooting/postgres/upgrade_kubernetes.mdx).

For subsequent releases:

- The Redis chart will be upgraded to the latest version.
- The PostgreSQL chart will be upgraded to the latest version, with major upgrades being called out in authentik release notes.

We encourage users to pin their PostgreSQL image version.

### Manual action might be required

#### Sessions are now stored in the database

Previously, sessions were stored by default in the cache. Now, they are stored in the database. This allows for numerous other performance improvements. On high traffic instances, requests to old instances after the upgrade has started will fail to authenticate.

## New features

- **Remember me**: Users can now choose to skip entering their usernames after their first login on the same device. This feature is optional and admins can enable it in the [Identification stage](../../add-secure-apps/flows-stages/stages/identification/index.mdx).

- **RBAC: Initial Permissions**

    In hardened authentik installations, it is possible for a user to have permission to create an object type, but not to view/change/delete(/etc) objects of that type. Previously, this could result in a user creating an object and then not having any access to that object. `InitialPermissions` is a mechanism to automatically add permissions to any object on creation. Refer to our [documentation](../../users-sources/access-control/initial_permissions.mdx) for more details.

- **Reputation score limit**

    Reputation scores now have a configurable numerical limit in addition to the [already existing temporal limit](https://docs.goauthentik.io/docs/install-config/configuration/#authentik_reputation_expiry).

<!-- - **Support for PostgreSQL Connection Pools**: See [description](#highlights) under Highlights. Refer to our [documentation](../../install-config/configuration/configuration.mdx). -->

- **Password History Policy**: See [description](#highlights) under Highlights. Refer to our [documentation](../../customize/policies/types/password-uniqueness.mdx).

- **Improve membership resolution for the LDAP Source**: See [description](#highlights) under Highlights. Refer to our [documentation](../../users-sources/sources/directory-sync/active-directory/index.mdx).

- **Provider Sync Dry Run**: See [description](#highlights) under Highlights.

- **Gateway API support** :ak-preview

    For Kubernetes users, authentik now supports the Gateway API. The Helm chart supports HTTPRoute. The Kubernetes outpost integrations supports creating HTTPRoute objects for Proxy providers. Refer to our [documentation](../../add-secure-apps/outposts/integrations/kubernetes.mdx).

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added.

- [Apple Business Manager](/integrations/services/apple/)
- [FleetDM](/integrations/services/fleet/)
- [Gravity](/integrations/services/gravity/)
- [Homarr](/integrations/services/homarr/)
- [KnocKnoc](/integrations/services/knocknoc)
- [Mautic](/integrations/services/mautic/)
- [Mailcow](/integrations/services/mailcow/)
- [Mealie](/integrations/services/mealie/)
- [OpenProject](/integrations/services/openproject)
- [Sidero Omni](/integrations/services/omni)
- [Tandoor](/integrations/services/tandoor/)
- [Wazuh](/integrations/services/wazuh)
- [XCreds](/integrations/services/xcreds)
- [Zipline](/integrations/services/zipline/)

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2025.4/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.4
```

## Minor changes/fixes

- \*/saml: allow for domainless SAML URLs (#13737)
- \*: fix stage incorrectly being inserted instead of appended (#13304)
- admin: fix system API when using bearer token (#13651)
- blueprints: Adjust title for MFA set up (#13400)
- brands: add option to set global default flow background (#13079)
- brands: fix migration 0008 by removing incorrect context manager usage (#13635)
- brands: migrate custom CSS to brands (#13172)
- cmd: set version in outposts (#13116)
- cmd: set version in outposts (cherry-pick #13116) (#13122)
- core: Tidy contributor onboarding, fix typos. (#12700)
- core: add darkreader-lock (#13183)
- core: add pre-hydrated relative URL (#13243)
- core: clear expired database sessions (#13105)
- core: fix core/user is_superuser filter (#13693)
- core: fix double slash in cache key (#13721)
- core: fix error when viewing used_by for built-in source (#13588)
- core: fix flaky tests introduced with is_superuser API fix (#13709)
- core: fix migrations (#14009)
- core: fix non-exploitable open redirect (#13696)
- core: migrate all sessions to the database (#9736)
- core: users API: add date_joined (#13817)
- enterprise/policies: Add Password Uniqueness History Policy (#13453)
- enterprise/stages/source: fix Source stage not executing authentication/enrollment flow (#12875)
- enterprise/stages/source: fix dispatch method signature (#13321)
- enterprise/stages/source: set is_redirected in flow source stage redirects to (#13604)
- events: add configurable headers to webhooks (#13602)
- flows: fix API not returning configured background (#13641)
- lib/config: fix conn_max_age parsing (#13370)
- lib/sync/outgoing: add dry run (#13244)
- lib: set a default HTTP timeout on outgoing requests (#13599)
- lifecycle/migrate: fix migration failing if killed during first startup (#14207)
- lifecycle: add warning regarding supported installation methods (#13190)
- outposts/controllers: k8s: sanitize resource names to comply with DNS subdomain standards (#13444)
- outposts/ldap: fix paginator going into infinite loop (#13677)
- outposts: add support for gateway API (#13272)
- policies/geoip: fix math in impossible travel (#13141)
- policies/geoip: fix result when only dynamic results are used (#14107)
- policies/reputation: limit reputation score (#14008)
- policies: buffered policy access view for concurrent authorization attempts when unauthenticated (#13629)
- providers/SCIM: fix object exists error for users, attempt to look up user ID in remote system (#13437)
- providers/oauth2, rac: make sure tokens are revoked after session deletion (#14011)
- providers/oauth2: offline_access don't require explicit consent (#13419)
- providers/oauth2: properly support P-384 and P-521 keys (#13317)
- providers/proxy: kubernetes outpost: fix reconcile when only annotations changed (#13372)
- providers/rac: fix signals and Endpoint caching (#13529)
- providers/rac: move to open source (#13015)
- providers/saml: configurable AuthnContextClassRef (#13566)
- providers/scim: add compatibility mode for AWS & Slack (#13342)
- providers/scim: fix group membership check failing (#13644)
- providers/scim: save attributes returned from remote system like google workspace and entra ID (#13459)
- rbac: add `InitialPermissions` (#13795)
- rbac: add `name` to Permissions search (#14269)
- remove rc notice and enterprise tag for the span
- revert: rbac: exclude permissions for internal models (#12803) (#13138)
- root: allow configuring session cookie age (#12389)
- root: bump python client generator version (#13467)
- root: bump python patch version to 3.12.9 (#13710)
- root: fix dependency install due to description-file (#13655)
- root: fix uv lock file on macOS (#13578)
- root: prevent docker-compose up when secret key is missing (#14043)
- root: replace poetry with uv (#13388)
- root: support db pool (#13534)
- scripts: fix broken link (#13156)
- scripts: postgres: print statements (#13537)
- security: fix CVE-2025-29928 (#13695)
- sources/kerberos, saml: allow creation of connections from the API (#13794)
- sources/ldap: add source connections (#13796)
- sources/ldap: lookup group memberships from user attribute (#12661)
- sources/oauth: add group sync for azure_ad (#12894)
- sources/oauth: fix duplicate authentication (#13322)
- sources/oauth: ignore missing well-known keys (#13468)
- sources/oauth: introduce authorization code auth method (#14034)
- sources/oauth: reddit: fix duplicate keyword auth (#13466)
- sources: move identifier to parent model (#13797)
- sources: prevent deletion of built-in source (#12914)
- stages/authenticator_email: Email Authenticator Stage Documentation (#12853)
- stages/authenticator_email: Fix Enroll dropdown in the MFA Devices page (#13404)
- stages/authenticator_email: fix session cleanup test b (#13264)
- stages/authenticator_email: remove flaky assertions (#13371)
- stages/email: Clean newline characters in TemplateEmailMessage (#13666)
- stages/email: Fix email stage serialization (#13256)
- stages/email: fix for newlines in emails (#13712)
- stages/email: token_expiry format (#13394)
- stages/identification: check captcha after checking authentication (#13533)
- stages/identification: refresh captcha on failure (#13697)
- web/admin: add button to clear application cache (#13399)
- web/admin: add sync status refresh button (#13678)
- web/admin: allow user lists to show active only (#13403)
- web/admin: decorative display in user’s page breaks in other locales (#13393)
- web/admin: fix comment being rendered (#13530)
- web/admin: fix custom scope mappings being selected by default in proxy provider (#13735)
- web/admin: fix default selection for binding policy (#13180)
- web/admin: fix diff showing previous false as "-" (#13580)
- web/admin: fix display bug for assigned users in application bindings in the wizard (#13435)
- web/admin: fix markdown being completely whited out in dark mode on proxy provider pages (#13387)
- web/admin: fix minor typo (#13181)
- web/admin: only show message when not editing an application (#13165)
- web/admin: prefer using datefns over moment.js (#13143)
- web/admin: prevent default logo flashing in admin interface (#13960)
- web/admin: reworked sync status card (#13625)
- web/admin: reworked sync status card (cherry-pick #13625) (#13692)
- web/admin: update Application Wizard button placement (#12771)
- web/api: Fix Hoisted exports across entrypoints. Update Axios. (#14089)
- web/common: utils: fix infinite value handling in getRelativeTime function (#13564)
- web/flow: fix translate extract (#13208)
- web/flow: grab focus to uid input field (#13177)
- web/flow: update default flow background (#13175)
- web/flows: disambiguate brand links codeblock (#12141)
- web/flows: fix error on interactive Captcha stage when retrying captcha (#13119)
- web/flows: fix missing padding on authenticator_validate card (#13420)
- web/user: ensure modal container on user-settings page is min-height: 100% (#13402)
- web/user: fix RAC launch not opening when clicking icon (#13164)
- web/user: fix display for RAC tile (#13211)
- web/user: fix opening application with Enter not respecting new tab setting (#13115)
- web/user: fix post MFA creation link being invalid (#13157)
- web/user: fix race condition in user settings flow executor (#13163)
- web/user: show admin interface button on mobile (#13421)
- web: Client-side MDX rendering (#13610)
- web: ESBuild performance + Live reload (#13026)
- web: Fix TypeScript compilation issues for mixins, events. (#13766)
- web: Fix inline documentation rendering (#13379)
- web: Fix prop. (#13630)
- web: Flesh out configs. (#13801)
- web: Ignore Storybook when running codespell. (#13454)
- web: Indicate when caps-lock is active during password input. (#12733)
- web: Indicate when caps-lock is active during password input. (cherry-pick #12733) (#13160)
- web: Normalize client-side error handling (#13595)
- web: Packagify live reload plugin. (#14134)
- web: Safari fixes merge branch (#14181)
- web: Tidy temporal utilities. (#13755)
- web: add `remember me` feature to IdentificationStage (#10397)
- web: admin interface: faster card load (#13331)
- web: elements: Table: Fix table selection clearing behavior (#13959)
- web: ensure wizard modal closes on first cancel click (#13636)
- web: fix bug that was causing charts to be too tall (#14253)
- web: fix scrollbar styling (#12600)
- web: lock lit/ssr (#14214)
- web: update default flow background (#14115)
- Revert "core: fix non-exploitable open redirect (#13696)" (#13824)
- Revert "policies: buffered policy access view for concurrent authorization attempts when unauthenticated (#13629)" (#14180)
- Revert "web: Safari fixes merge branch (#14181)" (#14211)
- Revert "website/docs: Prepare for monorepo. (#14119)" (#14239)
- Revert package-lock.json changes from "web: add `remember me` feature to IdentificationStage (#10397)" (#14212)

## Fixed in 2025.4.1

- brands: fix CSS Migration not updating brands (cherry-pick #14306) (#14308)
- core: bump h11 from 0.14.0 to v0.16.0 (cherry-pick #14352) (#14472)
- core: fix session migration when old session can't be loaded (cherry-pick #14466) (#14480)
- core: fix unable to create group if no enable_group_superuser permission is given (cherry-pick #14510) (#14521)
- core: remove `OldAuthenticatedSession` content type (cherry-pick #14507) (#14509)
- enterprise: fix expired license's users being counted (cherry-pick #14451) (#14496)
- lifecycle: fix ak dump_config (cherry-pick #14445) (#14448)
- outposts: fix tmpdir in containers not being set (cherry-pick #14444) (#14449)
- rbac: fix RoleObjectPermissionTable not showing `add_user_to_group` (cherry-pick #14312) (#14334)
- root: backport SFE Build fix (#14495)
- root: temporarily deactivate database pool option (cherry-pick #14443) (#14479)
- web/flows/sfe: fix global background image not being loaded (cherry-pick #14442) (#14450)

## Fixed in 2025.4.2

- core: Migrate permissions before deleting OldAuthenticatedSession (cherry-pick #14788) (#14791)
- lifecycle: fix arguments not being passed to worker command (cherry-pick #14574) (#14620)
- sources/scim: fix all users being added to group when no members are given (cherry-pick #14645) (#14666)

## Fixed in 2025.4.3

- security: fix CVE-2025-52553 (#15289)

## Fixed in 2025.4.4

- security: fix CVE-2025-53942 (#15719)

## API Changes

#### What's New

---

##### `GET` /policies/unique_password/

##### `POST` /policies/unique_password/

##### `GET` /policies/unique_password/&#123;policy_uuid&#125;/

##### `PUT` /policies/unique_password/&#123;policy_uuid&#125;/

##### `DELETE` /policies/unique_password/&#123;policy_uuid&#125;/

##### `PATCH` /policies/unique_password/&#123;policy_uuid&#125;/

##### `GET` /policies/unique_password/&#123;policy_uuid&#125;/used_by/

##### `GET` /rbac/initial_permissions/

##### `POST` /rbac/initial_permissions/

##### `GET` /rbac/initial_permissions/&#123;id&#125;/

##### `PUT` /rbac/initial_permissions/&#123;id&#125;/

##### `DELETE` /rbac/initial_permissions/&#123;id&#125;/

##### `PATCH` /rbac/initial_permissions/&#123;id&#125;/

##### `GET` /rbac/initial_permissions/&#123;id&#125;/used_by/

##### `GET` /sources/group_connections/all/

##### `GET` /sources/group_connections/all/&#123;id&#125;/

##### `PUT` /sources/group_connections/all/&#123;id&#125;/

##### `DELETE` /sources/group_connections/all/&#123;id&#125;/

##### `PATCH` /sources/group_connections/all/&#123;id&#125;/

##### `GET` /sources/group_connections/all/&#123;id&#125;/used_by/

##### `GET` /sources/group_connections/ldap/

##### `POST` /sources/group_connections/ldap/

##### `GET` /sources/group_connections/ldap/&#123;id&#125;/

##### `PUT` /sources/group_connections/ldap/&#123;id&#125;/

##### `DELETE` /sources/group_connections/ldap/&#123;id&#125;/

##### `PATCH` /sources/group_connections/ldap/&#123;id&#125;/

##### `GET` /sources/group_connections/ldap/&#123;id&#125;/used_by/

##### `GET` /sources/user_connections/ldap/

##### `POST` /sources/user_connections/ldap/

##### `GET` /sources/user_connections/ldap/&#123;id&#125;/

##### `PUT` /sources/user_connections/ldap/&#123;id&#125;/

##### `DELETE` /sources/user_connections/ldap/&#123;id&#125;/

##### `PATCH` /sources/user_connections/ldap/&#123;id&#125;/

##### `GET` /sources/user_connections/ldap/&#123;id&#125;/used_by/

##### `POST` /sources/group_connections/kerberos/

##### `POST` /sources/group_connections/saml/

#### What's Changed

---

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `reputation_lower_limit` (integer)

        > Reputation cannot decrease lower than this value. Zero or negative.

    - Added property `reputation_upper_limit` (integer)
        > Reputation cannot increase higher than this value. Zero or positive.

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `reputation_lower_limit` (integer)

    > Reputation cannot decrease lower than this value. Zero or negative.

- Added property `reputation_upper_limit` (integer)
    > Reputation cannot increase higher than this value. Zero or positive.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `reputation_lower_limit` (integer)

        > Reputation cannot decrease lower than this value. Zero or negative.

    - Added property `reputation_upper_limit` (integer)
        > Reputation cannot increase higher than this value. Zero or positive.

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `reputation_lower_limit` (integer)

    > Reputation cannot decrease lower than this value. Zero or negative.

- Added property `reputation_upper_limit` (integer)
    > Reputation cannot increase higher than this value. Zero or positive.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `reputation_lower_limit` (integer)

        > Reputation cannot decrease lower than this value. Zero or negative.

    - Added property `reputation_upper_limit` (integer)
        > Reputation cannot increase higher than this value. Zero or positive.

##### `GET` /core/authenticated_sessions/&#123;uuid&#125;/

###### Parameters:

Changed: `uuid` in `path`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `expires`
    - `last_user_agent`
    * Changed property `last_ip` (string)

    * Changed property `last_user_agent` (string)

    * Changed property `expires` (string)

##### `DELETE` /core/authenticated_sessions/&#123;uuid&#125;/

###### Parameters:

Changed: `uuid` in `path`

##### `GET` /core/brands/&#123;brand_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `branding_custom_css` (string)

    - Added property `branding_default_flow_background` (string)

##### `PUT` /core/brands/&#123;brand_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `branding_custom_css` (string)

- Added property `branding_default_flow_background` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `branding_custom_css` (string)

    - Added property `branding_default_flow_background` (string)

##### `PATCH` /core/brands/&#123;brand_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `branding_custom_css` (string)

- Added property `branding_default_flow_background` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `branding_custom_css` (string)

    - Added property `branding_default_flow_background` (string)

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.enterprise.policies.unique_password`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_rbac.initialpermissions`
        - `authentik_sources_ldap.userldapsourceconnection`
        - `authentik_sources_ldap.groupldapsourceconnection`
        - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `PUT` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:
    - `authentik.enterprise.policies.unique_password`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.enterprise.policies.unique_password`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_rbac.initialpermissions`
        - `authentik_sources_ldap.userldapsourceconnection`
        - `authentik_sources_ldap.groupldapsourceconnection`
        - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `PATCH` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:
    - `authentik.enterprise.policies.unique_password`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.enterprise.policies.unique_password`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_rbac.initialpermissions`
        - `authentik_sources_ldap.userldapsourceconnection`
        - `authentik_sources_ldap.groupldapsourceconnection`
        - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `GET` /providers/scim/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `compatibility_mode` (object)

        > Alter authentik behavior for vendor-specific SCIM implementations.

        Enum values:
        - `default`
        - `aws`
        - `slack`

    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `PUT` /providers/scim/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `compatibility_mode` (object)

    > Alter authentik behavior for vendor-specific SCIM implementations.

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `compatibility_mode` (object)

        > Alter authentik behavior for vendor-specific SCIM implementations.

    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `PATCH` /providers/scim/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `compatibility_mode` (object)

    > Alter authentik behavior for vendor-specific SCIM implementations.

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `compatibility_mode` (object)

        > Alter authentik behavior for vendor-specific SCIM implementations.

    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `GET` /providers/scim_groups/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `attributes`
    * Added property `attributes` (object)

##### `GET` /providers/scim_users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `attributes`
    * Added property `attributes` (object)

##### `GET` /core/authenticated_sessions/

###### Parameters:

Added: `session__last_ip` in `query`

Added: `session__last_user_agent` in `query`

Deleted: `last_ip` in `query`

Deleted: `last_user_agent` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatedSession Serializer

        New required properties:
        - `expires`
        - `last_user_agent`
        * Changed property `last_ip` (string)

        * Changed property `last_user_agent` (string)

        * Changed property `expires` (string)

##### `GET` /core/authenticated_sessions/&#123;uuid&#125;/used_by/

###### Parameters:

Changed: `uuid` in `path`

##### `POST` /core/brands/

###### Request:

Changed content type : `application/json`

- Added property `branding_custom_css` (string)

- Added property `branding_default_flow_background` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `branding_custom_css` (string)

    - Added property `branding_default_flow_background` (string)

##### `GET` /core/brands/

###### Parameters:

Added: `branding_default_flow_background` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Brand Serializer
        - Added property `branding_custom_css` (string)

        - Added property `branding_default_flow_background` (string)

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `branding_custom_css`
    * Added property `branding_custom_css` (string)

##### `GET` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `PUT` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `PATCH` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `GET` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `date_joined`
    * Added property `date_joined` (string)

##### `PUT` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `date_joined`
    * Added property `date_joined` (string)

##### `PATCH` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `date_joined`
    * Added property `date_joined` (string)

##### `GET` /events/transports/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webhook_mapping_body` (string)

        > Customize the body of the request. Mapping should return data that is JSON-serializable.

    - Added property `webhook_mapping_headers` (string)

        > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

    - Deleted property `webhook_mapping` (string)

##### `PUT` /events/transports/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webhook_mapping_body` (string)

    > Customize the body of the request. Mapping should return data that is JSON-serializable.

- Added property `webhook_mapping_headers` (string)

    > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

- Deleted property `webhook_mapping` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webhook_mapping_body` (string)

        > Customize the body of the request. Mapping should return data that is JSON-serializable.

    - Added property `webhook_mapping_headers` (string)

        > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

    - Deleted property `webhook_mapping` (string)

##### `PATCH` /events/transports/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webhook_mapping_body` (string)

    > Customize the body of the request. Mapping should return data that is JSON-serializable.

- Added property `webhook_mapping_headers` (string)

    > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

- Deleted property `webhook_mapping` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webhook_mapping_body` (string)

        > Customize the body of the request. Mapping should return data that is JSON-serializable.

    - Added property `webhook_mapping_headers` (string)

        > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

    - Deleted property `webhook_mapping` (string)

##### `GET` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `PUT` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `PATCH` /policies/bindings/&#123;policy_binding_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:
    - `authentik.enterprise.policies.unique_password`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum value:
        - `authentik.enterprise.policies.unique_password`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_rbac.initialpermissions`
        - `authentik_sources_ldap.userldapsourceconnection`
        - `authentik_sources_ldap.groupldapsourceconnection`
        - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `GET` /policies/event_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Changed property `app` (string)

            > Match events created by selected application. When left empty, all applications are matched.

            Added enum value:
            - `authentik.enterprise.policies.unique_password`

        - Changed property `model` (string)

            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

            Added enum values:
            - `authentik_rbac.initialpermissions`
            - `authentik_sources_ldap.userldapsourceconnection`
            - `authentik_sources_ldap.groupldapsourceconnection`
            - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `GET` /providers/google_workspace/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `PUT` /providers/google_workspace/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `PATCH` /providers/google_workspace/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `GET` /providers/microsoft_entra/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `PUT` /providers/microsoft_entra/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `PATCH` /providers/microsoft_entra/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `GET` /providers/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `authn_context_class_ref_mapping` (string)

        > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

    - Changed property `acs_url` (string)

##### `PUT` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `authn_context_class_ref_mapping` (string)

    > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

- Changed property `acs_url` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `authn_context_class_ref_mapping` (string)

        > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

    - Changed property `acs_url` (string)

##### `PATCH` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `authn_context_class_ref_mapping` (string)

    > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

- Changed property `acs_url` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `authn_context_class_ref_mapping` (string)

        > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

    - Changed property `acs_url` (string)

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Added property `compatibility_mode` (object)

    > Alter authentik behavior for vendor-specific SCIM implementations.

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `compatibility_mode` (object)

        > Alter authentik behavior for vendor-specific SCIM implementations.

    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProvider Serializer
        - Added property `compatibility_mode` (object)

            > Alter authentik behavior for vendor-specific SCIM implementations.

        - Added property `dry_run` (boolean)
            > When enabled, provider will not modify or create objects in the remote system.

##### `POST` /providers/scim_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `attributes`
    * Added property `attributes` (object)

##### `GET` /providers/scim_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProviderGroup Serializer

        New required properties:
        - `attributes`
        * Added property `attributes` (object)

##### `POST` /providers/scim_users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `attributes`
    * Added property `attributes` (object)

##### `GET` /providers/scim_users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProviderUser Serializer

        New required properties:
        - `attributes`
        * Added property `attributes` (object)

##### `GET` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `PUT` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `PATCH` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `POST` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `PATCH` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `POST` /rbac/permissions/assigned_by_users/&#123;id&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `PATCH` /rbac/permissions/assigned_by_users/&#123;id&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_rbac.initialpermissions`
    - `authentik_sources_ldap.userldapsourceconnection`
    - `authentik_sources_ldap.groupldapsourceconnection`
    - `authentik_policies_unique_password.uniquepasswordpolicy`

##### `DELETE` /sources/all/&#123;slug&#125;/

##### `GET` /sources/group_connections/kerberos/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/group_connections/kerberos/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/group_connections/kerberos/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/group_connections/oauth/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/group_connections/oauth/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/group_connections/oauth/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/group_connections/plex/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/group_connections/plex/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/group_connections/plex/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/group_connections/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/group_connections/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/group_connections/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/ldap/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `lookup_groups_from_user` (boolean)
        > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

##### `PUT` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `lookup_groups_from_user` (boolean)
    > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `lookup_groups_from_user` (boolean)
        > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

##### `PATCH` /sources/ldap/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `lookup_groups_from_user` (boolean)
    > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `lookup_groups_from_user` (boolean)
        > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

##### `GET` /sources/oauth/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `authorization_code_auth_method` (object)

        > How to perform authentication during an authorization_code token request flow

        Enum values:
        - `basic_auth`
        - `post_body`

##### `PUT` /sources/oauth/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `authorization_code_auth_method` (object)
    > How to perform authentication during an authorization_code token request flow

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `authorization_code_auth_method` (object)
        > How to perform authentication during an authorization_code token request flow

##### `PATCH` /sources/oauth/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `authorization_code_auth_method` (object)
    > How to perform authentication during an authorization_code token request flow

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `authorization_code_auth_method` (object)
        > How to perform authentication during an authorization_code token request flow

##### `GET` /sources/saml/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `sso_url` (string)

        > URL that the initial Login request is sent to.

    - Changed property `slo_url` (string)
        > Optional URL if your IDP supports Single-Logout.

##### `PUT` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `sso_url` (string)

    > URL that the initial Login request is sent to.

- Changed property `slo_url` (string)
    > Optional URL if your IDP supports Single-Logout.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `sso_url` (string)

        > URL that the initial Login request is sent to.

    - Changed property `slo_url` (string)
        > Optional URL if your IDP supports Single-Logout.

##### `PATCH` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `sso_url` (string)

    > URL that the initial Login request is sent to.

- Changed property `slo_url` (string)
    > Optional URL if your IDP supports Single-Logout.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `sso_url` (string)

        > URL that the initial Login request is sent to.

    - Changed property `slo_url` (string)
        > Optional URL if your IDP supports Single-Logout.

##### `GET` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `PUT` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `PATCH` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /sources/user_connections/all/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `identifier`
    - `last_updated`
    * Added property `identifier` (string)

    * Added property `last_updated` (string)

##### `PUT` /sources/user_connections/all/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

New required properties:

- `identifier`

* Added property `identifier` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `identifier`
    - `last_updated`
    * Added property `identifier` (string)

    * Added property `last_updated` (string)

##### `PATCH` /sources/user_connections/all/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `identifier` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `identifier`
    - `last_updated`
    * Added property `identifier` (string)

    * Added property `last_updated` (string)

##### `DELETE` /sources/user_connections/kerberos/&#123;id&#125;/

##### `GET` /sources/user_connections/kerberos/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/user_connections/kerberos/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/user_connections/kerberos/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `DELETE` /sources/user_connections/oauth/&#123;id&#125;/

##### `GET` /sources/user_connections/oauth/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

    * Changed property `identifier` (string)

##### `PUT` /sources/user_connections/oauth/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `identifier` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

    * Changed property `identifier` (string)

##### `PATCH` /sources/user_connections/oauth/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `identifier` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

    * Changed property `identifier` (string)

##### `DELETE` /sources/user_connections/plex/&#123;id&#125;/

##### `GET` /sources/user_connections/plex/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/user_connections/plex/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/user_connections/plex/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `DELETE` /sources/user_connections/saml/&#123;id&#125;/

##### `GET` /sources/user_connections/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PUT` /sources/user_connections/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `PATCH` /sources/user_connections/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /ssf/streams/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider_obj` (object)

        > SSFProvider Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer

                New required properties:
                - `date_joined`
                * Added property `date_joined` (string)

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /core/user_consent/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `date_joined`
    * Added property `date_joined` (string)

##### `GET` /core/users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `POST` /events/transports/

###### Request:

Changed content type : `application/json`

- Added property `webhook_mapping_body` (string)

    > Customize the body of the request. Mapping should return data that is JSON-serializable.

- Added property `webhook_mapping_headers` (string)

    > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

- Deleted property `webhook_mapping` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `webhook_mapping_body` (string)

        > Customize the body of the request. Mapping should return data that is JSON-serializable.

    - Added property `webhook_mapping_headers` (string)

        > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

    - Deleted property `webhook_mapping` (string)

##### `GET` /events/transports/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationTransport Serializer
        - Added property `webhook_mapping_body` (string)

            > Customize the body of the request. Mapping should return data that is JSON-serializable.

        - Added property `webhook_mapping_headers` (string)

            > Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs

        - Deleted property `webhook_mapping` (string)

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PolicyBinding Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `POST` /providers/google_workspace/

###### Request:

Changed content type : `application/json`

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `GET` /providers/google_workspace/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > GoogleWorkspaceProvider Serializer
        - Added property `dry_run` (boolean)
            > When enabled, provider will not modify or create objects in the remote system.

##### `POST` /providers/google_workspace/&#123;id&#125;/sync/object/

###### Request:

Changed content type : `application/json`

- Added property `override_dry_run` (boolean)

##### `POST` /providers/microsoft_entra/

###### Request:

Changed content type : `application/json`

- Added property `dry_run` (boolean)
    > When enabled, provider will not modify or create objects in the remote system.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

##### `GET` /providers/microsoft_entra/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > MicrosoftEntraProvider Serializer
        - Added property `dry_run` (boolean)
            > When enabled, provider will not modify or create objects in the remote system.

##### `POST` /providers/microsoft_entra/&#123;id&#125;/sync/object/

###### Request:

Changed content type : `application/json`

- Added property `override_dry_run` (boolean)

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Added property `authn_context_class_ref_mapping` (string)

    > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

- Changed property `acs_url` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `authn_context_class_ref_mapping` (string)

        > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

    - Changed property `acs_url` (string)

##### `GET` /providers/saml/

###### Parameters:

Added: `authn_context_class_ref_mapping` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLProvider Serializer
        - Added property `authn_context_class_ref_mapping` (string)

            > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

        - Changed property `acs_url` (string)

##### `POST` /providers/scim/&#123;id&#125;/sync/object/

###### Request:

Changed content type : `application/json`

- Added property `override_dry_run` (boolean)

##### `POST` /providers/ssf/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /providers/ssf/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFProvider Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer

                New required properties:
                - `date_joined`
                * Added property `date_joined` (string)

##### `GET` /rbac/permissions/assigned_by_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned_by_users/

###### Parameters:

Changed: `model` in `query`

##### `GET` /sources/group_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `POST` /sources/group_connections/oauth/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/group_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `POST` /sources/group_connections/plex/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/group_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `GET` /sources/group_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `lookup_groups_from_user` (boolean)
    > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `lookup_groups_from_user` (boolean)
        > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

##### `GET` /sources/ldap/

###### Parameters:

Added: `lookup_groups_from_user` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > LDAP Source Serializer
        - Added property `lookup_groups_from_user` (boolean)
            > Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Added property `authorization_code_auth_method` (object)
    > How to perform authentication during an authorization_code token request flow

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `authorization_code_auth_method` (object)
        > How to perform authentication during an authorization_code token request flow

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth Source Serializer
        - Added property `authorization_code_auth_method` (object)
            > How to perform authentication during an authorization_code token request flow

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Changed property `sso_url` (string)

    > URL that the initial Login request is sent to.

- Changed property `slo_url` (string)
    > Optional URL if your IDP supports Single-Logout.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `sso_url` (string)

        > URL that the initial Login request is sent to.

    - Changed property `slo_url` (string)
        > Optional URL if your IDP supports Single-Logout.

##### `GET` /sources/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLSource Serializer
        - Changed property `sso_url` (string)

            > URL that the initial Login request is sent to.

        - Changed property `slo_url` (string)
            > Optional URL if your IDP supports Single-Logout.

##### `POST` /sources/scim/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /sources/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMSource Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer

                New required properties:
                - `date_joined`
                * Added property `date_joined` (string)

##### `GET` /sources/user_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection

        New required properties:
        - `identifier`
        - `last_updated`
        * Added property `identifier` (string)

        * Added property `last_updated` (string)

##### `POST` /sources/user_connections/kerberos/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/user_connections/kerberos/

###### Parameters:

Added: `user` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `POST` /sources/user_connections/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `identifier` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

    * Changed property `identifier` (string)

##### `GET` /sources/user_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

        * Changed property `identifier` (string)

##### `POST` /sources/user_connections/plex/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/user_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `POST` /sources/user_connections/saml/

###### Request:

Changed content type : `application/json`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `last_updated`
    * Added property `last_updated` (string)

##### `GET` /sources/user_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection

        New required properties:
        - `last_updated`
        * Added property `last_updated` (string)

##### `GET` /ssf/streams/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFStream Serializer
        - Changed property `provider_obj` (object)

            > SSFProvider Serializer
            - Changed property `token_obj` (object)

                > Token Serializer
                - Changed property `user_obj` (object)

                    > User Serializer

                    New required properties:
                    - `date_joined`
                    * Added property `date_joined` (string)

##### `GET` /stages/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_expiry` (integer -> string)
        > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

##### `PUT` /stages/email/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `token_expiry` (integer -> string)
    > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_expiry` (integer -> string)
        > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

##### `PATCH` /stages/email/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `token_expiry` (integer -> string)
    > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_expiry` (integer -> string)
        > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

##### `GET` /stages/identification/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `enable_remember_me` (boolean)
        > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

##### `PUT` /stages/identification/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `enable_remember_me` (boolean)
    > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `enable_remember_me` (boolean)
        > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

##### `PATCH` /stages/identification/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `enable_remember_me` (boolean)
    > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `enable_remember_me` (boolean)
        > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

##### `GET` /core/user_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserConsent Serializer
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-identification` component:
    - Added property `enable_remember_me` (boolean)

##### `POST` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-identification` component:
    - Added property `enable_remember_me` (boolean)

##### `GET` /oauth2/access_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `GET` /oauth2/authorization_codes/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer

        New required properties:
        - `date_joined`
        * Added property `date_joined` (string)

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Changed property `token_expiry` (integer -> string)
    > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `token_expiry` (integer -> string)
        > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

##### `GET` /stages/email/

###### Parameters:

Changed: `token_expiry` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > EmailStage Serializer
        - Changed property `token_expiry` (integer -> string)
            > Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).

##### `POST` /stages/identification/

###### Request:

Changed content type : `application/json`

- Added property `enable_remember_me` (boolean)
    > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `enable_remember_me` (boolean)
        > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > IdentificationStage Serializer
        - Added property `enable_remember_me` (boolean)
            > Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

    Updated `authentik_providers_microsoft_entra.microsoftentraprovider` provider_model:
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

    Updated `authentik_providers_scim.scimprovider` provider_model:
    - Added property `compatibility_mode` (object)

        > Alter authentik behavior for vendor-specific SCIM implementations.

    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

    Updated `authentik_providers_google_workspace.googleworkspaceprovider` provider_model:
    - Added property `dry_run` (boolean)
        > When enabled, provider will not modify or create objects in the remote system.

    Updated `authentik_providers_saml.samlprovider` provider_model:
    - Added property `authn_context_class_ref_mapping` (string)

        > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

    - Changed property `acs_url` (string)

##### `GET` /oauth2/access_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /oauth2/authorization_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

##### `GET` /oauth2/refresh_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer

            New required properties:
            - `date_joined`
            * Added property `date_joined` (string)

---

## Release 2025.6

## Highlights

- **mTLS Stage**:  The Mutual TLS stage provides support for mTLS, a standard protocol that uses certificates for mutual authentication between a client and a server.

- **Email verification compatibility with link scanners**: We have improved compatibility for environments that have automated scanning software that inadvertently invalidated one-time links sent by authentik.

- **LDAP source sync forward deletions**: This option synchronizes the deletion of users and groups from LDAP sources to authentik.

## Breaking changes

- **Helm chart dependencies upgrades**:
  - The PostgreSQL chart has been updated to version 16.7.4. The PostgreSQL image is no longer pinned in authentik's default values and has been upgraded from version 15 to 17. Follow our [PostgreSQL upgrade instructions](../../troubleshooting/postgres/upgrade_kubernetes.mdx) to update to the latest PostgreSQL version.
  - The Redis chart has been updated to version 21.1.6. There are no breaking changes and Redis has been upgraded from version 7 to 8.

- **Deprecated and frozen `:latest` container image tag after 2025.2**

  Using the `:latest` tag with container images is not recommended as it can lead to unintentional updates and potentially broken setups. The tag will not be removed, however it will also not be updated past 2025.2. We strongly recommend using a specific version tag for authentik instances' container images, such as `:2025.6`.

- **CSS**: We’ve made some improvements to our theming system. If your authentik instance uses custom CSS, you might need to review flow and user interfaces for any visual changes.

## New features and improvements

- **mTLS stage**:  The Mutual TLS stage enables authentik to use client certificates to enroll and authenticate users. These certificates can be local to the device or available via PIV Smart Cards, Yubikeys, etc. For environments where certificates are already rolled out, this can make authentication a lot more seamless. Refer to our [technical documentation](../../add-secure-apps/flows-stages/stages/mtls/index.mdx) for more information.
- **Email verification compatibility with link scanners**: We have improved compatibility for environments with automated scanning software that inadvertently invalidated one-time links sent by authentik.
- **LDAP source sync forward deletions**: With this option enabled, users or groups created in authentik via LDAP sources will also be removed from authentik if they are deleted from the LDAP source. For more information, please refer to our [LDAP source documentation](../../users-sources/sources/protocols/ldap/index.mdx).
- **Provider sync performance**: We have implemented parallel scheduling for outgoing syncs to provide faster synchronization.
- **Branding**: Custom branding should now be more consistent on initial load, without flickering.
- **Remote Access Control (RAC) improved [documentation](https://docs.goauthentik.io/docs/add-secure-apps/providers/rac/)**: Added content about how to authenticate using a public key and improved the wording and formatting throughout the topic.

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added to our documentation:

- [Atlassian Cloud (Jira, Confluence, etc)](/integrations/services/atlassian/)
- [Coder](/integrations/services/coder/)
- [FileRise](/integrations/services/filerise/)
- [Komodo](/integrations/services/komodo/)
- [Pangolin](/integrations/services/pangolin/)
- [Push Security](/integrations/services/push-security/)
- [Stripe](/integrations/services/stripe/)
- [Tailscale](/integrations/services/tailscale/)
- [YouTrack](/integrations/services/youtrack/)

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2025.6/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.6
```

## Minor changes/fixes

- brands: fix CSS Migration not updating brands (#14306)
- core: fix session migration when old session can't be loaded (#14466)
- core: fix unable to create group if no enable\_group\_superuser permission is given (#14510)
- core: Migrate permissions before deleting OldAuthenticatedSession (#14788)
- core: Publish web packages. (#14648)
- core: remove `OldAuthenticatedSession` content type (#14507)
- enterprise: fix expired license's users being counted (#14451)
- enterprise/stages: Add MTLS stage (#14296)
- enterprise/stages/mtls: improve certificate validation (#14582)
- enterprise/stages/mtls: update go & web client, fix py client generation (#14576)
- lib/sync: fix static incorrect label of pages (#14851)
- lib/sync/outgoing: reduce number of db queries made (#14177)
- lib/sync/outgoing: sync in parallel (#14697)
- lifecycle: fix ak dump\_config (#14445)
- lifecycle: fix test-all in docker (#14244)
- outposts: fix tmpdir in containers not being set (#14444)
- providers/ldap: retain binder and update users instead of re-creating (#14735)
- providers/proxy: kubernetes outpost: fix reconcile when ingress class name changed (#14612)
- providers/rac: apply ConnectionToken scoped-settings last (#14838)
- rbac: add `name` to Permissions search (#14269)
- rbac: fix RoleObjectPermissionTable not showing `add_user_to_group` (#14312)
- root: backport SFE Build fix (#14495)
- root: do not use /bin/bash directly (#14698)
- root: improve sentry distributed tracing (#14468)
- root: move forked dependencies to goauthentik org (#14590)
- root: pin package version in pyproject for dependabot (#14469)
- root: readme: use right contribution guide link (#14250)
- root: replace raw\.githubusercontent.com by checking out repo (#14567)
- root: temporarily deactivate database pool option (#14443)
- sources/kerberos: resolve logger warnings (#14540)
- sources/ldap: add forward deletion option (#14718)
- stages/email: fix email scanner voiding token (#14325)
- tests/e2e: Add E2E tests for Flow SFE (#14484)
- tests/e2e: add test for authentication flow in compatibility mode (#14392)
- tests/e2e: fix flaky SAML Source test (#14708)
- web, website: update browserslist (#14386)
- web: Add specific Storybook dependency. (#14719)
- web: Clean up browser-only module imports that crash WebDriverIO. (#14330)
- web: cleanup/loading attribute always true (#14288)
- web: Controller refinements, error handling (#14700)
- Web: Controllers cleanup (#14616)
- web: fix bug that was causing charts to be too tall (#14253)
- web: fix description for signing responses in SAML provider (#14573)
- web: Fix issue where dual select type is not specific. (#14783)
- web: Fix issue where Storybook cannot resolve styles. (#14553)
- web: Fix missing Enterprise sidebar entries. (#14615)
- web: fix regression in subpath support (#14646)
- web: NPM workspaces (#14274)
- web: Type Tidy (#14647)
- web: Use engine available on Github Actions. (#14699)
- web: Use monorepo package utilities to build packages (#14159)
- web/admin: Dual select state management, custom event dispatching. (#14490)
- web/admin: fix enterprise menu display (#14447)
- web/admin: fix permissions modal button missing for PolicyBindings and FlowStageBindings (#14619)
- web/admin: Fix sidebar toggle synchronization. (#14487)
- web/admin: prevent default logo flashing in admin interface (#13960)
- web/flows: update default flow background (#14769)
- web/flows/sfe: fix global background image not being loaded (#14442)

## Fixed in 2025.6.1

- providers/proxy: add option to override host header with property mappings (cherry-pick #14927) (#14945)
- tenants: fix tenant aware celery scheduler (cherry-pick #14921)
- web/user: fix user settings flow not loading (cherry-pick #14911) (#14930)

## Fixed in 2025.6.2

- brands: fix custom\_css being escaped (cherry-pick #14994) (#14996)
- core: bump django from 5.1.10 to 5.1.11 (cherry-pick #14997) (#15010)
- core: bump django from 5.1.9 to 5.1.10 (cherry-pick #14951) (#15008)
- internal/outpost: fix incorrect usage of golang SHA API (cherry-pick #14981) (#14982)
- providers/rac: fixes prompt data not being merged with connection\_settings (cherry-pick #15037) (#15038)
- stages/email: Only attach logo to email if used (cherry-pick #14835) (#14969)
- web/elements: fix dual select without sortBy (cherry-pick #14977) (#14979)
- web/elements: fix typo in localeComparator (cherry-pick #15054) (#15055)

## Fixed in 2025.6.3

- ci: fix CodeQL failing on cherry-pick PRs (cherry-pick #15205) (#15206)
- ci: fix post-release e2e builds failing (cherry-pick #15082) (#15092)
- core: bump goauthentik/fips-python from 3.13.3-slim-bookworm-fips to 3.13.5-slim-bookworm-fips in 2025.6 (#15274)
- core: bump protobuf from 6.30.2 to v6.31.1 (cherry-pick #14894) (#15173)
- core: bump requests from 2.32.3 to v2.32.4 (cherry-pick #15129) (#15135)
- core: bump tornado from 6.4.2 to v6.5.1 (cherry-pick #15100) (#15116)
- core: bump urllib3 from 2.4.0 to v2.5.0 (cherry-pick #15131) (#15174)
- security: fix CVE-2025-52553 (cherry-pick #15289) (#15290)
- sources/ldap: fix sync on empty groups (cherry-pick #15158) (#15171)
- stages/user\_login: fix session binding logging (#15175)
- web/elements: Add light mode custom css handling (cherry-pick #14944) (#15096)
- web/elements: typing error when variables are not converted to string (cherry-pick #15169) (#15222)
- web/user: fix infinite loop when no user settings flow is set (cherry-pick #15188) (#15192)

## Fixed in 2025.6.4

- web/elements: fix table search not resetting page when query changes (cherry-pick #15324) (#15326)
- core: fix missing serializer on AuthenticatedSession (cherry-pick #15323) (#15365)
- core: fix set\_token\_key permission not declared (cherry-pick #15384) (#15391)
- providers/proxy: fix ingress-nginx proxy buffer size annotations (cherry-pick #15506) by (#15507)
- providers/radius: set message authenticator (cherry-pick #15635) (#15665)

## API Changes

#### What's New

***

##### `GET` /stages/mtls/

##### `POST` /stages/mtls/

##### `GET` /stages/mtls/\{stage\_uuid}/

##### `PUT` /stages/mtls/\{stage\_uuid}/

##### `DELETE` /stages/mtls/\{stage\_uuid}/

##### `PATCH` /stages/mtls/\{stage\_uuid}/

##### `GET` /stages/mtls/\{stage\_uuid}/used\_by/

#### What's Changed

***

##### `GET` /core/brands/\{brand\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `client_certificates` (array)

    > Certificates used for client authentication.

    Items (string):

##### `PUT` /core/brands/\{brand\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `client_certificates` (array)
  > Certificates used for client authentication.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `client_certificates` (array)
    > Certificates used for client authentication.

##### `PATCH` /core/brands/\{brand\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `client_certificates` (array)
  > Certificates used for client authentication.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `client_certificates` (array)
    > Certificates used for client authentication.

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.enterprise.stages.mtls`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_stages_mtls.mutualtlsstage`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.enterprise.stages.mtls`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.enterprise.stages.mtls`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_stages_mtls.mutualtlsstage`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.enterprise.stages.mtls`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.enterprise.stages.mtls`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_stages_mtls.mutualtlsstage`

##### `POST` /core/brands/

###### Request:

Changed content type : `application/json`

- Added property `client_certificates` (array)
  > Certificates used for client authentication.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `client_certificates` (array)
    > Certificates used for client authentication.

##### `GET` /core/brands/

###### Parameters:

Added: `client_certificates` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Brand Serializer

    - Added property `client_certificates` (array)
      > Certificates used for client authentication.

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum value:

  - `authentik.enterprise.stages.mtls`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum value:

    - `authentik.enterprise.stages.mtls`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_stages_mtls.mutualtlsstage`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum value:

      - `authentik.enterprise.stages.mtls`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum value:

      - `authentik_stages_mtls.mutualtlsstage`

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_stages_mtls.mutualtlsstage`

##### `GET` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `delete_not_found_objects` (boolean)
    > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

##### `PUT` /sources/ldap/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `delete_not_found_objects` (boolean)
  > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `delete_not_found_objects` (boolean)
    > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

##### `PATCH` /sources/ldap/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `delete_not_found_objects` (boolean)
  > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `delete_not_found_objects` (boolean)
    > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `delete_not_found_objects` (boolean)
  > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `delete_not_found_objects` (boolean)
    > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

##### `GET` /sources/ldap/

###### Parameters:

Added: `delete_not_found_objects` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAP Source Serializer

    - Added property `delete_not_found_objects` (boolean)
      > Delete authentik users and groups which were previously supplied by this source, but are now missing from it.

---

## Release 2025.8

## Highlights

- **OAuth2/OpenID Connect back-channel logout**:  A server-to-server notification mechanism that allows authentik to notify OAuth2/OpenID providers whenever a user's session is terminated. Learn [more](../../add-secure-apps/providers/oauth2/frontchannel_and_backchannel_logout.mdx).

- **Event map**:  View geolocation of user events on a map.

![Screenshot of the admin interface showing events plotted on a histogram chart and on a map](../../sys-mgmt/events/event-map-chart.png)

- **Advanced search**:  Search with [AKQL](../../sys-mgmt/akql.mdx) to filter users and event logs by their properties and attributes.

- **Email stage rate limiting**: The email stage can now be configured to set a maximum number of emails that can be sent within a specified time period.

## Breaking changes

### Worker and background tasks revamped

The authentik [worker](../../sys-mgmt/ops/worker.mdx) and [background tasks](../../sys-mgmt/background-tasks.mdx) have been reworked for better observability of tasks, and better configurability of scheduled tasks.

This rework also allowed us to not depend on Redis for background tasks. However, we replaced the engine used to manage these tasks, and as such, don't have a seamless migration path.

For instances with a high level of traffic, such as many users logging in, many sign up requests, etc., some tasks may be lost during the upgrade. Instances with low traffic can upgrade during periods of downtime.

To prevent losing tasks during the upgrade, instances with a high level of traffic should follow these instructions:

1. Start by upgrading the authentik server.
2. Inspect the old version task queue to check that all tasks are done. Execute the following commands in the not-yet-upgraded worker container:

```sh
docker compose exec worker bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect active'
docker compose exec worker bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect scheduled'
docker compose exec worker bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect reserved'
```

```sh
kubectl exec -it deployment/authentik-worker -c worker -- bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect active'
kubectl exec -it deployment/authentik-worker -c worker -- bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect scheduled'
kubectl exec -it deployment/authentik-worker -c worker -- bash -c 'DJANGO_SETTINGS_MODULE=authentik.root.settings celery -A authentik.root.celery inspect reserved'
```

3. Wait for all these commands to report the old task queues as "empty"
4. Finish by upgrading the worker

### Docker image deprecation notice for `beryju/authentik` and `beryju/authentik-*`

The `beryju/authentik` and `beryju/authentik-*` Docker images are no longer being updated. Users are now encouraged to use the following images:

- **Server image:**
  - `ghcr.io/goauthentik/server` or `authentik/server`

- **Outpost images:**
  - `ghcr.io/goauthentik/ldap` or `authentik/ldap`
  - `ghcr.io/goauthentik/proxy` or `authentik/proxy`
  - `ghcr.io/goauthentik/rac` or `authentik/rac`
  - `ghcr.io/goauthentik/radius` or `authentik/radius`

We recommend updating your Docker Compose files or other container configurations to use these new image paths.

### Database encoding requirements

The PostgreSQL database must now use the `UTF8` encoding. This is the default encoding that PostgreSQL uses. Unless you have specifically chosen a different encoding when creating the authentik database, no change is needed.

### Renamed/removed settings

The `AUTHENTIK_WORKER__CONCURRENCY` setting has been renamed `AUTHENTIK_WORKER__THREADS`. The old setting is still available as an alias and will be removed in a future release.

The following settings have been removed and no longer have an effect:

- `AUTHENTIK_BROKER__URL`
- `AUTHENTIK_BROKER__TRANSPORT_OPTIONS`
- `AUTHENTIK_RESULT_BACKEND__URL`

### Renamed/removed metrics

The `authentik_admin_workers` metric has been renamed `authentik_tasks_workers`.

The following metrics have been removed:

- `authentik_system_tasks`
- `authentik_system_tasks_time_seconds`
- `authentik_system_tasks_status`

Instead, the following metrics are now available:

- `authentik_tasks_total`
- `authentik_tasks_errors_total`
- `authentik_tasks_retries_total`
- `authentik_tasks_rejected_total`
- `authentik_tasks_in_progress`
- `authentik_tasks_delayed_in_progress`
- `authentik_tasks_duration_milliseconds`

### Prometheus metrics

The tasks metrics are no longer exposed by the server, but by the worker. For Helm chart users, add the following values to enable a `ServiceMonitor` to scrape those metrics:

```yaml
worker:
    metrics:
        enabled: true
        serviceMonitor:
            enabled: true
```

### Helm chart changes

Due to [Bitnami upcoming changes](https://github.com/bitnami/containers/issues/83267) to availability of their container images, the Helm chart default values have been updated to instead use [docker.io/library/postgres](https://hub.docker.com/_/postgres) and [docker.io/library/redis](https://hub.docker.com/_/redis). If you are setting custom values for either PostgreSQL or Redis, please review the [associated Helm chart changes](https://github.com/goauthentik/helm/pull/385) to update your values.

Redis has also been updated from 8.0 to 8.2.

From this point on, we recommend using the bundled PostgreSQL dependency for demonstration and test purposes only. See our [installation documentation](../../install-config/install/kubernetes.mdx) for alternatives to run PostgreSQL in a production environment.

## New features and improvements

- **LDAP Provider improvements**:
  - Group objects returned by queries to the LDAP provider now includes a `memberOf` field pointing back to its parent if set. Contributed by [@danieladugyan](https://github.com/danieladugyan), thank you!
  - LDAP connections are now terminated upon session deletion in authentik.

- **Accessibility improvements**: Better screen reader support within the admin interface for navigation, forms, and wizard elements.

- **Send event notifications to associated user**: Configure notification rules to send the event notification to the user associated to the event. Read more in our [notifications documentation](../../sys-mgmt/events/notifications.mdx).

- **Policy bindings performance improvements**: Policy bindings evaluation avoids forking new processes for user and group policy bindings.

- **SCIM Source patch support**: Add full patch support for all properties of users and groups.

- **Secret inputs in the admin interface are now hidden by default**.

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added.

- [1Password](https://integrations.goauthentik.io/security/1password/)
- [Bitwarden](https://integrations.goauthentik.io/security/bitwarden/)
- [Papra](https://integrations.goauthentik.io/documentation/papra/)
- [Planka](https://integrations.goauthentik.io/chat-communication-collaboration/planka/)
- [Seafile](https://integrations.goauthentik.io/media/seafile/)
- [Vaultwarden](https://integrations.goauthentik.io/security/vaultwarden/)
- [Zoho](https://integrations.goauthentik.io/platforms/zoho/)

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new Docker Compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O docker-compose.yml https://goauthentik.io/version/2025.8/docker-compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.8
```

## Minor changes/fixes

- \*: remove redundant user\_logged\_out signals (#15221)
- \*: replace Celery with Dramatiq (#13492)
- \*: use ManagedAppConfig everywhere (#14839)
- admin: only run update checks in the default tenant (#14874)
- blueprints: add File tag (#15727)
- blueprints: add FindObject tag (#12415)
- blueprints: add JSON tag to parse JSON from string (#15235)
- blueprints: add section support for organization (#15045)
- blueprints: sort schema items (#15022)
- brands: revert sort matched brand by match length (revert #15413) (cherry-pick #16233) (#16235)
- brands: sort matched brand by match length (#15413)
- core, providers/ldap: add parent/child groups to api and ldap results (#14974)
- core: Add email template selector (cherry-pick #16170) (#16225)
- core: Prevent application creation with reserved slugs (#15930)
- core: add updated\_at field to user (#15571)
- core: better API validation for JSON fields (#15236)
- core: fix flow planner checking against wrong user when creating recovery link (#15390)
- core: include more authenticator details when possible (#15224)
- core: limit User search\_field to pure text only (#16020)
- enterprise/audit: fix diff with update\_fields (#15574)
- enterprise/search: ability to use more precise search queries (#7698)
- enterprise/search: fix schema once again (#15392)
- enterprise/search: fix search fallback for non QL queries (#15325)
- enterprise/stages/source: update outer flow with context from inner flow (#15177)
- enterprise/web/admin: OSM for events (#9287)
- enterprise: fix frontend considering license valid when it isn't (#15578)
- events: add option to send notifications to event user (#15083)
- events: disable all JSON autocomplete (#15138)
- events: disable computation of autocomplete structure for event context (#15137)
- events: fix ak\_client\_ip not set in notification rule policy context (#15464)
- events: fix map again and fix flaky tests (#15154)
- events: improve error formatting in events (#15187)
- events: rework metrics endpoint (#14934)
- events: use pending\_user as user when possible (#15238)
- lib/sync/outgoing: fix page sync task id (#15828)
- lib/sync: drop sync task when triggered by users' last\_login change (#15553)
- outpost/proxyv2: add session cleanup for filesystem session store (#15798)
- outpost: proxy: handle nil HTTP response in attemptBasicAuth function (#13781)
- outposts/ldap: Handle comma-separated attributes in LDAP search requests (#15000)
- outposts: Refactor session end signal and add LDAP support (#14539)
- outposts: remove duplicate startup/setup code, add pyroscope, make sentry not reconfigure every time (#14724)
- packages/django-dramatiq-postgres: broker: avoid exception on consumer final close (#15824)
- packages/django-dramatiq-postgres: broker: fix infinite loop (#16088)
- packages/django-dramatiq-postgres: broker: remember previously fetched notifies (#16128)
- packages/django-dramatiq-postgres: fix typo (#15932)
- packages/django-dramatiq-postgres: run worker in the same base process, use structlog (#16061)
- policies/password: Fix amount\_uppercase in password policy check (cherry-pick #16197) (#16228)
- policies/reputation: fix updated for reputation not updating (#15782)
- policies: Optimize policy checking for static bindings (#14957)
- policies: buffered policy access view for concurrent authorization attempts when unauthenticated (#15034)
- policies: fix typo (#15933)
- providers/oauth2: Add `cause` to debug issues and better tests (#15057)
- providers/oauth2: add conformance tools (#15228)
- providers/oauth2: add support for OAuth 2.0 Authorization Server Metadata endpoint (RFC 8414) (#12383)
- providers/oauth2: backchannel logout (#15401)
- providers/oauth2: bug fixes from conformance testing (#15056)
- providers/proxy: set\_oauth\_defaults in reconcile instead of task (#14875)
- providers/rac: fix incorrect caching (#15779)
- providers/rac: fix property mapping expression not executing (#15819)
- providers/saml: configuration for default NameID Policy (#15109)
- revert: web/flow: cleanup WebAuthn helper functions (#14460)" (#15172)
- revert: web: Font fixes (#15581) (#15789)
- root: Add more opencontainer labels to Dockerfiles (#15923)
- root: add system check for database encoding (#15186)
- root: enhance custom middleware experience (#15919)
- root: extract custom setup code (#15150)
- root: fix custom packages installation in docker (cherry-pick #16150) (#16151)
- root: fix custom packages installation in docker (cherry-pick #16157) (#16158)
- root: fix missing uv run in makefile (#16146)
- root: fix some cases of invalid data triggering exceptions (#14799)
- root: monitoring: force db connection reload before healthcheck (#9970)
- root: remove /if/help (#14929)
- root: support for custom postgresql connection options (#15577)
- root: test label handling and error reporting in PytestTestRunner (#14000)
- root: update Makefile with new commands for docs and integrations (#15689)
- sources/SCIM: Full Patch support for User and Group (#15485)
- sources/oauth: add entra ID source and move logic over (#15538)
- sources/plex: add missing group connection type to flow manager (#15750)
- sources/scim: add group patch support (#15212)
- stages/authenticator\_sms: allow custom message for twilio provider, pass request (#15629)
- stages/authenticator\_validate: fix WebAuthn in android during google account addition (#15351)
- stages/authenticator\_webauthn: add option to configure max attempts (#15041)
- stages/email: implement rate limiting for account verification (#15531)
- stages/email: only update is\_active on user to not overwrite external changes (#15508)
- stages/email: remove superfluous td from account\_confirmation template (#15297)
- stages/prompt: fix list policy for prompt validation failing with multiple policies (#15522)
- stages/user\_login: unknown device (#14459)
- tasks/schedules: fix IntegrityError on schedule update (#15871)
- tasks: add sentry dramatiq integration (cherry-pick #16167) (#16183)
- tasks: fix rel\_obj being removed when task is retried (#15862)
- tests/e2e: WebAuthn E2E tests (#14461)
- web/a11y -- ak-form-group (#15688)
- web/a11y -- ak-form-group part 2: type clean up, Chrome warnings (#15721)
- web/a11y -- ak-sidebar, ak-modal, cards (#15690)
- web/a11y: Form Errors (#15940)
- web/a11y: Form Inputs (#15878)
- web/a11y: License notice ARIA attributes. (#15872)
- web/a11y: Navigation Banner (#15880)
- web/a11y: QL Search Input (cherry-pick #16198) (#16229)
- web/a11y: Tables & Modals (#15877)
- web/admin: Text and Textarea Fields that "hide" their contents until prompted (#15024)
- web/admin: adopt ak-hidden-text (#15042)
- web/admin: fix language in certificate import (#14953)
- web/admin: fix settings saving (cherry-pick #16184) (#16187)
- web/admin: fix variable name (#15934)
- web/admin: hide webhook URL by default (#15136)
- web/admin: improve admin UI for tasks slightly (#15829)
- web/admin: make message container bottom aligned for admin interface (#14816)
- web/admin: point create application to wizard (#15211)
- web/admin: remove all special cases of slug handling, replace with a "smart slug" component (#14983)
- web/admin: show selected policy engine mode on bindings pages, allow setting it on sources (#12963)
- web/admin: use attribute naming scheme for attributes (#14644)
- web/cleanup/empty state better slot handling (#14289)
- web/common: fix form element alignment (#15904)
- web/common: fix uiConfig not merged correctly (#15080)
- web/elements/empty-state: Fix issues with EmptyState and Loading Overlay (#15152)
- web/elements: fix QL autocomplete not working (#16054)
- web/flow: cleanup WebAuthn helper functions (#14460)
- web/flow: fix ak-flow-card layout for identification stage with source and enrollment (#15404)
- web/flow: fix flow dark theme flow footer band; user settings flow (#15408)
- web/flows: fix bottom padding when loading challenge (#15372)
- web/flows: fix flow inspector button always showing (#15893)
- web/flows: more padding fixes (#15467)
- web/flows: update default flow background (#16056)
- web/maintenance: remove `writeOnly` hacks from Form and HorizontalFormElement (#14649)
- web/packages: NPM workspace: Mini Cleanup (#14767)
- web/standards: fix boolean attribute abuse (#14662)
- web/user: fix infinite loop when no user settings flow is set (#15188)
- web/user: fix infinite loop when no user settings flow is set (cherry-pick #15188) (#15192)
- web/user: fix user settings flow not loading (#14911)
- web/user: fix user settings flow not loading (cherry-pick #14911) (#14930)
- web: Add support for placeholder in ak-text-input (#15795)
- web: Clean up WebSocket lifecycle. (#15480)
- web: Clean up file methods. (#15479)
- web: Consistent use of static styles (#15510)
- web: Disable autocomplete. (#15551)
- web: Fix ak-flow-card footer alignment. (cherry-pick #16236) (#16238)
- web: Fix cursor using pointer in modals. (#16009)
- web: Fix dangling div. (#15478)
- web: Fix form captcha submission (#15482)
- web: Fix initial browser color scheme. (#16028)
- web: Fix intermediate wizard steps propagating refresh events to parent (#15548)
- web: Fix issue where TypeDoc comments are arranged between imports. (#15364)
- web: Fix issue where `aria-owns` attribute triggers Chrome crash. (#16003)
- web: Fix issue where base render method is not preferred. (#15726)
- web: Fix lack of error when setting recovery password (#15405)
- web: Fix missing TypeScript dependency when running make for first time. (#15502)
- web: Fix property name mismatch. (#15961)
- web: Fix scroll-event induced tab crash (#15939)
- web: Fix stale application slug, missing error state. (#15941)
- web: Fix wide inputs, label alignment (#16042)
- web: Font fixes (#15581)
- web: Form error rendering (#15874)
- web: Form submission (#15477)
- web: Form validation regressions, consistency fixes (#15894)
- web: Import organization (#14696)
- web: Make Webdriver optional during install. (#15952)
- web: Storybook v9 (#15550)
- web: Update dependencies. Fix categories. (#15748)
- web: Update license mixing types to anticipate load state. (#15634)
- web: Upgrade Prettier import formatter (#15276)
- web: minor design tweaks (#14803)
- web: minor design tweaks (cherry-pick #14803) (#14804)
- web: providers/rac: Fix wizard confirmation (#16013)
- web: remove mdx and fix references to `@goauthentik/elements` (#15694)
- web: rework storybook for flow components and to make the design consistent (#15415)

## Fixed in 2025.8.1

- \*: Fix dead doc link (cherry-pick #16288) (#16297)
- core: use email backend for test\_email management command (cherry-pick #16311) (#16337)
- lifecycle: set PROMETHEUS\_MULTIPROC\_DIR as early as possible (cherry-pick #16298) (#16302)
- outposts: allow ingress path type configuration (cherry-pick #16339) (#16341)
- outposts: fix service connection update task arguments (cherry-pick #16312) (#16313)
- packages/django-dramatiq-postgres: broker: fix various timing issues (cherry-pick #16340) (#16342)
- packages/django-dramatiq-postgres: middleware: fix listening on hosts where ipv6 is not supported (cherry-pick #16308) (#16305)
- providers/oauth2: fix logout token missing sid, fix wrong sub mode used (cherry-pick #16295) (#16299)
- web: Fix form group slots (cherry-pick #16276) (#16277)
- web: Fix hidden textarea required attribute. (cherry-pick #16168) (#16275)
- web: Fix issue where clicking a list item scrolls container (cherry-pick #16174) (#16278)
- web: Improvements to ReCaptcha resizing (cherry-pick #16171) (#16281)
- web: Username truncation, field alignment. (cherry-pick #16283) (#16284)
- web: fix "Explore integrations" link in Quick actions (cherry-pick #16274) (#16285)

## Fixed in 2025.8.2

- core: bump django from 5.1.11 to v5.1.12 (cherry-pick #16584) (#16591)
- core: bump h2 from 4.2.0 to 4.3.0 (cherry-pick #16446) (#16449)
- core: fix client-side only validation allowing admin to set blank user password (cherry-pick #16467) (#16469)
- lib/logging: only show locals when in debug mode (cherry-pick #16772) #16774
- lib/sync/outgoing: fix single object sync timeout (cherry-pick #16447) (#16453)
- lib/sync: fix missing f for string (cherry-pick #16423) (#16427)
- lifecycle: fix PROMETHEUS\_MULTIPROC\_DIR missing suffix (cherry-pick #16401) (#16407)
- policies: remove object pk from authentik\_policies\_execution\_time to reduce cardinality (cherry-pick #16500) (#16501)
- providers/oauth2: add missing exp claim for logout token (cherry-pick #16593) (#16598)
- providers/oauth2: avoid deadlock during session migration (cherry-pick #16361) (#16364)
- providers/rac: fix AuthenticatedSession migration (cherry-pick #16400) (#16419)
- providers/scim: improve error message when object fails to sync (cherry-pick #16625) (#16643)
- sources/ldap: fix malformed filter error with special characters in group DN (cherry-pick #16243) (#16585)
- sources/oauth/entra\_id: do not assume group\_id comes from entra (cherry-pick #16456) (#16777)
- tasks/schedules: fix api search fields (cherry-pick #16405) (#16410)
- tasks: fix status and healthcheck breaking with connection issues (cherry-pick #16504) (#16673)
- web/flows: only disable login button when interactive captcha is configured and not loaded (cherry-pick #16586) (#16590)

## Fixed in 2025.8.3

- lifecycle: fix permission error when running worker as root (cherry-pick #16735) (#16784)
- stages/email\_authenticator: Fix email mfa loop (cherry-pick #16579) (#16807)
- website/docs: fix docker tabs not rendering properly (cherry-pick #16799) (#16802)
- website/docs: update create oauth provider page (cherry-pick #16617) (#16806)

## Fixed in 2025.8.4

- \*/bindings: order by pk (cherry-pick #17027) (#17053)
- cmd/server/healthcheck: info log success instead of debug (cherry-pick #17093 to version-2025.8) (#17097)
- core: add index on Group.is\_superuser (cherry-pick #17011) (#17017)
- lib: match exception\_to\_dict locals behavior (cherry-pick #17006) (#17016)
- lib/config: fix listen settings (cherry-pick #17005) (#17023)
- outposts/ldap: add pwdChangeTime attribute (cherry-pick #17010 to version-2025.8) (#17101)
- packages/django-dramatiq-postgres: broker: fix new messages not being picked up when too many messages are waiting (cherry-pick #17106 to version-2025.8) (#17108)
- providers/ldap: add include\_children parameter to cached search mode (cherry-pick #16918) (#17000)
- providers/oauth2: fix authentication error with identical app passwords (cherry-pick #17100 to version-2025.8) (#17103)
- providers/scim: fix string formatting for SCIM user filter (cherry-pick #16465) (#16852)
- rbac: fix typo (cherry-pick #16476) (#17018)
- rbac: optimize rbac assigned by users query (cherry-pick #17015 to version-2025.8) (#17092)
- stages/identification: fix mismatched error messages (cherry-pick #17090 to version-2025.8) (#17104)
- tasks: fix logger name (cherry-pick #17009 to version-2025.8) (#17060)
- tasks: reduce default number of retries and max backoff (cherry-pick #17107 to version-2025.8) (#17109)
- web: Fix layout class for row in LibraryPage (cherry-pick #16752 to version-2025.8) (#17091)
- web/admin: fix federation sources automatically selected (cherry-pick #17069 to version-2025.8) (#17070)

## Fixed in 2025.8.5

- blueprints: ensure tasks retry on database errors (cherry-pick #17333 to version-2025.8) (#17334)
- build(deps): bump django from 5.1.12 to 5.1.13 (cherry-pick #17198 to version-2025.8) (#17199)
- core: bump Django from 5.1.13 to 5.1.14 for 2025.8 (#17968)
- core: fix absolute and relative path file uploads (cherry-pick #17269 to version-2025.8) (#17272)
- internal: Automated internal backport: 1487-invitation-expiry.sec.patch to authentik-2025.8 (#18261)
- internal: Automated internal backport: 1498-oauth2-cc-user-active.sec.patch to authentik-2025.8 (#18262)
- lib/sync/outgoing: revert reduce number of db queries made (revert #14177) (cherry-pick #17306 to version-2025.8) (#17330)
- packages/django-dramatiq-postgres: broker: fix task expiration (cherry-pick #17178 to version-2025.8) (#17217)
- packages/django-dramatiq-postgres: fix error when updating task with no changes (cherry-pick #16728 to version-2025.8) (#17238)
- tasks/middlewares/messages: make sure exceptions are always logged (cherry-pick #17237 to version-2025.8) (#17248)
- web: Fix behavior for modals configured with closeAfterSuccessfulSubmit (cherry-pick #17277 to version-2025.8) (#17299)
- web/admin: fix incorrect placeholder for scim provider (cherry-pick #17308 to version-2025.8) (#17309)

## Fixed in 2025.8.6

- root: update client-go generation (cherry-pick #19762 and #19906 to version-2025.8) (#19934)
- security: [CVE-2026-25227](../../security/cves/CVE-2026-25227.mdx) (#20233)
- security: [CVE-2026-25748](../../security/cves/CVE-2026-25748.mdx) (#20234)
- security: [CVE-2026-25922](../../security/cves/CVE-2026-25922.mdx) (#20235)

## API Changes

#### What's New

***

##### `GET` /tasks/schedules/

##### `GET` /tasks/schedules/\{id}/

##### `PUT` /tasks/schedules/\{id}/

##### `PATCH` /tasks/schedules/\{id}/

##### `POST` /tasks/schedules/\{id}/send/

##### `GET` /tasks/tasks/

##### `GET` /tasks/tasks/\{message\_id}/

##### `POST` /tasks/tasks/\{message\_id}/retry/

##### `GET` /tasks/workers

#### What's Deleted

***

##### `GET` /admin/metrics/

##### `GET` /admin/workers/

##### `GET` /core/applications/\{slug}/metrics/

##### `GET` /core/users/\{id}/metrics/

##### `GET` /events/events/per\_month/

##### `GET` /events/system\_tasks/

##### `GET` /events/system\_tasks/\{uuid}/

##### `POST` /events/system\_tasks/\{uuid}/run/

#### What's Changed

***

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `flags`

  * Added property `flags` (object)
    - Property `policies_buffered_access_view` (boolean)

  * Changed property `footer_links` (object)

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

New required properties:

- `flags`

* Added property `flags` (object)

* Changed property `footer_links` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `flags`

  * Added property `flags` (object)

  * Changed property `footer_links` (object)

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `flags` (object)

- Changed property `footer_links` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `flags`

  * Added property `flags` (object)

  * Changed property `footer_links` (object)

##### `GET` /authenticators/admin/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serializer for authenticator devices

  New required properties:

  - `external_id`

  * Added property `external_id` (string)
    > Get external Device ID

##### `GET` /authenticators/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Serializer for authenticator devices

  New required properties:

  - `external_id`

  * Added property `external_id` (string)
    > Get external Device ID

##### `GET` /core/application\_entitlements/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `PUT` /core/application\_entitlements/\{pbm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `PATCH` /core/application\_entitlements/\{pbm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /core/brands/\{brand\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `PUT` /core/brands/\{brand\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `PATCH` /core/brands/\{brand\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `POST` /core/users/\{id}/recovery/

##### `POST` /core/users/\{id}/recovery\_email/

##### `GET` /events/events/volume/

###### Parameters:

Added: `actions` in `query`

Added: `history_days` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Count of events of action created on day

  New required properties:

  - `action`
  - `count`
  - `time`

  New optional properties:

  - `x_cord`
  - `y_cord`

  * Added property `action` (string)

    Enum values:

    - `login`
    - `login_failed`
    - `logout`
    - `user_write`
    - `suspicious_request`
    - `password_set`
    - `secret_view`
    - `secret_rotate`
    - `invitation_used`
    - `authorize_application`
    - `source_linked`
    - `impersonation_started`
    - `impersonation_ended`
    - `flow_execution`
    - `policy_execution`
    - `policy_exception`
    - `property_mapping_exception`
    - `system_task_execution`
    - `system_task_exception`
    - `system_exception`
    - `configuration_error`
    - `model_created`
    - `model_updated`
    - `model_deleted`
    - `email_sent`
    - `update_available`
    - `custom_`

  * Added property `time` (string)

  * Added property `count` (integer)

  * Deleted property `x_cord` (integer)

  * Deleted property `y_cord` (integer)

##### `GET` /events/rules/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `destination_group_obj`

  New optional properties:

  - `group_obj`

  * Added property `destination_group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Added property `destination_group_obj` (object)
    - Property `pk` (string)

    - Property `num_pk` (integer)

    - Property `name` (string)

    - Property `is_superuser` (boolean)

      > Users added to this group will be superusers.

    - Property `parent` (string)

    - Property `parent_name` (string)

    - Property `users` (array)

      Items (integer):

    - Property `users_obj` (array)

      Items (object): > Stripped down user serializer to show relevant users for groups

      - Property `pk` (integer)

      - Property `username` (string)

        > Required. 150 characters or fewer. Letters, digits and @/./+/-/\_ only.

      - Property `name` (string)

        > User's display name.

      - Property `is_active` (boolean)

        > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

      - Property `last_login` (string)

      - Property `email` (string)

      - Property `attributes` (object)

      - Property `uid` (string)

    - Property `attributes` (object)

    - Property `roles` (array)

      Items (string):

    - Property `roles_obj` (array)

      Items (object): > Role serializer

      - Property `pk` (string)

      - Property `name` (string)

    - Property `children` (array)

    - Property `children_obj` (array)

      Items (object): > Stripped down group serializer to show relevant children for groups

      - Property `pk` (string)

      - Property `name` (string)

      - Property `is_superuser` (boolean)

        > Users added to this group will be superusers.

      - Property `attributes` (object)

      - Property `group_uuid` (string)

  * Added property `destination_event_user` (boolean)

    > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

  * Deleted property `group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Deleted property `group_obj` (object)

##### `PUT` /events/rules/\{pbm\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `destination_group` (string)

  > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

- Added property `destination_event_user` (boolean)

  > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

- Deleted property `group` (string)
  > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `destination_group_obj`

  New optional properties:

  - `group_obj`

  * Added property `destination_group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Added property `destination_group_obj` (object)

  * Added property `destination_event_user` (boolean)

    > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

  * Deleted property `group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Deleted property `group_obj` (object)

##### `PATCH` /events/rules/\{pbm\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `destination_group` (string)

  > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

- Added property `destination_event_user` (boolean)

  > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

- Deleted property `group` (string)
  > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `destination_group_obj`

  New optional properties:

  - `group_obj`

  * Added property `destination_group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Added property `destination_group_obj` (object)

  * Added property `destination_event_user` (boolean)

    > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

  * Deleted property `group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Deleted property `group_obj` (object)

##### `GET` /managed/blueprints/\{instance\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `PUT` /managed/blueprints/\{instance\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `PATCH` /managed/blueprints/\{instance\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `POST` /managed/blueprints/\{instance\_uuid}/apply/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `GET` /outposts/service\_connections/kubernetes/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `PUT` /outposts/service\_connections/kubernetes/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `kubeconfig` (object -> object)
  > Paste your kubeconfig here. authentik will automatically use the currently selected context.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `PATCH` /outposts/service\_connections/kubernetes/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `kubeconfig` (object -> object)
  > Paste your kubeconfig here. authentik will automatically use the currently selected context.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.tasks`
    - `authentik.tasks.schedules`
    - `authentik.enterprise.search`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_tasks_schedules.schedule`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.tasks`
  - `authentik.tasks.schedules`
  - `authentik.enterprise.search`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum value:

  - `authentik_tasks_schedules.schedule`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.tasks`
    - `authentik.tasks.schedules`
    - `authentik.enterprise.search`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_tasks_schedules.schedule`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.tasks`
  - `authentik.tasks.schedules`
  - `authentik.enterprise.search`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum value:

  - `authentik_tasks_schedules.schedule`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.tasks`
    - `authentik.tasks.schedules`
    - `authentik.enterprise.search`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_tasks_schedules.schedule`

##### `GET` /policies/reputation/scores/\{reputation\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `ip_geo_data` (object -> object)

  - Changed property `ip_asn_data` (object -> object)

##### `GET` /providers/google\_workspace/\{id}/sync/status/

###### Return Type:

Deleted response : **404 Not Found**

> Task not found

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `tasks`

  * Added property `last_successful_sync` (string)

  * Added property `last_sync_status` (string)

    Enum values:

    - `queued`
    - `consumed`
    - `rejected`
    - `done`
    - `info`
    - `warning`
    - `error`

  * Deleted property `tasks` (array)

  * Changed property `is_running` (boolean)

##### `GET` /providers/google\_workspace\_groups/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/google\_workspace\_users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/microsoft\_entra/\{id}/sync/status/

###### Return Type:

Deleted response : **404 Not Found**

> Task not found

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `tasks`

  * Added property `last_successful_sync` (string)

  * Added property `last_sync_status` (string)

  * Deleted property `tasks` (array)

  * Changed property `is_running` (boolean)

##### `GET` /providers/microsoft\_entra\_groups/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/microsoft\_entra\_users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/rac/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `settings` (object -> object)

##### `PUT` /providers/rac/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `settings` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `settings` (object -> object)

##### `PATCH` /providers/rac/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `settings` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `settings` (object -> object)

##### `GET` /providers/scim/\{id}/sync/status/

###### Return Type:

Deleted response : **404 Not Found**

> Task not found

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `tasks`

  * Added property `last_successful_sync` (string)

  * Added property `last_sync_status` (string)

  * Deleted property `tasks` (array)

  * Changed property `is_running` (boolean)

##### `GET` /providers/scim\_groups/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/scim\_users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /sources/kerberos/\{slug}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `tasks`

  * Added property `last_successful_sync` (string)

  * Added property `last_sync_status` (string)

  * Deleted property `tasks` (array)

  * Changed property `is_running` (boolean)

##### `GET` /sources/ldap/\{slug}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `tasks`

  * Added property `last_successful_sync` (string)

  * Added property `last_sync_status` (string)

  * Deleted property `tasks` (array)

  * Changed property `is_running` (boolean)

##### `GET` /sources/scim\_groups/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `PUT` /sources/scim\_groups/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `external_id`

New optional properties:

- `id`

* Added property `external_id` (string)

* Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `PATCH` /sources/scim\_groups/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `external_id` (string)

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `GET` /sources/scim\_users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `PUT` /sources/scim\_users/\{id}/

###### Request:

Changed content type : `application/json`

New required properties:

- `external_id`

New optional properties:

- `id`

* Added property `external_id` (string)

* Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `PATCH` /sources/scim\_users/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `external_id` (string)

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `GET` /authenticators/admin/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/admin/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/admin/endpoint/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/admin/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/admin/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/admin/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/endpoint/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /core/application\_entitlements/

###### Request:

Changed content type : `application/json`

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /core/application\_entitlements/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > ApplicationEntitlement Serializer

    - Changed property `attributes` (object -> object)

##### `GET` /core/authenticated\_sessions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /core/brands/

###### Request:

Changed content type : `application/json`

- Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /core/brands/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Brand Serializer

    - Changed property `attributes` (object -> object)

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `flags`

  * Added property `flags` (object)
    - Property `policies_buffered_access_view` (boolean)

##### `GET` /core/groups/\{group\_uuid}/

###### Parameters:

Added: `include_children` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `children_obj`

  * Added property `children` (array)

  * Added property `children_obj` (array)

##### `PUT` /core/groups/\{group\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `children` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `children_obj`

  * Added property `children` (array)

  * Added property `children_obj` (array)

##### `PATCH` /core/groups/\{group\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `children` (array)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `children_obj`

  * Added property `children` (array)

  * Added property `children_obj` (array)

##### `GET` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `PUT` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `PATCH` /core/tokens/\{identifier}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `GET` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `last_updated`

  * Added property `last_updated` (string)

##### `PUT` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `last_updated`

  * Added property `last_updated` (string)

##### `PATCH` /core/users/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `last_updated`

  * Added property `last_updated` (string)

##### `GET` /crypto/certificatekeypairs/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /enterprise/license/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /events/events/\{event\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

  - Changed property `brand` (object -> object)

##### `PUT` /events/events/\{event\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `user` (object -> object)

- Changed property `context` (object -> object)

- Changed property `brand` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

  - Changed property `brand` (object -> object)

##### `PATCH` /events/events/\{event\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `user` (object -> object)

- Changed property `context` (object -> object)

- Changed property `brand` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

  - Changed property `brand` (object -> object)

##### `POST` /events/rules/

###### Request:

Changed content type : `application/json`

- Added property `destination_group` (string)

  > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

- Added property `destination_event_user` (boolean)

  > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

- Deleted property `group` (string)
  > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `destination_group_obj`

  New optional properties:

  - `group_obj`

  * Added property `destination_group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Added property `destination_group_obj` (object)

  * Added property `destination_event_user` (boolean)

    > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

  * Deleted property `group` (string)

    > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

  * Deleted property `group_obj` (object)

##### `GET` /events/rules/

###### Parameters:

Added: `destination_group__name` in `query`

Deleted: `group__name` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > NotificationRule Serializer

    New required properties:

    - `destination_group_obj`

    New optional properties:

    - `group_obj`

    * Added property `destination_group` (string)

      > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

    * Added property `destination_group_obj` (object)

    * Added property `destination_event_user` (boolean)

      > When enabled, notification will be sent to user the user that triggered the event.When destination\_group is configured, notification is sent to both.

    * Deleted property `group` (string)

      > Define which group of users this notification should be sent and shown to. If left empty, Notification won't be sent.

    * Deleted property `group_obj` (object)

##### `GET` /events/transports/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `email_subject_prefix` (string)

  - Added property `email_template` (string)

##### `PUT` /events/transports/\{uuid}/

###### Request:

Changed content type : `application/json`

- Added property `email_subject_prefix` (string)

- Added property `email_template` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `email_subject_prefix` (string)

  - Added property `email_template` (string)

##### `PATCH` /events/transports/\{uuid}/

###### Request:

Changed content type : `application/json`

- Added property `email_subject_prefix` (string)

- Added property `email_template` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `email_subject_prefix` (string)

  - Added property `email_template` (string)

##### `POST` /managed/blueprints/

###### Request:

Changed content type : `application/json`

- Changed property `context` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `context` (object -> object)

  - Changed property `metadata` (object -> object)

##### `GET` /managed/blueprints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Info about a single blueprint instance file

    - Changed property `context` (object -> object)

    - Changed property `metadata` (object -> object)

##### `GET` /outposts/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /outposts/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /outposts/service\_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /outposts/service\_connections/docker/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /outposts/service\_connections/kubernetes/

###### Request:

Changed content type : `application/json`

- Changed property `kubeconfig` (object -> object)
  > Paste your kubeconfig here. authentik will automatically use the currently selected context.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `kubeconfig` (object -> object)
    > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `GET` /outposts/service\_connections/kubernetes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > KubernetesServiceConnection Serializer

    - Changed property `kubeconfig` (object -> object)
      > Paste your kubeconfig here. authentik will automatically use the currently selected context.

##### `GET` /policies/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `children_obj`

    * Added property `children` (array)

    * Added property `children_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `children_obj`

    * Added property `children` (array)

    * Added property `children_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `children_obj`

    * Added property `children` (array)

    * Added property `children_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `GET` /policies/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.tasks`
  - `authentik.tasks.schedules`
  - `authentik.enterprise.search`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum value:

  - `authentik_tasks_schedules.schedule`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.tasks`
    - `authentik.tasks.schedules`
    - `authentik.enterprise.search`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum value:

    - `authentik_tasks_schedules.schedule`

##### `GET` /policies/event\_matcher/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum values:

      - `authentik.tasks`
      - `authentik.tasks.schedules`
      - `authentik.enterprise.search`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum value:

      - `authentik_tasks_schedules.schedule`

##### `GET` /policies/expression/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /policies/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /policies/password\_expiry/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /policies/reputation/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /policies/reputation/scores/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Reputation Serializer

    - Changed property `ip_geo_data` (object -> object)

    - Changed property `ip_asn_data` (object -> object)

##### `GET` /policies/unique\_password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/notification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/google\_workspace/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/microsoft\_entra/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/rac/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/provider/scope/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/source/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/source/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/source/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/source/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/source/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /propertymappings/source/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /providers/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /providers/google\_workspace/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `PUT` /providers/google\_workspace/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `credentials` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `PATCH` /providers/google\_workspace/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `credentials` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `POST` /providers/google\_workspace\_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/google\_workspace\_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > GoogleWorkspaceProviderGroup Serializer

    - Changed property `attributes` (object -> object)

##### `POST` /providers/google\_workspace\_users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/google\_workspace\_users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > GoogleWorkspaceProviderUser Serializer

    - Changed property `attributes` (object -> object)

##### `POST` /providers/microsoft\_entra\_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/microsoft\_entra\_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > MicrosoftEntraProviderGroup Serializer

    - Changed property `attributes` (object -> object)

##### `POST` /providers/microsoft\_entra\_users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/microsoft\_entra\_users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > MicrosoftEntraProviderUser Serializer

    - Changed property `attributes` (object -> object)

##### `POST` /providers/rac/

###### Request:

Changed content type : `application/json`

- Changed property `settings` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `settings` (object -> object)

##### `GET` /providers/rac/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > RACProvider Serializer

    - Changed property `settings` (object -> object)

##### `GET` /providers/radius/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /providers/saml/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `default_name_id_policy` (string)

    Enum values:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`
    - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
    - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
    - `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName`
    - `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`
    - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

##### `PUT` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `default_name_id_policy` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `default_name_id_policy` (string)

##### `PATCH` /providers/saml/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `default_name_id_policy` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `default_name_id_policy` (string)

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /providers/scim\_groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/scim\_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SCIMProviderGroup Serializer

    - Changed property `attributes` (object -> object)

##### `POST` /providers/scim\_users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `attributes` (object -> object)

##### `GET` /providers/scim\_users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SCIMProviderUser Serializer

    - Changed property `attributes` (object -> object)

##### `GET` /providers/ssf/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `PUT` /providers/ssf/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `PATCH` /providers/ssf/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `GET` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      - Changed property `settings` (object -> object)

    - Changed property `settings` (object -> object)

##### `PUT` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      - Changed property `settings` (object -> object)

    - Changed property `settings` (object -> object)

##### `PATCH` /rac/connection\_tokens/\{connection\_token\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `endpoint_obj` (object)

    > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      - Changed property `settings` (object -> object)

    - Changed property `settings` (object -> object)

##### `GET` /rac/endpoints/\{pbm\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `settings` (object -> object)

##### `PUT` /rac/endpoints/\{pbm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `settings` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `settings` (object -> object)

##### `PATCH` /rac/endpoints/\{pbm\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `settings` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `settings` (object -> object)

##### `GET` /rbac/permissions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_tasks_schedules.schedule`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_tasks_schedules.schedule`

##### `POST` /rbac/permissions/assigned\_by\_users/\{id}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_tasks_schedules.schedule`

##### `PATCH` /rbac/permissions/assigned\_by\_users/\{id}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum value:

  - `authentik_tasks_schedules.schedule`

##### `GET` /rbac/roles/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)

    Added enum value:

    - `entraid`

##### `PUT` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `oidc_jwks` (object -> object)

- Changed property `provider_type` (string)

  Added enum value:

  - `entraid`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)

    Added enum value:

    - `entraid`

##### `PATCH` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `oidc_jwks` (object -> object)

- Changed property `provider_type` (string)

  Added enum value:

  - `entraid`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)

    Added enum value:

    - `entraid`

##### `GET` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

##### `PUT` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `name_id_policy` (string)

  > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

  Added enum value:

  - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

##### `PATCH` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `name_id_policy` (string)

  > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

  Added enum value:

  - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

##### `GET` /sources/scim/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `PUT` /sources/scim/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `PATCH` /sources/scim/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `POST` /sources/scim\_groups/

###### Request:

Changed content type : `application/json`

New required properties:

- `external_id`

New optional properties:

- `id`

* Added property `external_id` (string)

* Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `GET` /sources/scim\_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SCIMSourceGroup Serializer

    New required properties:

    - `external_id`

    New optional properties:

    - `id`

    * Added property `external_id` (string)

    * Changed property `attributes` (object -> object)

##### `POST` /sources/scim\_users/

###### Request:

Changed content type : `application/json`

New required properties:

- `external_id`

New optional properties:

- `id`

* Added property `external_id` (string)

* Changed property `attributes` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `external_id`

  New optional properties:

  - `id`

  * Added property `external_id` (string)

  * Changed property `attributes` (object -> object)

##### `GET` /sources/scim\_users/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SCIMSourceUser Serializer

    New required properties:

    - `external_id`

    New optional properties:

    - `id`

    * Added property `external_id` (string)

    * Changed property `attributes` (object -> object)

##### `GET` /ssf/streams/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > SSFProvider Serializer

    - Changed property `token_obj` (object)

      > Token Serializer

      - Changed property `user_obj` (object)

        > User Serializer

        New required properties:

        - `last_updated`

        * Added property `last_updated` (string)

##### `GET` /stages/authenticator/webauthn\_device\_types/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /tenants/domains/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /tenants/tenants/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/admin/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /authenticators/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /core/groups/

###### Request:

Changed content type : `application/json`

- Added property `children` (array)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `children_obj`

  * Added property `children` (array)

  * Added property `children_obj` (array)

##### `GET` /core/groups/

###### Parameters:

Added: `include_children` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Group Serializer

    New required properties:

    - `children_obj`

    * Added property `children` (array)

    * Added property `children_obj` (array)

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `last_updated`

  * Added property `last_updated` (string)

##### `GET` /core/users/

###### Parameters:

Added: `date_joined` in `query`

Added: `date_joined__gt` in `query`

Added: `date_joined__lt` in `query`

Added: `last_updated` in `query`

Added: `last_updated__gt` in `query`

Added: `last_updated__lt` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `POST` /events/events/

###### Request:

Changed content type : `application/json`

- Changed property `user` (object -> object)

- Changed property `context` (object -> object)

- Changed property `brand` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

  - Changed property `brand` (object -> object)

##### `GET` /events/events/

###### Parameters:

Added: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Event Serializer

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

    - Changed property `brand` (object -> object)

##### `GET` /events/notifications/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

    - Changed property `brand` (object -> object)

##### `PUT` /events/notifications/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

  > Event Serializer

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

  - Changed property `brand` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

    - Changed property `brand` (object -> object)

##### `PATCH` /events/notifications/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

  > Event Serializer

  - Changed property `user` (object -> object)

  - Changed property `context` (object -> object)

  - Changed property `brand` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Changed property `user` (object -> object)

    - Changed property `context` (object -> object)

    - Changed property `brand` (object -> object)

##### `POST` /events/transports/

###### Request:

Changed content type : `application/json`

- Added property `email_subject_prefix` (string)

- Added property `email_template` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `email_subject_prefix` (string)

  - Added property `email_template` (string)

##### `GET` /events/transports/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > NotificationTransport Serializer

    - Added property `email_subject_prefix` (string)

    - Added property `email_template` (string)

##### `GET` /flows/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `group_obj` (object)

    > Group Serializer

    New required properties:

    - `children_obj`

    * Added property `children` (array)

    * Added property `children_obj` (array)

  - Changed property `user_obj` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    - Changed property `group_obj` (object)

      > Group Serializer

      New required properties:

      - `children_obj`

      * Added property `children` (array)

      * Added property `children_obj` (array)

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `GET` /policies/geoip/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /providers/google\_workspace/

###### Request:

Changed content type : `application/json`

- Changed property `credentials` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `GET` /providers/google\_workspace/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > GoogleWorkspaceProvider Serializer

    - Changed property `credentials` (object -> object)

##### `GET` /providers/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /providers/microsoft\_entra/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `backchannel_logout_uri` (string)

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `backchannel_logout_uri` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `backchannel_logout_uri` (string)

##### `PATCH` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `backchannel_logout_uri` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `backchannel_logout_uri` (string)

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Added property `default_name_id_policy` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `default_name_id_policy` (string)

##### `GET` /providers/saml/

###### Parameters:

Added: `default_name_id_policy` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SAMLProvider Serializer

    - Added property `default_name_id_policy` (string)

##### `POST` /providers/ssf/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `GET` /providers/ssf/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SSFProvider Serializer

    - Changed property `token_obj` (object)

      > Token Serializer

      - Changed property `user_obj` (object)

        > User Serializer

        New required properties:

        - `last_updated`

        * Added property `last_updated` (string)

##### `GET` /rac/connection\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > ConnectionToken Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      - Changed property `settings` (object -> object)

    - Changed property `endpoint_obj` (object)

      > Endpoint Serializer

      - Changed property `provider_obj` (object)

        > RACProvider Serializer

        - Changed property `settings` (object -> object)

      - Changed property `settings` (object -> object)

##### `POST` /rac/endpoints/

###### Request:

Changed content type : `application/json`

- Changed property `settings` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > RACProvider Serializer

    - Changed property `settings` (object -> object)

  - Changed property `settings` (object -> object)

##### `GET` /rac/endpoints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Endpoint Serializer

    - Changed property `provider_obj` (object)

      > RACProvider Serializer

      - Changed property `settings` (object -> object)

    - Changed property `settings` (object -> object)

##### `GET` /rbac/initial\_permissions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /rbac/permissions/assigned\_by\_roles/

###### Parameters:

Changed: `model` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /rbac/permissions/assigned\_by\_users/

###### Parameters:

Changed: `model` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/group\_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/group\_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/group\_connections/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/group\_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/group\_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/group\_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `oidc_jwks` (object -> object)

- Changed property `provider_type` (string)

  Added enum value:

  - `entraid`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `oidc_jwks` (object -> object)

  - Changed property `provider_type` (string)

    Added enum value:

    - `entraid`

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `oidc_jwks` (object -> object)

    - Changed property `provider_type` (string)

      Added enum value:

      - `entraid`

##### `GET` /sources/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Changed property `name_id_policy` (string)

  > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

  Added enum value:

  - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `name_id_policy` (string)

    > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

    Added enum value:

    - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

##### `GET` /sources/saml/

###### Parameters:

Changed: `name_id_policy` in `query`

> NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SAMLSource Serializer

    - Changed property `name_id_policy` (string)

      > NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent.

      Added enum value:

      - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

##### `POST` /sources/scim/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `token_obj` (object)

    > Token Serializer

    - Changed property `user_obj` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `GET` /sources/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SCIMSource Serializer

    - Changed property `token_obj` (object)

      > Token Serializer

      - Changed property `user_obj` (object)

        > User Serializer

        New required properties:

        - `last_updated`

        * Added property `last_updated` (string)

##### `GET` /sources/user\_connections/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/user\_connections/kerberos/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/user\_connections/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/user\_connections/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/user\_connections/plex/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /sources/user\_connections/saml/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /ssf/streams/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > SSFStream Serializer

    - Changed property `provider_obj` (object)

      > SSFProvider Serializer

      - Changed property `token_obj` (object)

        > Token Serializer

        - Changed property `user_obj` (object)

          > User Serializer

          New required properties:

          - `last_updated`

          * Added property `last_updated` (string)

##### `GET` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `PUT` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `credentials` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `PATCH` /stages/authenticator/endpoint\_gdtc/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `credentials` (object -> object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `GET` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `max_attempts` (integer)

##### `PUT` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `max_attempts` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `max_attempts` (integer)

##### `PATCH` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `max_attempts` (integer)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `max_attempts` (integer)

##### `GET` /stages/email/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `recovery_max_attempts` (integer)

  - Added property `recovery_cache_timeout` (string)
    > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

##### `PUT` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `recovery_max_attempts` (integer)

- Added property `recovery_cache_timeout` (string)
  > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `recovery_max_attempts` (integer)

  - Added property `recovery_cache_timeout` (string)
    > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

##### `PATCH` /stages/email/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `recovery_max_attempts` (integer)

- Added property `recovery_cache_timeout` (string)
  > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `recovery_max_attempts` (integer)

  - Added property `recovery_cache_timeout` (string)
    > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/user\_login/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `remember_device` (string)
    > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

##### `PUT` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `remember_device` (string)
  > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `remember_device` (string)
    > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

##### `PATCH` /stages/user\_login/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `remember_device` (string)
  > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `remember_device` (string)
    > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

##### `GET` /events/notifications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Notification Serializer

    - Changed property `event` (object)

      > Event Serializer

      - Changed property `user` (object -> object)

      - Changed property `context` (object -> object)

      - Changed property `brand` (object -> object)

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /flows/executor/\{flow\_slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-authenticator-validate` component:

  - Changed property `device_challenges` (array)

    Changed items (object): > Single device challenge

    - Changed property `device_class` (string)

      Added enum values:

      - `static`
      - `totp`
      - `webauthn`
      - `duo`
      - `sms`
      - `email`

##### `POST` /flows/executor/\{flow\_slug}/

###### Request:

Changed content type : `application/json`

Updated `ak-stage-authenticator-validate` component:

- Changed property `selected_challenge` (object)

  > Single device challenge

  - Changed property `device_class` (string)

    Added enum values:

    - `static`
    - `totp`
    - `webauthn`
    - `duo`
    - `sms`
    - `email`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Updated `ak-stage-authenticator-validate` component:

  - Changed property `device_challenges` (array)

    Changed items (object): > Single device challenge

    - Changed property `device_class` (string)

      Added enum values:

      - `static`
      - `totp`
      - `webauthn`
      - `duo`
      - `sms`
      - `email`

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `backchannel_logout_uri` (string)

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `backchannel_logout_uri` (string)

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `user` (object)

    > User Serializer

    New required properties:

    - `last_updated`

    * Added property `last_updated` (string)

  - Changed property `provider` (object)

    > OAuth2Provider Serializer

    - Added property `backchannel_logout_uri` (string)

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Added property `backchannel_logout_uri` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `backchannel_logout_uri` (string)

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    - Added property `backchannel_logout_uri` (string)

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/authenticator/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /stages/authenticator/endpoint\_gdtc/

###### Request:

Changed content type : `application/json`

- Changed property `credentials` (object -> object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `credentials` (object -> object)

##### `GET` /stages/authenticator/endpoint\_gdtc/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > AuthenticatorEndpointGDTCStage Serializer

    - Changed property `credentials` (object -> object)

##### `GET` /stages/authenticator/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/authenticator/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Added property `max_attempts` (integer)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `max_attempts` (integer)

##### `GET` /stages/authenticator/webauthn/

###### Parameters:

Added: `max_attempts` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > AuthenticatorWebAuthnStage Serializer

    - Added property `max_attempts` (integer)

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /stages/email/

###### Request:

Changed content type : `application/json`

- Added property `recovery_max_attempts` (integer)

- Added property `recovery_cache_timeout` (string)
  > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `recovery_max_attempts` (integer)

  - Added property `recovery_cache_timeout` (string)
    > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > EmailStage Serializer

    - Added property `recovery_max_attempts` (integer)

    - Added property `recovery_cache_timeout` (string)
      > The time window used to count recent account recovery attempts. If the number of attempts exceed recovery\_max\_attempts within this period, further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/mtls/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/redirect/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/source/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/user\_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `POST` /stages/user\_login/

###### Request:

Changed content type : `application/json`

- Added property `remember_device` (string)
  > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `remember_device` (string)
    > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

##### `GET` /stages/user\_login/

###### Parameters:

Added: `remember_device` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > UserLoginStage Serializer

    - Added property `remember_device` (string)
      > When set to a non-zero value, authentik will save a cookie with a longer expiry,to remember the device the user is logging in from. (Format: hours=-1;minutes=-2;seconds=-3)

##### `GET` /stages/user\_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `GET` /stages/user\_write/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

  Updated `authentik_providers_rac.racprovider` provider\_model:

  - Changed property `settings` (object -> object)

  Updated `authentik_providers_google_workspace.googleworkspaceprovider` provider\_model:

  - Changed property `credentials` (object -> object)

  Updated `authentik_providers_saml.samlprovider` provider\_model:

  - Added property `default_name_id_policy` (string)

  Updated `authentik_providers_oauth2.oauth2provider` provider\_model:

  - Added property `backchannel_logout_uri` (string)

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `backchannel_logout_uri` (string)

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `backchannel_logout_uri` (string)

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

  * Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `user` (object)

      > User Serializer

      New required properties:

      - `last_updated`

      * Added property `last_updated` (string)

    - Changed property `provider` (object)

      > OAuth2Provider Serializer

      - Added property `backchannel_logout_uri` (string)

##### `GET` /stages/prompt/prompts/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `autocomplete`

  * Added property `autocomplete` (object)

---

## Release 2026.2

<!-- spellchecker:ignore fqxr xjjx πthon -->

## Highlights

- **Object Lifecycle Management**: :ak-enterprise :ak-preview Admins can now automatically schedule periodic reviews of authentik objects (applications, groups, roles) for compliance and auditing purposes.
- **WS-Federation**: :ak-enterprise authentik now supports WS-Federation, a single sign-on and identity federation protocol common in some Microsoft environments.
- **SCIM provider**: Major improvements to the SCIM provider have been made by community contributions from @ImmanuelVonNeumann and @bitpavel-l25 in the form of [sync improvements](https://github.com/goauthentik/authentik/pull/13947) and [group imports](https://github.com/goauthentik/authentik/pull/19846). Thank you!

### Release frequency change

In recent years, a new authentik release was cut roughly every two months. We will be extending this to target a three-month release cycle, with the next release being 2026.5 in May. We will keep to our current practice of supporting the two most recently released versions with security coverage, which will therefore result in a longer coverage period as well.

## Breaking changes

### SCIM group syncing behavior

Users will now be filtered based on the policies bound to the application the SCIM provider is used with. There is now an option to select groups in the SCIM provider, which, if selected, will only sync those groups, and if no groups are selected, all groups will be synced. If you have a SCIM provider with a group filter setup, it will be deactivated and a configuration warning will be created, for you to review the configuration.

### Policies / Property mappings

`User.ak_groups` has been deprecated. Users' groups are now accessed through `User.groups`. Usage of `.ak_groups` will continue to function, but will create a configuration warning event, at most every 30 days. We recommend you check any custom code (e.g. expression policies, property mappings) that deals with group memberships to update them if necessary.

## New features and improvements

### Object lifecycle management :ak-enterprise :ak-preview

[Object Lifecycle Management](../../sys-mgmt/object-lifecycle-management.mdx) allows Admins to schedule and track periodic reviews for Applications, Groups, and Roles. Reviewing access privileges to specific applications is an important best practice, as is reviewing other settings such as your branding settings, group and role membership, application entitlements, and current policy bindings.

### WS-Federation :ak-enterprise

We now have a provider to integrate authentik with applications and service providers that use the [WS-Fed protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adfsod/204de335-ea34-4f9b-ae73-8b7d4c8152d1). WS-Federation is an XML-based identity federation protocol that uses token exchange for federated Single Sign-On (SSO) and IdP authentication, specifically for Windows applications such as Sharepoint. Note that we only support the SAML2 token type within WS-Federation providers, and that using the WS-Fed provider with Entra ID is not supported because Entra ID requires a SAML 1.0 token.

For details refer to our [WS-Federation provider documentation](../../add-secure-apps/providers/wsfed/index.mdx).

### Endpoints and authentik agent :ak-enterprise

Endpoints now has a [Fleet connector](../../endpoint-devices/device-compliance/connectors/fleetdm.mdx) integration. You can now pull device facts and signals data from [Fleet](https://fleetdm.com/) into authentik to implement Conditional Access rules.

[Local Device Login](../../endpoint-devices/authentik-agent/device-authentication/local-device-login/linux.mdx) now works on Linux too and also supports webauthn/FIDO2.

### Certificate builder

authentik's certificate builder now supports ED25519 and ED448 certificate generation.

### SAML Provider

The SAML provider's metadata parser now supports importing Single Logout Service endpoints and encryption certificates. Also, encryption certificates without private keys are now accepted, and the structure of encrypted SAML assertions has been corrected. The signing order for encrypted SAML responses has been fixed, and signature algorithm options are now automatically pulled from the selected signing certificate. The SP ACS binding field has been lowered in the form and will soon be sunset, as defaulting to POST should work in every case.

### SAML Source

SAML sources now correctly handle transient usernames longer than 150 characters by truncating them. AuthnRequest signatures are no longer incorrectly embedded in the request body when using the redirect binding. The signature verification order has been fixed to properly accommodate encrypted assertions, and InvalidSignature exceptions are now properly caught. Status message handling has also been improved for better error reporting.

### Documentation page: First steps

We now have a tutorial for your [First steps](../../install-config/first-steps/index.mdx) after installing authentik! This document walks you through adding a new application and provider, then adding your first user, with Tips to explain more complex concepts. Best practices and troubleshooting tips are also included.

### πthon

authentik now uses [Python 3.14](https://docs.python.org/3/whatsnew/3.14.html) under the hood. This means absolutely nothing as we use none of its features, but it has a cool name.

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added. A big thanks to our contributors!

- [Affine](https://integrations.goauthentik.io/chat-communication-collaboration/affine/) (Thanks to @akaSorin!)
- [Arcane](https://integrations.goauthentik.io/integrations/hypervisors-orchestrators/arcane/) (Thanks to @steilerDev!)
- [Datadog](https://integrations.goauthentik.io/integrations/monitoring/datadog/) (Thanks to @dominic-r!)
- [Elastic Cloud](https://integrations.goauthentik.io/integrations/platforms/elastic-cloud/) (Thanks to @dominic-r!)

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

Upgrades MUST be performed sequentially by major version. If you are two or more major releases behind, you must first upgrade to each intermediate major release before upgrading to this one. Refer to our [Upgrade documentation](../../install-config/upgrade.mdx) for more information on upgrade sequence.

The version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

Starting with 2026.2, we renamed the file from docker-compose.yml to compose.yml. Look over your old docker-compose.yml file and make any changes to the new compose.yml before deleting your old docker-compose.yml.

To upgrade, download the new compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O compose.yml https://goauthentik.io/version/2026.2/lifecycle/container/compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2026.2
```

## Minor changes/fixes

- \*: Auto compress images (#19065)
- admin/files: add centralized theme variable support for file URLs (#19657)
- admin/files: fix duplicate bucket name in presigned URLs with custom domain (#19537)
- admin/files: fix get_objects_for_user queryset argument in FileUsedByView (#18845)
- admin/files: fix manageable check blocking file creation on fresh installs (#19547)
- admin/files: revert add check for /media existence (#18636) (#18829)
- admin/files: support %(theme)s variable in media file paths (#19108)
- api: fix latest version for public schema (#18902)
- api: fix page_size with invalid query param (#18879)
- blueprints: add InternallyManagedMixin instead of large list (#18983)
- blueprints: don't exclude default values (#20057)
- blueprints: fix deadlock and task context error in MetaApplyBlueprint (#19033)
- blueprints: fix flaky tests (#19002)
- blueprints: set enrollment token key (#19061)
- brands: fix Domain Matching in Brand Resolution (#19976)
- core: add bulk session revocation (#18564)
- core: add CC and BCC support to ak_send_email and TemplateEmailMessage (#19633)
- core: add last_login filter to users API (#18993)
- core: add prettier failure on duplicate group names (#18941)
- core: add skip s3_test_server_available to TestResolveFileUrlS3Backend (#18858)
- core: ask for token duration on recovery link/email by admin (#19875)
- core: fix non-expiring service accounts and app passwords (#19913)
- core: fix read replica routing during transactions (#19086)
- core: handle deserialization errors from FileField migration (#19067)
- core: list applications fix (#18798)
- core: remove session migration (#14568)
- core: remove superuser check from `Token` list (#18684)
- core: return bad request when user is authenticated and not active (#19706)
- core: skip s3 tests if endpoint isn't available (#18841)
- core: Update supported versions in SECURITY.md (#19385)
- core: use chunked_queryset for expired message deletion (#19028)
- core/groups: optimize prefetch queries to fetch only required fields (#18448)
- crypto: Add ED25519 and ED448 support to the certificate builder (#19465)
- crypto: fix extra cert data in db migration (#18937)
- crypto: Store details parsed from includeDetails in database instead (#18013)
- endpoints: fix endpoints stage marked as enterprise (#19607)
- endpoints: FleetDM connector (#18589)
- endpoints: include license status in agent config (#19227)
- endpoints: show agent version (#19239)
- endpoints/connectors/agent: add tests for IA endpoint stage (#19487)
- endpoints/connectors/agent: fix icon (#19722)
- endpoints/connectors/agent: Skip Endpoint stage on device IA & fix confusing identification subtext (#19482)
- endpoints/devices: cleanup (#19047)
- enterprise/audit: Expanded Diff (#19726)
- enterprise/lifecycle: implement Object Lifecycle Management (#20015)
- enterprise/providers: WS-Federation (#19583)
- enterprise/providers: WSFed configurable realm, default `wreply` (#19996)
- enterprise/reports: improve export list, confirmation (#18981)
- enterprise/search: add static autocomplete structure (#19008)
- events: notifications live update (#18980)
- Fix authenticator sms docs (#19797)
- flows: add option for flow layout with frame background (#19527)
- flows/executor: fix KeyError when session has no existing plan (#18951)
- integrations: add saml steps to mattermost (#19590)
- internal: don't warn on empty outpost for embedded (#18786)
- internal: fix certificate not refetched if fingerprint changes (#19761)
- internal: fix incorrect metric calculation (#19701)
- internal: rework liveness probe and proxy (#19312)
- internal: update TLS Suite (#19076)
- internal/outpost: improve PostgreSQL connection options parsing (#19118)
- lib: add helper for creating events in migration (#20044)
- lib: Add ssh/sftp schemas in to DomainlessFormattedURLValidator (#19881)
- lib: update error logging (#18628)
- lib: use orjson for structlog json (#19462)
- lib/sync: fix sync_dispatch (#19053)
- lib/sync/outgoing: handle deletions even if object does not exist in database (#18968)
- outpost/proxyv2: fix stale session cookie causing 400 error in createState (#19026)
- outpost/proxyv2: reduce max number of postgres connections (#19211)
- outpost/proxyv2: revalidate auth if session fails to load (#18063)
- outposts: fix docker_tls created files permission (#19978)
- outposts: fix permission errors for related certificates (#18861)
- packages/ak-guardian: cast safely (#18929)
- packages/django-dramatiq-postgres: broker: close django connections on consumer close (#18833)
- packages/django-dramatiq-postgres: broker: empty message after task completed successfully (#19340)
- policies: fix Provider's authentication_flow not used when set (#19609)
- providers/oauth2: add `logout+jwt` token type for oidc logout token. (#19554)
- providers/oauth2: allow property mappings to override scope claim in access tokens (#19226)
- providers/oauth2: Automated OpenID Conformance tests (#14785)
- providers/oauth2: Support login_hint (#19498)
- providers/oauth2: use compare_digest for client_secret comparison (#19979)
- providers/proxy: Fix incorrect comparison of redirect URL and CookieDomain (#15686)
- providers/saml: allow encryption certificates without private keys (#19526)
- providers/saml: auto pull signature algorithm options (#17614)
- providers/saml: fix signing order for encrypted saml responses (#19620)
- providers/saml: fix structure of encrypted saml assertion (#19592)
- providers/saml: move sp acs binding down in form (#20039)
- providers/saml: update metadata parser for single logout and encryption certificate (#20031)
- providers/scim: add configuration warning for migration (#19859)
- providers/scim: fix email validation mismatch (#19848)
- providers/scim: import SCIM groups (#19846)
- providers/scim: modify user- and group syncing behavior (#13947)
- rbac: Add show all to roles tab, add role tab to groups (#19097)
- rbac: alter migrated direct permission roles (#18860)
- rbac: clean up roles and permissions (#19588)
- recovery: consume token in transaction (#19967)
- root: Python 3.14 (#17313)
- security: CVE-2026-25227 (#20230)
- security: CVE-2026-25748 (#20231)
- security: CVE-2026-25922 (#20232)
- sources/kerberos: update to new python-kadmin-rs (#19491)
- sources/oauth: add fallback for id_token when profile URL is not available (#19311)
- sources/oauth: Fix an issue where wechat may crash during login. (#18973)
- sources/oauth: Fix InvalidAudienceError in id_token fallback (#20096)
- sources/saml: Add testcases for PR #19593 (#19647)
- sources/saml: Fix signature verification order to accommodate encrypted assertions (#19593)
- sources/saml: prevent authnrequest signature being inside body on redirect (#19898)
- sources/saml: properly catch InvalidSignature exception (#19641)
- sources/saml: Set AuthnRequest ProtocolBinding to HTTP-POST instead of HTTP-Redirect (#17378)
- sources/saml: truncate transient username longer than 150 chars (#19930)
- sources/saml: update handling statusmessage (#19739)
- stages: remove more global state (#18641)
- stages/authenticator\_\*: fix code input field not string (#18875)
- stages/authenticator_static: set max token length to 100 chars (#19162)
- stages/authenticator_validate: decrease reputation on failed MFA attempt (#19378)
- stages/authenticator_webauthn: fix double JSON encoding of webauthn options (#19952)
- stages/identification: replace sleep with make_password (#18883)
- stages/password: replace session-based retries with reputation (#18643)
- stages/prompt: optimize API endpoints (#19251)
- tasks: add queued tasks metrics (#20118)
- tasks/middleware: close connections on worker status update database error (#18881)
- tasks/middlewares: call monitoring_set upon metrics request (#20117)
- web: add "Copy Secret" button to TOTP configuration stage (#19863)
- web: add custom message with links for empty data export list (#18830)
- web: Allow unused spread properties to strict unsafe. (#20084)
- web: Capitalize language display names, code owner fix (#19119)
- web: Captcha Refinements, Part 2 (#19757)
- web: Defer table refresh, visibility checks. (#19194)
- web: disable user settings fields when changes are not allowed (#19132)
- web: display custom attributes on admin view pages (#19720)
- web: Enforce `challenge` nullish types. (#19768)
- web: fix Brand CSS not applied to nested Shadow DOM components (#19892)
- web: Fix development theme overrides (#19826)
- web: fix file search input not resetting results properly (#19034)
- web: fix file upload form (#18808)
- web: Fix flow inspector advancement event. (#19309)
- web: Fix Impersonation, Lit Reactive Controller Contexts (#19114)
- web: Fix locale selector in compatibility mode. (#19946)
- web: fix notification counter (#18781)
- web: fix Open button selecting row instead of navigating (#18992)
- web: fix promoted source button hover losing blue color (#19048)
- web: fix slug auto-updating when editing existing applications (#19169)
- web: Fix stale flow background (#19015)
- web: Fix Storybook package resolution with `npm link` (#19016)
- web: Fix user library colors, modal z-indexes, table progress bars (#19152)
- web: Flow info, localization, back button. (#19234)
- web: Form Modal Independence: Part 1 (#19395)
- web: Images styles, theming (#19233)
- web: Lit Development Mode, performance fixes. (#19825)
- web: Locale selector UI fixes (#18972)
- web: Merge branch -- Stale notifications, synchronized context objects, rendering fixes (#19141)
- web: re-update package-lock.json to include missing tree-sitter references
- web: Reduce Sentry Development Errors (#19504)
- web: refactor TOTP clipboard handlers and secret parsing (#19953)
- web: revert `package-lock.json` by tag workflow (#20349)
- web: Session UI Config Lifecycle (#19788)
- web: Token Form Fixes (#19121)
- web: UI Locale Fixes (#19235)
- web: update @goauthentik/api (#19542)
- web: Vendor SFE Bootstrap (#19766)
- web: Z-Index Fixes, Mobile Sidebar Behavior. (#19460)
- web/a11y: CAPTCHA Stage Form (#19670)
- web/a11y: Locale selector select styles, contrast. (#19634)
- web/admin: add banner to flow import form (#19288)
- web/admin: add UI copy to RBAC modal (#18917)
- web/admin: adjust sync threshold, add tooltip (#19131)
- web/admin: always retrieve selected provider when editing the application (#19341)
- web/admin: endpoint: change wording and add helper text (#18871)
- web/admin: fix brand form sending "undefined" string for blank default application (#19658)
- web/admin: fix button alignment on user view page (#19079)
- web/admin: fix captcha stage provider selector not showing saved value (#19555)
- web/admin: fix dark theme on map (#18985)
- web/admin: fix default binding order (#19943)
- web/admin: fix endpoints user binding (#18935)
- web/admin: fix file upload not preserving extension for custom names with dots (#19548)
- web/admin: Fix haveibeenpwned link in PasswordPolicyForm (#18984)
- web/admin: fix impersonation form requesting data without being opened (#19673)
- web/admin: fix read-only provider selection for application form (#18768)
- web/admin: fix rendering for configuration_warning event (#20050)
- web/admin: fix switches (#19493)
- web/admin: fix toggle-group for bindings now showing up (#19820)
- web/admin: Pluralize Certificate-Key Pair deletion confirmation (#19389)
- web/admin: prevent file upload attempt when backend not managed (#18646)
- web/admin: Register stage elements. Fix linter warnings (#19948)
- web/admin: reword some things on the device view page (#18785)
- web/admin: source forms not rendering (#19887)
- web/admin: use consistent icon for inactive user status (#19032)
- web/admin/rbac: misc object permission fixes (#18859)
- web/common: add dev middleware to show warnings for consecutive identical requests (#19671)
- web/elements: hidden secrets not propagating (#19029)
- web/elements: progress-bar and table loading header (#18934)
- web/elements: reduce spacing between collapsible form groups (#19627)
- web/elements: remove pfbase everywhere (#19623)
- web/elements: stabilize dual-select status height (#19734)
- web/flow: Fix spurious double submit on ak-stage-autosubmit (#18727)
- web/flows: revisit agent stage fallback delay (#20028)
- web/flows: update flow background (#19974)
- web/flows: update icon and text for device classes (#19648)
- web/forms: fix forms not resetting state when modal closes (#19562)
- web/forms: fix invalid date error for empty datetime-local inputs (#19561)
- web/i18n: Fix Japanese and Korean font overrides. (#19994)
- web/sfe: bug: polyfill needed to supply Object.assign() to IE11. (#20126)
- web/sfe: downgrade bootstrap, add access denied test (#19763)
- web/startup: deprecated theme names break theming (#19431)
- web/table: align row action icons and tooltip color (#19736)
- web/user: fix consent delete form missing details (#19147)
- web/user: fix Firefox for Android infinite render loop in user library (#19379)

## Fixed in 2026.2.1

- core: fix get_provider returning base Provider instead of subclass (cherry-pick #19064 to version-2026.2) (#20670)
- crypto: fix kid legacy signal (cherry-pick #20627 to version-2026.2) (#20628)
- enterprise/wsfed: Fix metadata export and signing logic (cherry-pick #20643 to version-2026.2) (#20649)
- internal: make http timeouts configurable (cherry-pick #20472 to version-2026.2) (#20567)
- outpost/proxyv2: prevent panic in handleSignOut (cherry-pick #20097 to version-2026.2) (#20689)
- packages/django-channels-postgres: eagerly delete messages (cherry-pick #20687 to version-2026.2) (#20688)
- packages/django-dramatiq-postgres: fix worker startup on macos (cherry-pick #20637 to version-2026.2) (#20641)
- packages/django-dramatiq-postgres: use fork (cherry-pick #20606 to version-2026.2) (#20608)
- providers/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2026.2) (#20693)
- sources/ldap: add connection logging & downgrade message (cherry-pick #20519 to version-2026.2) (#20636)
- web: fix identification stage styling in compatibility mode (cherry-pick #20684 to version-2026.2) (#20694)
- web/flows: fix source icons being always inverted (cherry-pick #20419 to version-2026.2) (#20607)

## Fixed in 2026.2.2

- core: expiring model: ignore DoesNotExist error (cherry-pick #20922 to version-2026.2) (#20925)
- core: fix provider not nullable (cherry-pick #21275 to version-2026.2) (#21282)
- endpoints: prevent selection of incompatible connector (cherry-pick #20806 to version-2026.2) (#20807)
- endpoints/connectors: fix enabled flag not respected (cherry-pick #21144 to version-2026.2) (#21145)
- enterprise/endpoints/connectors/agent: add login_hint support for interactive auth (cherry-pick #20647 to version-2026.2) (#21047)
- events: avoid implicitly setting context from login_failed event (cherry-pick #21045 to version-2026.2) (#21050)
- events: prevent exception when events contains incompatible unicode (cherry-pick #21048 to version-2026.2) (#21053)
- flows: continuous login debug (cherry-pick #21044 to version-2026.2) (#21090)
- internal: fix certificate fallback without SNI (cherry-pick #21417 to version-2026.2) (#21419)
- outposts: only dispatch logout task if any outpost exists (cherry-pick #20920 to version-2026.2) (#20949)
- packages/django-channels-postgres: provide sync API for group_send (cherry-pick #20740 to version-2026.2) (#20741)
- packages/django-dramatiq-postgres: scheduler: only dispatch tasks if they're not running yet (cherry-pick #20921 to version-2026.2) (#20950)
- providers/ldap: inherit adjustable page size for LDAP searchers (cherry-pick #21377 to version-2026.2) (#21384)
- providers/oauth2: decode percent-encoded basic auth (cherry-pick #20779 to version-2026.2) (#20781)
- providers/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2) (#21140)
- providers/proxy: remove redundant logout event (cherry-pick #20860 to version-2026.2) (#20866)
- providers/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2026.2) (#21284)
- providers/scim: fix out-of-scope users and groups not being deleted from destination application (cherry-pick #20742 to version-2026.2) (#20780)
- providers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2026.2) (#21228)
- sources/ldap: fix exception in ldap debug endpoint (cherry-pick #21219 to version-2026.2) (#21222)
- sources/ldap: fix incorrect error response for invalid sync_users_password (cherry-pick #21016 to version-2026.2) (#21039)
- sources/oauth: Allow patching without provider type (cherry-pick #21211 to version-2026.2) (#21213)
- tasks: allow retry for rejected tasks only (cherry-pick #21433 to version-2026.2) (#21436)
- web/admin: bad width on policy test results (cherry-pick #20668 to version-2026.2) (#20697)
- web/admin: fix missing OSM referrerPolicy header (cherry-pick #20984 to version-2026.2) (#20990)
- web/admin: Fix SCIM page_size UI issue (cherry-pick #20890 to version-2026.2) (#20929)
- web/admin: handle non-string values in formatUUID to prevent Event Log crash (cherry-pick #20804 to version-2026.2) (#21052)
- web/applications: add wsfed to app wizard (cherry-pick #20880 to version-2026.2) (#21184)
- web/flow: be more aggressive about checking inspector hide/show status (#21358)
- web/flow: reset stale authenticator selection between consecutive validate stages (cherry-pick #20802 to version-2026.2) (#21014)
- web/flows: continuous login (cherry-pick #19862 to version-2026.2) (#20712)
- web/rbac: disambiguate duplicate permission names in initial permissions (cherry-pick #20786 to version-2026.2) (#20805)

## Fixed in 2026.2.3

- blueprints: fix reconcile calling @property (cherry-pick #21576 to version-2026.2) (#21616)
- core: bump django from v5.2.12 to 5.2.13 (cherry-pick #21520 to version-2026.2) (#21526)
- core: fix policy binding objects not being nullable (cherry-pick #21421 to version-2026.2) (#21481)
- core: fix search for app entitlements failing (cherry-pick #21944 to version-2026.2) (#21988)
- endpoints: fix tasks failing (cherry-pick #20904 to version-2026.2) (#21538)
- events: fix `destination_group_obj` not being nullable (cherry-pick #22161 to version-2026.2) (#22165)
- security: [CVE-2026-40165](../../security/cves/CVE-2026-40165) (#22282)
- security: [CVE-2026-40166](../../security/cves/CVE-2026-40166) (#22283)
- security: [CVE-2026-40172](https://github.com/goauthentik/authentik/security/advisories/GHSA-h6x7-hjjc-wjc9) (#22284)
- security: [CVE-2026-41569](../../security/cves/CVE-2026-41569) (#22285)
- security: [CVE-2026-41577](https://github.com/goauthentik/authentik/security/advisories/GHSA-4v4x-x5pr-8gp2) (#22286)
- security: [CVE-2026-42849](../../security/cves/CVE-2026-42849) (#22287)
- internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.2 (#22288)
- internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.2 (#22289)
- internal: fix lint (#22263)
- lib/sync/outgoing: avoid expensive query to get number of sync pages (cherry-pick #21575 to version-2026.2) (#21581)
- packages/django-dramatiq-postgres: reset db connections in raise_connection_error (cherry-pick #21577 to version-2026.2) (#21599)
- packages/django-dramatiq-postgres/broker: avoid task processing stopping on decode error (cherry-pick #22110 to version-2026.2) (#22127)
- providers/oauth2: allow cross provider token introspection for federated providers (cherry-pick #21513 to version-2026.2) (#21748)
- providers/oauth2: clip device authorization scope against the provider's ScopeMapping set (cherry-pick #21701 to version-2026.2) (#21799)
- providers/oauth2: don't auto-set redirect_uri (cherry-pick #21746 to version-2026.2) (#21750)
- providers/oauth2: fix time logic in refresh_token_threshold (cherry-pick #21537 to version-2026.2) (#21598)
- providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2026.2) (#21828)
- rbac: ensure migration 0056 runs before 0010 removes group field (cherry-pick #21964 to version-2026.2) (#22033)
- release: 2026.2.3-rc1
- root: update django to 5.2.14 (cherry-pick #22064 to version-2026.2) (#22066)
- tenants/settings: present unset flags as `False` (cherry-pick #22162 to version-2026.2) (#22164)
- web: Fix duplicate Turnstile widgets after extended idle (cherry-pick #21380 to version-2026.2) (#21473)
- web/flows: prevent leader tab deadlock in continuous login flow (cherry-pick #21583 to version-2026.2) (#21627)
- web/packages: Rework SFE rendering (cherry-pick #21833 to version-2026.2) (#21850)

## Fixed in 2026.2.4

- core: bump goauthentik/fips-python from 3.14.3-slim-trixie-fips to 3.14.5-slim-trixie-fips in /lifecycle/container (cherry-pick #22518 to version-2026.2) (#22528)
- core: fix filter_not_expired not accepting positional arguments (#22690)
- endpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.2) (#22596)
- outposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.2) (#22504)
- security: CVE-2026-47201
- security: GHSA-wr38-7xg8-fqxr
- security: GHSA-xp7f-xjjx-gwm8

## Fixed in 2026.2.5

- admin/files: sign custom-domain S3 URLs for the final host (cherry-pick #21704 to version-2026.2) (#23008)
- core: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.2) (#23393)
- endpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.2) (#22950)
- packages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.2) (#23258)
- policies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.2) (#23426)
- providers/\*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.2) (#23232)
- providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.2) (#23766)
- providers/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.2) (#22966)
- providers/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.2) (#23771)
- providers/SCIM: Add discover support (cherry-pick #20658 to version-2026.2) (#23776)
- providers/scim: allow failures during discovery (cherry-pick #23357 to version-2026.2) (#23772)
- root: in-process per-IP rate throttle (#23015) (2026.2) (#23774)
- stages/captcha: fix hcaptcha height (#20901) (2026.2) (#23775)
- tasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.2) (#23526)
- web: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.2) (#22457)
- web/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.2) (#23557)

## Fixed in 2026.2.6

- lib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.2) (#24018)
- packages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.2) (#24034)
- security: automated internal backport of patch 1817.sec.patch to authentik-2026.2 (#24053)
- security: automated internal backport of patch 1822.sec.patch to authentik-2026.2 (#24054)
- security: automated internal backport of patch 1887.sec.patch to authentik-2026.2 (#24055)
- security: automated internal backport of patch 1919.sec.patch to authentik-2026.2 (#24056)
- security: automated internal backport of patch 1934.sec.patch to authentik-2026.2 (#24057)
- sources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.2) (#24021)
- tests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.2) (#23835)

## Fixed in 2026.2.7

- core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.2) (#24817)
- core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.2) (#24956)
- lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.2) (#25759)
- lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.2) (#24113)
- policies: filter policy engine (cherry-pick #24025 to version-2026.2) (#24169)
- providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.2) (#24443)
- rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.2) (#24946)
- security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.2 (#25955)
- security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.2 (#25956)
- security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.2 (#25957)
- security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.2 (#25958)
- security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.2 (#25959)
- server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.2) (#25363)
- stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.2) (#25499)

## API Changes

### authentik (v2026.2.0)

---

#### What's New

---

##### `DELETE` /core/authenticated_sessions/bulk_delete/

##### `GET` /endpoints/fleet/connectors/

##### `POST` /endpoints/fleet/connectors/

##### `GET` /endpoints/fleet/connectors/&#123;connector_uuid&#125;/

##### `PUT` /endpoints/fleet/connectors/&#123;connector_uuid&#125;/

##### `DELETE` /endpoints/fleet/connectors/&#123;connector_uuid&#125;/

##### `PATCH` /endpoints/fleet/connectors/&#123;connector_uuid&#125;/

##### `GET` /endpoints/fleet/connectors/&#123;connector_uuid&#125;/used_by/

##### `POST` /lifecycle/iterations/

##### `GET` /lifecycle/iterations/latest/&#123;content_type&#125;/&#123;object_id&#125;/

##### `GET` /lifecycle/iterations/open/

##### `POST` /lifecycle/reviews/

##### `GET` /lifecycle/rules/

##### `POST` /lifecycle/rules/

##### `GET` /lifecycle/rules/&#123;id&#125;/

##### `PUT` /lifecycle/rules/&#123;id&#125;/

##### `DELETE` /lifecycle/rules/&#123;id&#125;/

##### `PATCH` /lifecycle/rules/&#123;id&#125;/

##### `GET` /providers/wsfed/

##### `POST` /providers/wsfed/

##### `GET` /providers/wsfed/&#123;id&#125;/

##### `PUT` /providers/wsfed/&#123;id&#125;/

##### `DELETE` /providers/wsfed/&#123;id&#125;/

##### `PATCH` /providers/wsfed/&#123;id&#125;/

##### `GET` /providers/wsfed/&#123;id&#125;/metadata/

##### `GET` /providers/wsfed/&#123;id&#125;/preview_user/

##### `GET` /providers/wsfed/&#123;id&#125;/used_by/

#### What's Changed

---

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `enterprise_audit_include_expanded_diff`
        * Added property `enterprise_audit_include_expanded_diff` (boolean)

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Changed property `flags` (object)

    New required properties:
    - `enterprise_audit_include_expanded_diff`
    * Added property `enterprise_audit_include_expanded_diff` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `enterprise_audit_include_expanded_diff`
        * Added property `enterprise_audit_include_expanded_diff` (boolean)

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Changed property `flags` (object)

    New required properties:
    - `enterprise_audit_include_expanded_diff`
    * Added property `enterprise_audit_include_expanded_diff` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `enterprise_audit_include_expanded_diff`
        * Added property `enterprise_audit_include_expanded_diff` (boolean)

##### `POST` /core/users/&#123;id&#125;/recovery/

###### Request:

New content type : `application/json`

##### `POST` /core/users/&#123;id&#125;/recovery_email/

###### Parameters:

Deleted: `email_stage` in `query`

###### Request:

New content type : `application/json`

##### `POST` /core/users/export/

###### Parameters:

Added: `last_login` in `query`

Added: `last_login__gt` in `query`

Added: `last_login__isnull` in `query`

Added: `last_login__lt` in `query`

##### `GET` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `fingerprint_sha256` (string)

        > SHA256 fingerprint of the certificate

    - Changed property `fingerprint_sha1` (string)

        > SHA1 fingerprint of the certificate

    - Changed property `cert_expiry` (string)

        > Certificate expiry date

    - Changed property `cert_subject` (string)

        > Certificate subject as RFC4514 string

    - Changed property `key_type` (string)
        > Key algorithm type detected from the certificate's public key

##### `PUT` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `fingerprint_sha256` (string)

        > SHA256 fingerprint of the certificate

    - Changed property `fingerprint_sha1` (string)

        > SHA1 fingerprint of the certificate

    - Changed property `cert_expiry` (string)

        > Certificate expiry date

    - Changed property `cert_subject` (string)

        > Certificate subject as RFC4514 string

    - Changed property `key_type` (string)
        > Key algorithm type detected from the certificate's public key

##### `PATCH` /crypto/certificatekeypairs/&#123;kp_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `fingerprint_sha256` (string)

        > SHA256 fingerprint of the certificate

    - Changed property `fingerprint_sha1` (string)

        > SHA1 fingerprint of the certificate

    - Changed property `cert_expiry` (string)

        > Certificate expiry date

    - Changed property `cert_subject` (string)

        > Certificate subject as RFC4514 string

    - Changed property `key_type` (string)
        > Key algorithm type detected from the certificate's public key

##### `POST` /crypto/certificatekeypairs/generate/

###### Request:

Changed content type : `application/json`

- Changed property `alg` (string)

    Added enum values:
    - `ed25519`
    - `ed448`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `fingerprint_sha256` (string)

        > SHA256 fingerprint of the certificate

    - Changed property `fingerprint_sha1` (string)

        > SHA1 fingerprint of the certificate

    - Changed property `cert_expiry` (string)

        > Certificate expiry date

    - Changed property `cert_subject` (string)

        > Certificate subject as RFC4514 string

    - Changed property `key_type` (string)
        > Key algorithm type detected from the certificate's public key

##### `GET` /endpoints/agents/enrollment_tokens/&#123;token_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `device_group_obj` (object)
        - Added property `attributes` (object)

##### `PUT` /endpoints/agents/enrollment_tokens/&#123;token_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `device_group_obj` (object)
        - Added property `attributes` (object)

##### `PATCH` /endpoints/agents/enrollment_tokens/&#123;token_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `device_group_obj` (object)
        - Added property `attributes` (object)

##### `GET` /endpoints/device_access_groups/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `attributes` (object)

##### `PUT` /endpoints/device_access_groups/&#123;pbm_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `attributes` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `attributes` (object)

##### `PATCH` /endpoints/device_access_groups/&#123;pbm_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `attributes` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `attributes` (object)

##### `POST` /events/events/export/

###### Parameters:

Changed: `actions` in `query`

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.fleet`
        - `authentik.enterprise.lifecycle`
        - `authentik.enterprise.providers.ws_federation`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_fleet.fleetconnector`
        - `authentik_lifecycle.lifecyclerule`
        - `authentik_lifecycle.lifecycleiteration`
        - `authentik_lifecycle.review`
        - `authentik_providers_ws_federation.wsfederationprovider`

##### `PUT` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:
    - `configuration_warning`
    - `review_initiated`
    - `review_overdue`
    - `review_attested`
    - `review_completed`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.enterprise.endpoints.connectors.fleet`
    - `authentik.enterprise.lifecycle`
    - `authentik.enterprise.providers.ws_federation`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints_connectors_fleet.fleetconnector`
    - `authentik_lifecycle.lifecyclerule`
    - `authentik_lifecycle.lifecycleiteration`
    - `authentik_lifecycle.review`
    - `authentik_providers_ws_federation.wsfederationprovider`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.fleet`
        - `authentik.enterprise.lifecycle`
        - `authentik.enterprise.providers.ws_federation`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_fleet.fleetconnector`
        - `authentik_lifecycle.lifecyclerule`
        - `authentik_lifecycle.lifecycleiteration`
        - `authentik_lifecycle.review`
        - `authentik_providers_ws_federation.wsfederationprovider`

##### `PATCH` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:
    - `configuration_warning`
    - `review_initiated`
    - `review_overdue`
    - `review_attested`
    - `review_completed`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.enterprise.endpoints.connectors.fleet`
    - `authentik.enterprise.lifecycle`
    - `authentik.enterprise.providers.ws_federation`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints_connectors_fleet.fleetconnector`
    - `authentik_lifecycle.lifecyclerule`
    - `authentik_lifecycle.lifecycleiteration`
    - `authentik_lifecycle.review`
    - `authentik_providers_ws_federation.wsfederationprovider`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.fleet`
        - `authentik.enterprise.lifecycle`
        - `authentik.enterprise.providers.ws_federation`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_fleet.fleetconnector`
        - `authentik_lifecycle.lifecyclerule`
        - `authentik_lifecycle.lifecycleiteration`
        - `authentik_lifecycle.review`
        - `authentik_providers_ws_federation.wsfederationprovider`

##### `GET` /rbac/roles/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `PUT` /rbac/roles/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `PATCH` /rbac/roles/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `enterprise_audit_include_expanded_diff`
        * Added property `enterprise_audit_include_expanded_diff` (boolean)

##### `GET` /core/groups/&#123;group_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `PUT` /core/groups/&#123;group_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `PATCH` /core/groups/&#123;group_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `GET` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `PUT` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `PATCH` /core/tokens/&#123;identifier&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `PUT` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `PATCH` /core/users/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `POST` /crypto/certificatekeypairs/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `fingerprint_sha256` (string)

        > SHA256 fingerprint of the certificate

    - Changed property `fingerprint_sha1` (string)

        > SHA1 fingerprint of the certificate

    - Changed property `cert_expiry` (string)

        > Certificate expiry date

    - Changed property `cert_subject` (string)

        > Certificate subject as RFC4514 string

    - Changed property `key_type` (string)
        > Key algorithm type detected from the certificate's public key

##### `GET` /crypto/certificatekeypairs/

###### Parameters:

Deleted: `include_details` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > CertificateKeyPair Serializer
        - Changed property `fingerprint_sha256` (string)

            > SHA256 fingerprint of the certificate

        - Changed property `fingerprint_sha1` (string)

            > SHA1 fingerprint of the certificate

        - Changed property `cert_expiry` (string)

            > Certificate expiry date

        - Changed property `cert_subject` (string)

            > Certificate subject as RFC4514 string

        - Changed property `key_type` (string)
            > Key algorithm type detected from the certificate's public key

##### `POST` /endpoints/agents/connectors/check_in/

###### Request:

Changed content type : `application/json`

- Changed property `os` (object)

    > For example:
    > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
    > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;
    - Changed property `name` (string)

        > Operating System name, such as 'Server 2022' or 'Ubuntu'

    - Changed property `version` (string)
        > Operating System version, must always be the version number but may contain build name

##### `POST` /endpoints/agents/enrollment_tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `device_group_obj` (object)
        - Added property `attributes` (object)

##### `GET` /endpoints/agents/enrollment_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object):
        - Changed property `device_group_obj` (object)
            - Added property `attributes` (object)

##### `POST` /endpoints/device_access_groups/

###### Request:

Changed content type : `application/json`

- Added property `attributes` (object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `attributes` (object)

##### `GET` /endpoints/device_access_groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object):
        - Added property `attributes` (object)

##### `GET` /events/events/&#123;event_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

##### `PUT` /events/events/&#123;event_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    Added enum values:
    - `configuration_warning`
    - `review_initiated`
    - `review_overdue`
    - `review_attested`
    - `review_completed`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

##### `PATCH` /events/events/&#123;event_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    Added enum values:
    - `configuration_warning`
    - `review_initiated`
    - `review_overdue`
    - `review_attested`
    - `review_completed`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

##### `GET` /events/events/volume/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Count of events of action created on day
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

##### `GET` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `PUT` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `PATCH` /events/rules/&#123;pbm_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /flows/instances/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `layout` (string)

        Added enum values:
        - `sidebar_left_frame_background`
        - `sidebar_right_frame_background`

##### `PUT` /flows/instances/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `layout` (string)

    Added enum values:
    - `sidebar_left_frame_background`
    - `sidebar_right_frame_background`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `layout` (string)

        Added enum values:
        - `sidebar_left_frame_background`
        - `sidebar_right_frame_background`

##### `PATCH` /flows/instances/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `layout` (string)

    Added enum values:
    - `sidebar_left_frame_background`
    - `sidebar_right_frame_background`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `layout` (string)

        Added enum values:
        - `sidebar_left_frame_background`
        - `sidebar_right_frame_background`

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:
    - `configuration_warning`
    - `review_initiated`
    - `review_overdue`
    - `review_attested`
    - `review_completed`

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.enterprise.endpoints.connectors.fleet`
    - `authentik.enterprise.lifecycle`
    - `authentik.enterprise.providers.ws_federation`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints_connectors_fleet.fleetconnector`
    - `authentik_lifecycle.lifecyclerule`
    - `authentik_lifecycle.lifecycleiteration`
    - `authentik_lifecycle.review`
    - `authentik_providers_ws_federation.wsfederationprovider`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `action` (string)

        > Match created events with this action type. When left empty, all action types will be matched.

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.fleet`
        - `authentik.enterprise.lifecycle`
        - `authentik.enterprise.providers.ws_federation`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_fleet.fleetconnector`
        - `authentik_lifecycle.lifecyclerule`
        - `authentik_lifecycle.lifecycleiteration`
        - `authentik_lifecycle.review`
        - `authentik_providers_ws_federation.wsfederationprovider`

##### `GET` /policies/event_matcher/

###### Parameters:

Changed: `action` in `query`

> Match created events with this action type. When left empty, all action types will be matched.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Changed property `action` (string)

            > Match created events with this action type. When left empty, all action types will be matched.

            Added enum values:
            - `configuration_warning`
            - `review_initiated`
            - `review_overdue`
            - `review_attested`
            - `review_completed`

        - Changed property `app` (string)

            > Match events created by selected application. When left empty, all applications are matched.

            Added enum values:
            - `authentik.enterprise.endpoints.connectors.fleet`
            - `authentik.enterprise.lifecycle`
            - `authentik.enterprise.providers.ws_federation`

        - Changed property `model` (string)

            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

            Added enum values:
            - `authentik_endpoints_connectors_fleet.fleetconnector`
            - `authentik_lifecycle.lifecyclerule`
            - `authentik_lifecycle.lifecycleiteration`
            - `authentik_lifecycle.review`
            - `authentik_providers_ws_federation.wsfederationprovider`

##### `GET` /providers/scim/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `group_filters` (array)

        > Group filters used to define sync-scope for groups.

        Items (string):

    - Deleted property `filter_group` (string)

##### `PUT` /providers/scim/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `group_filters` (array)

    > Group filters used to define sync-scope for groups.

- Deleted property `filter_group` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `group_filters` (array)

        > Group filters used to define sync-scope for groups.

    - Deleted property `filter_group` (string)

##### `PATCH` /providers/scim/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `group_filters` (array)

    > Group filters used to define sync-scope for groups.

- Deleted property `filter_group` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `group_filters` (array)

        > Group filters used to define sync-scope for groups.

    - Deleted property `filter_group` (string)

##### `GET` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `PUT` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `PATCH` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /rbac/permissions/

###### Parameters:

Deleted: `user` in `query`

##### `POST` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_endpoints_connectors_fleet.fleetconnector`
    - `authentik_lifecycle.lifecyclerule`
    - `authentik_lifecycle.lifecycleiteration`
    - `authentik_lifecycle.review`
    - `authentik_providers_ws_federation.wsfederationprovider`

##### `PATCH` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_endpoints_connectors_fleet.fleetconnector`
    - `authentik_lifecycle.lifecyclerule`
    - `authentik_lifecycle.lifecycleiteration`
    - `authentik_lifecycle.review`
    - `authentik_providers_ws_federation.wsfederationprovider`

##### `POST` /rbac/roles/

###### Request:

Changed content type : `application/json`

- Changed property `name` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `name` (string)

##### `GET` /rbac/roles/

###### Parameters:

Added: `groups` in `query`

Deleted: `ak_groups` in `query`

Changed: `inherited` in `query`

> Include inherited roles (requires users or groups filter)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `GET` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `PUT` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `PATCH` /sources/scim/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /ssf/streams/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `provider_obj` (object)

        > SSFProvider Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer
                - Changed property `roles_obj` (array)

                    Changed items (object): > Role serializer
                    - Changed property `name` (string)

##### `POST` /stages/authenticator/duo/&#123;stage_uuid&#125;/enrollment_status/

##### `GET` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `POST` /core/groups/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `GET` /core/groups/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `POST` /core/tokens/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `user_obj` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /core/tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /core/user_consent/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `POST` /core/users/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `roles_obj` (array)

        Changed items (object): > Role serializer
        - Changed property `name` (string)

##### `GET` /core/users/

###### Parameters:

Added: `last_login` in `query`

Added: `last_login__gt` in `query`

Added: `last_login__isnull` in `query`

Added: `last_login__lt` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /endpoints/devices/&#123;device_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `access_group_obj` (object)
        - Added property `attributes` (object)

    - Changed property `connections_obj` (array)

        Changed items (object):
        - Changed property `latest_snapshot` (object)

            New required properties:
            - `vendor`
            * Added property `vendor` (object)

                Enum values:
                - `goauthentik.io/@merged`
                - `goauthentik.io/platform`
                - `fleetdm.com`

    - Changed property `facts` (object)

        New required properties:
        - `vendor`
        * Added property `vendor` (object)

        * Changed property `data` (object)
            - Changed property `os` (object)

                > For example:
                > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;
                - Changed property `name` (string)

                    > Operating System name, such as 'Server 2022' or 'Ubuntu'

                - Changed property `version` (string)
                    > Operating System version, must always be the version number but may contain build name

##### `PUT` /endpoints/devices/&#123;device_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `access_group_obj` (object)
    - Added property `attributes` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `access_group_obj` (object)
        - Added property `attributes` (object)

    - Changed property `facts` (object)

        New required properties:
        - `vendor`
        * Added property `vendor` (object)

        * Changed property `data` (object)
            - Changed property `os` (object)

                > For example:
                > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;
                - Changed property `name` (string)

                    > Operating System name, such as 'Server 2022' or 'Ubuntu'

                - Changed property `version` (string)
                    > Operating System version, must always be the version number but may contain build name

##### `PATCH` /endpoints/devices/&#123;device_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `access_group_obj` (object)
    - Added property `attributes` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `access_group_obj` (object)
        - Added property `attributes` (object)

    - Changed property `facts` (object)

        New required properties:
        - `vendor`
        * Added property `vendor` (object)

        * Changed property `data` (object)
            - Changed property `os` (object)

                > For example:
                > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;
                - Changed property `name` (string)

                    > Operating System name, such as 'Server 2022' or 'Ubuntu'

                - Changed property `version` (string)
                    > Operating System version, must always be the version number but may contain build name

##### `POST` /events/events/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

    Added enum values:
    - `configuration_warning`
    - `review_initiated`
    - `review_overdue`
    - `review_attested`
    - `review_completed`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

##### `GET` /events/events/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Serializer
        - Changed property `action` (string)

            Added enum values:
            - `configuration_warning`
            - `review_initiated`
            - `review_overdue`
            - `review_attested`
            - `review_completed`

##### `GET` /events/notifications/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

            Added enum values:
            - `configuration_warning`
            - `review_initiated`
            - `review_overdue`
            - `review_attested`
            - `review_completed`

##### `PUT` /events/notifications/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

    > Event Serializer
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

            Added enum values:
            - `configuration_warning`
            - `review_initiated`
            - `review_overdue`
            - `review_attested`
            - `review_completed`

##### `PATCH` /events/notifications/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

    > Event Serializer
    - Changed property `action` (string)

        Added enum values:
        - `configuration_warning`
        - `review_initiated`
        - `review_overdue`
        - `review_attested`
        - `review_completed`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `event` (object)

        > Event Serializer
        - Changed property `action` (string)

            Added enum values:
            - `configuration_warning`
            - `review_initiated`
            - `review_overdue`
            - `review_attested`
            - `review_completed`

##### `POST` /events/rules/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `destination_group_obj` (object)

        > Group Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /events/rules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationRule Serializer
        - Changed property `destination_group_obj` (object)

            > Group Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /flows/bindings/&#123;fsb_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `PUT` /flows/bindings/&#123;fsb_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `PATCH` /flows/bindings/&#123;fsb_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Changed property `layout` (string)

    Added enum values:
    - `sidebar_left_frame_background`
    - `sidebar_right_frame_background`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `layout` (string)

        Added enum values:
        - `sidebar_left_frame_background`
        - `sidebar_right_frame_background`

##### `GET` /flows/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Flow Serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Added property `group_filters` (array)

    > Group filters used to define sync-scope for groups.

- Deleted property `filter_group` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `group_filters` (array)

        > Group filters used to define sync-scope for groups.

    - Deleted property `filter_group` (string)

##### `GET` /providers/scim/

###### Parameters:

Added: `group_filters` in `query`

Deleted: `filter_group` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProvider Serializer
        - Added property `group_filters` (array)

            > Group filters used to define sync-scope for groups.

        - Deleted property `filter_group` (string)

##### `POST` /providers/ssf/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /providers/ssf/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFProvider Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer
                - Changed property `roles_obj` (array)

                    Changed items (object): > Role serializer
                    - Changed property `name` (string)

##### `GET` /rbac/permissions/assigned_by_roles/

###### Parameters:

Changed: `model` in `query`

##### `POST` /sources/plex/redeem_token/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_info` (object)

        > Contextual flow information for a challenge
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `POST` /sources/scim/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `token_obj` (object)

        > Token Serializer
        - Changed property `user_obj` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /sources/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMSource Serializer
        - Changed property `token_obj` (object)

            > Token Serializer
            - Changed property `user_obj` (object)

                > User Serializer
                - Changed property `roles_obj` (array)

                    Changed items (object): > Role serializer
                    - Changed property `name` (string)

##### `GET` /ssf/streams/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFStream Serializer
        - Changed property `provider_obj` (object)

            > SSFProvider Serializer
            - Changed property `token_obj` (object)

                > Token Serializer
                - Changed property `user_obj` (object)

                    > User Serializer
                    - Changed property `roles_obj` (array)

                        Changed items (object): > Role serializer
                        - Changed property `name` (string)

##### `GET` /stages/all/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/duo/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/duo/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/duo/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/endpoint_gdtc/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/endpoint_gdtc/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/endpoint_gdtc/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/sms/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/sms/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/sms/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/static/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/static/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/static/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/totp/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/totp/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/totp/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/captcha/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/captcha/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/captcha/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/consent/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/consent/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/consent/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/deny/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/deny/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/deny/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/dummy/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/dummy/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/dummy/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/email/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/endpoints/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/endpoints/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/endpoints/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/identification/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/identification/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/identification/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Invitation Serializer
        - Changed property `flow_obj` (object)

            > Flow Serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `GET` /stages/invitation/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/invitation/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/invitation/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/mtls/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/mtls/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/mtls/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/password/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/password/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/password/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `POST` /stages/prompt/prompts/preview/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_info` (object)

        > Contextual flow information for a challenge
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/prompt/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/prompt/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/prompt/stages/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/redirect/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/redirect/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/redirect/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/source/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/source/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/source/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_delete/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/user_delete/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/user_delete/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_login/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/user_login/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/user_login/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_logout/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/user_logout/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/user_logout/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_write/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PUT` /stages/user_write/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `PATCH` /stages/user_write/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /core/user_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserConsent Serializer
        - Changed property `user` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /endpoints/devices/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object):
        - Changed property `access_group_obj` (object)
            - Added property `attributes` (object)

        - Changed property `facts` (object)

            New required properties:
            - `vendor`
            * Added property `vendor` (object)

            * Changed property `data` (object)
                - Changed property `os` (object)

                    > For example:
                    > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                    > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;
                    - Changed property `name` (string)

                        > Operating System name, such as 'Server 2022' or 'Ubuntu'

                    - Changed property `version` (string)
                        > Operating System version, must always be the version number but may contain build name

##### `GET` /events/notifications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Notification Serializer
        - Changed property `event` (object)

            > Event Serializer
            - Changed property `action` (string)

                Added enum values:
                - `configuration_warning`
                - `review_initiated`
                - `review_overdue`
                - `review_attested`
                - `review_completed`

##### `POST` /flows/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `stage_obj` (object)

        > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `GET` /flows/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > FlowStageBinding Serializer
        - Changed property `stage_obj` (object)

            > Stage Serializer
            - Changed property `flow_set` (array)

                Changed items (object): > Stripped down flow serializer
                - Changed property `layout` (string)

                    Added enum values:
                    - `sidebar_left_frame_background`
                    - `sidebar_right_frame_background`

##### `GET` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-source-oauth-apple` component:
    - Changed property `flow_info` (object) > Contextual flow information for a challenge
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

        Updated `ak-stage-identification` component:

    - Added property `pending_user_identifier` (string)

##### `POST` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-source-oauth-apple` component:
    - Changed property `flow_info` (object) > Contextual flow information for a challenge
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

        Updated `ak-stage-identification` component:

    - Added property `pending_user_identifier` (string)

##### `GET` /flows/inspector/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `plans` (array)

        Changed items (object): > Serializer for an active FlowPlan
        - Changed property `current_stage` (object)

            > FlowStageBinding Serializer
            - Changed property `stage_obj` (object)

                > Stage Serializer
                - Changed property `flow_set` (array)

                    Changed items (object): > Stripped down flow serializer
                    - Changed property `layout` (string)

                        Added enum values:
                        - `sidebar_left_frame_background`
                        - `sidebar_right_frame_background`

##### `GET` /oauth2/access_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /oauth2/authorization_codes/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /oauth2/refresh_tokens/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user` (object)

        > User Serializer
        - Changed property `roles_obj` (array)

            Changed items (object): > Role serializer
            - Changed property `name` (string)

##### `GET` /stages/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Stage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/duo/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/duo/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorDuoStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/email/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorEmailStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/endpoint_gdtc/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/endpoint_gdtc/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorEndpointGDTCStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/sms/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/sms/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorSMSStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/static/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/static/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorStaticStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/totp/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/totp/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorTOTPStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/validate/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorValidateStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorWebAuthnStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/captcha/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > CaptchaStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/consent/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > ConsentStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/deny/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/deny/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > DenyStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/dummy/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/dummy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > DummyStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/email/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/email/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > EmailStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/endpoints/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/endpoints/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > EndpointStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/identification/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/identification/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > IdentificationStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/invitation/stages/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/invitation/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > InvitationStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/mtls/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/mtls/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > MutualTLSStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/password/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/password/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PasswordStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `GET` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `PUT` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `PATCH` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/prompt/stages/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/prompt/stages/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > PromptStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/redirect/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/redirect/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > RedirectStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/source/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/source/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SourceStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/user_delete/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_delete/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserDeleteStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/user_login/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_login/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserLoginStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/user_logout/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_logout/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserLogoutStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `POST` /stages/user_write/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_set` (array)

        Changed items (object): > Stripped down flow serializer
        - Changed property `layout` (string)

            Added enum values:
            - `sidebar_left_frame_background`
            - `sidebar_right_frame_background`

##### `GET` /stages/user_write/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserWriteStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider_model` (string)

    Added enum value:
    - `authentik_providers_ws_federation.wsfederationprovider`

- Changed property `provider` (object)

    Added 'authentik_providers_ws_federation.wsfederationprovider' provider_model:
    - Property `name` (string)

    - Property `authentication_flow` (string)

        > Flow used for authentication when the associated application is accessed by an un-authenticated user.

    - Property `authorization_flow` (string)

        > Flow used when authorizing this provider.

    - Property `invalidation_flow` (string)

        > Flow used ending the session from a provider.

    - Property `property_mappings` (array)

        Items (string):

    - Property `reply_url` (string)

    - Property `wtrealm` (string)

    - Property `assertion_valid_not_before` (string)

        > Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).

    - Property `assertion_valid_not_on_or_after` (string)

        > Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

    - Property `session_valid_not_on_or_after` (string)

        > Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

    - Property `name_id_mapping` (string)

        > Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered

    - Property `authn_context_class_ref_mapping` (string)

        > Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.

    - Property `digest_algorithm` (string)

        Enum values:
        - `http://www.w3.org/2000/09/xmldsig#sha1`
        - `http://www.w3.org/2001/04/xmlenc#sha256`
        - `http://www.w3.org/2001/04/xmldsig-more#sha384`
        - `http://www.w3.org/2001/04/xmlenc#sha512`

    - Property `signature_algorithm` (string)

        Enum values:
        - `http://www.w3.org/2000/09/xmldsig#rsa-sha1`
        - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha256`
        - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha384`
        - `http://www.w3.org/2001/04/xmldsig-more#rsa-sha512`
        - `http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1`
        - `http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256`
        - `http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384`
        - `http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512`
        - `http://www.w3.org/2000/09/xmldsig#dsa-sha1`

    - Property `signing_kp` (string)

        > Keypair used to sign outgoing Responses going to the Service Provider.

    - Property `encryption_kp` (string)

        > When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the private key.

    - Property `sign_assertion` (boolean)

    - Property `sign_logout_request` (boolean)

    - Property `default_name_id_policy` (string)

        Enum values:
        - `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`
        - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
        - `urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName`
        - `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName`
        - `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`
        - `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`

        Updated `authentik_providers_scim.scimprovider` provider_model:

    - Added property `group_filters` (array)

        > Group filters used to define sync-scope for groups.

    - Deleted property `filter_group` (string)

##### `GET` /oauth2/access_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /oauth2/authorization_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
        - Changed property `user` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `GET` /oauth2/refresh_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Serializer for BaseGrantModel and RefreshToken
        - Changed property `user` (object)

            > User Serializer
            - Changed property `roles_obj` (array)

                Changed items (object): > Role serializer
                - Changed property `name` (string)

##### `POST` /stages/prompt/prompts/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `prompt_stages_obj` (array)

        Changed items (object): > PromptStage Serializer
        - Changed property `flow_set` (array)

            Changed items (object): > Stripped down flow serializer
            - Changed property `layout` (string)

                Added enum values:
                - `sidebar_left_frame_background`
                - `sidebar_right_frame_background`

##### `GET` /stages/prompt/prompts/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Prompt Serializer
        - Changed property `prompt_stages_obj` (array)

            Changed items (object): > PromptStage Serializer
            - Changed property `flow_set` (array)

                Changed items (object): > Stripped down flow serializer
                - Changed property `layout` (string)

                    Added enum values:
                    - `sidebar_left_frame_background`
                    - `sidebar_right_frame_background`

#### Result

---

API changes broke backward compatibility

---

## Release 2026.5

<!-- spellchecker:ignore fqxr xjjx -->

## Highlights

- **Account Lockdown**: :ak-enterprise A new panic button for compromised accounts that can immediately cut off access, revoke tokens, end sessions, and leave an audit trail.
- **Conditional Access**: :ak-enterprise New connectors verify device compliance and feed it into conditional access flows: Fleet (via Fleet certificates and an mTLS stage, without the authentik agent) and Google Chrome (via Chrome Enterprise Device Trust).
- **`AKQL` is now open source**: The `AKQL` search query language, previously enterprise-only, is now free for everyone to use.
- **Command Palette and wizard upgrades**: A new `Cmd + K` command palette to search the authentik UI, alongside reworked wizards including a new user creation wizard, improved binding wizard, and new invitation wizard.
- **Performance improvements**: The new Rust worker entrypoint drops memory usage by approximately 200 MB per worker container, and opens one fewer PostgreSQL connection per worker. The Admin interface is less resource-intensive through lazy-loaded modals.

## Breaking changes

### Listening on multiple IPs

For advanced use cases, authentik now supports setting listening settings to a comma-separated list of IPs. With this change, the default IP we listen on changed from `0.0.0.0` to `[::]` to better match ecosystem standards. Some IPv4-only environments might need to adapt those settings.

### PostgreSQL custom connection options are deprecated

The `AUTHENTIK_POSTGRESQL__CONN_OPTIONS` and its replica equivalent are deprecated and will be removed in the next version. It was never properly used and may cause future breakages. If you're looking for a specific usage, open an issue to discuss alternative solutions.

## New features and improvements

### Account Lockdown :ak-enterprise

Account Lockdown gives administrators and users a panic button to secure an account when compromise is suspected. From the Admin interface, an administrator can lock down a user directly from their detail page; users can also lock down their own account from **Settings** if they no longer trust their password or active sessions.

A lockdown can deactivate the account, invalidate the local authentik password, terminate active sessions, revoke API/app/recovery/verification/OAuth tokens and grants, and record the reason in the audit log. authentik includes a packaged blueprint with warnings, reason collection, and completion messages so teams can get started quickly and customize the experience where needed.

For setup details, refer to the [Account Lockdown documentation](../../security/account-lockdown.mdx).

### Conditional access :ak-enterprise

We've added two new connectors that verify device compliance and let you use them as a signal in conditional access flows.

**Fleet**: authentik can now verify user devices based on their Fleet certificates without requiring the authentik agent, using the Fleet Connector together with an mTLS stage. For details, refer to the [Fleet Conditional Access documentation](../../endpoint-devices/device-compliance/fleet-conditional-access.mdx).

**Google Chrome**: authentik now includes a [Google Device Trust connector](../../endpoint-devices/device-compliance/connectors/google-chrome.mdx) that integrates with Chrome Enterprise Device Trust via the Chrome Verified Access API. This lets authentik validate that a user's Chrome browser or ChromeOS device is compliant — for example, running an up-to-date version with security patches applied. The connector is especially useful for BYOD environments and remote workforces where device compliance can't be assumed.

### Tap-to-login Secure Enclave support :ak-enterprise

[Endpoint Devices](../../endpoint-devices/index.mdx) now support independent Secure Enclave keys for tap-to-login. This allows iPhone and Apple Watch credentials to be bound directly to a user, so tap-to-login can work without first pairing the credential to a specific endpoint device.

### 2FA attempt throttling

The [Authenticator Validation stage](../../add-secure-apps/flows-stages/stages/authenticator_validate/index.mdx) can now throttle repeated failed attempts for email and SMS OTP devices, extending the same brute-force protection already available for TOTP and static authenticators. Admins can tune throttling behavior to slow down repeated guessing attempts without changing the user's login flow.

### Import hashed passwords

authentik can now bootstrap and import users with pre-hashed Django passwords, making automated installs and migrations safer by avoiding plaintext passwords in deployment workflows.

Use [`AUTHENTIK_BOOTSTRAP_PASSWORD_HASH`](../../install-config/automated-install.mdx#authentik_bootstrap_password_hash) for the initial `akadmin` password, generate hashes with the new `hash_password` command, or import hashes later through blueprints and the user password-hash API.

Hashed-password imports update authentik's local password verifier only. Because authentik never receives the raw password, these imports are not written back to LDAP or Kerberos sources.

### Command Palette

The new command palette lets you quickly navigate authentik without clicking through menus. Press `Cmd + K` (or `Ctrl + K` on Windows and Linux) from anywhere in the UI to open it, then start typing to jump to a page, run an action, or look up a user. You can also use `Cmd/Ctrl + /` to jump straight into search, or `Cmd/Ctrl + Shift + K` to open directly to the actions list.

Results are grouped by category, including pages within authentik, users, and documentation searches that open on docs.goauthentik.io. The palette is designed to make routine admin tasks faster — useful when you know what you want to do but don't want to hunt for the right menu.

### WebAuthn Client Hints support

The WebAuthn Stage now supports the `hints` parameter from the [WebAuthn Level 3 spec](https://www.w3.org/TR/webauthn-3/#enum-hints). Admins can configure one or more hints (`security-key`, `client-device`, or `hybrid`) to tell the browser which authenticator type to expect. The browser uses this to skip straight to the relevant selection UI during passkey registration and authentication, reducing friction especially in enterprise deployments where security keys are mandatory.

Keep in mind that hints are advisory — they only affect the browser UI, not policy. Authenticator type requirements still need to be enforced server-side.

### `AKQL` is now open source

The `AKQL` search query language was previously an enterprise-only feature. `AKQL` is now free for everyone to use, allowing searches based on specific attributes such as `context.geo.country = "Germany"`. For the full syntax and a list of where you can use it, see the [AKQL reference](../../sys-mgmt/akql.mdx).

### OAuth2 configurable grant types

[OAuth2 providers](../../add-secure-apps/providers/oauth2/index.mdx#oauth-20-flows-and-grant-types) now have a **Grant Types** setting that lets admins explicitly choose which grant types a given provider may use. The available options are Authorization Code, Implicit, Hybrid, Refresh token, Client credentials, Password, and Device-code. Existing providers default to having all grant types enabled to preserve current behavior, but you can now disable any grant types you don't want a particular client to use — useful for tightening security on individual integrations and disabling legacy flows like Implicit or Password where they aren't needed.

### Improved UI and accessibility

Accessibility and user experience improvements have been made across the admin interface.

#### Form accessibility

Form labels have been updated to be more descriptive for screen readers, and now informing you of the full action that will be executed when the button is pressed. This change is being rolled out across the entire admin interface, starting with the most commonly used buttons and forms. These changes have all been reflected in the docs as well, helping to make authentik more accessible for all users.

#### Modal accessibility

In addition to general improvements to form accessibility, many of our modals now use the browser native `<dialog>` element, fixing several issues which prevented screen readers from properly traversing modal content. We'll be phasing out the remaining non-`<dialog>` modals over the next few releases to ensure a more consistent and accessible experience across the entire admin interface.

#### Wizard improvements

Wizards throughout authentik have been reworked to have fewer steps and cover of the most common use cases.

The invitation wizard in particular now makes it easy for administrators to send invites to new users. It guides admins through the process of configuring an invite system and sending the invites to users.

Service accounts are now created through the new user creation wizard, which has been reworked to be more intuitive and faster to use.

#### Mobile and tablet improvements

While authentik's admin interface is primarily designed for desktop use, we've made several improvements to make it more usable on mobile and tablet devices for those times when you need to make a quick change on the go.

#### Login improvements

The login flow has additional UI improvements to reduce friction and make it easier to use, including:

- An improved "Remember me" option that autofocuses the most appropriate input field based the presence of a username or password field.
- Better error handling and messaging for failed login attempts, including more specific error messages for WebAuthn when authentication fails.
- Additional mobile optimizations, such as better keyboard handling, field focus, and responsive design improvements to make the login flow easier to use on mobile and tablet devices.

### Small general improvements

**SAML provider issuer**: authentik now automatically generates your SAML issuer URL. You can still override the default SAML issuer.

**SAML provider unified endpoints**: Instead of an individual endpoint for login and logout for redirect and post, there is now a single SAML endpoint that handles login and logout for both request methods.

**Application Dashboard**: The **My applications** page has been renamed to **Application Dashboard**, and related option labels have been updated to match. Our documentation and integration guides have been updated as well. You can now also [hide applications](../../add-secure-apps/applications/manage_apps.mdx#hide-applications) from the **Application Dashboard** page using the new **Hide from Application Dashboard** toggle.

Before authentik 2026.5, an application was hidden by setting its **Launch URL** to `blank://blank`. Existing applications using that value are automatically migrated to using the **Hide from Application Dashboard** option upon upgrading.

**Dependencies**: We've removed 17 packages from authentik. Fewer dependencies mean less code to maintain and keep patched, and a smaller attack surface overall.

### Performance improvements

The authentik worker now starts through a Rust entrypoint. Python still runs authentik's worker code, but the Rust process owns worker startup, health checks, metrics, and worker-status reporting. This removes an idle top-level Python process and has led to an approximately 200 MB drop in memory usage for a single worker container. If you're a developer, check the updated [Developer Docs](../../developer-docs/setup/full-dev-environment.mdx) to install Rust.

The worker status reporting change also uses one fewer PostgreSQL connection per worker, which should put less load on the database.

The Admin interface is also less resource-intensive in the browser due to lazy-loaded modals.

### New out-of-the-box experience

When setting up authentik for the first time, you will now automatically be redirected to the [initial-setup flow](../../install-config/first-steps/index.mdx) instead of having to manually go there to complete your authentik installation.

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added. A big thanks to our contributors!

- [Absorb LMS](https://integrations.goauthentik.io/learning/absorb-lms) (Thanks to @dewi-tik!)
- [Anthropic](https://integrations.goauthentik.io/platforms/anthropic/) (Thanks to @dominic-r!)
- [Anthropic Workload Identity Federation](https://integrations.goauthentik.io/platforms/anthropic-workload-identity-federation/) (Thanks to @dominic-r!)
- [Forgejo](https://integrations.goauthentik.io/development/forgejo/) (Thanks to @djagoo!)
- [grommunio](https://integrations.goauthentik.io/chat-communication-collaboration/grommunio/) (Thanks to @snxRCS!)
- [Okta](https://docs.goauthentik.io/users-sources/sources/social-logins/okta/) (Thanks to @dewi-tik!)
- [OneUptime](https://integrations.goauthentik.io/monitoring/oneuptime/) (Thanks to @M-Slanec!)
- [PhotoPrism](https://integrations.goauthentik.io/media/photoprism/) (Thanks to @dominic-r!)
- [PostHog](https://integrations.goauthentik.io/monitoring/posthog/) (Thanks to @dominic-r!)
- [RabbitMQ](https://integrations.goauthentik.io/infrastructure/rabbitmq/) (Thanks to @djooberlee!)
- [Splunk Enterprise](https://integrations.goauthentik.io/monitoring/splunk-enterprise/) (Thanks to @jhuesser!)
- [Technitium DNS](https://integrations.goauthentik.io/networking/technitium/) (Thanks to @scinca!)

### Integration guide updates

- The GitHub Enterprise integration docs were revamped and split into dedicated guides for [GitHub Enterprise Cloud](https://integrations.goauthentik.io/development/ghec/), [GitHub Enterprise Managed Users](https://integrations.goauthentik.io/development/ghec-emu/), and [GitHub Enterprise Server](https://integrations.goauthentik.io/development/ghes/), making it easier to pick the right SAML and SCIM setup path. (Thanks to @dominic-r!)
- Integration guides that configure application-side roles and permissions now use [authentik Application Entitlements](../../add-secure-apps/applications/manage_apps.mdx#application-entitlements), giving admins a more consistent pattern for mapping access. (Thanks to @dominic-r!)
- The Jellyseerr integration guide was updated for the project's move to [Seerr](https://integrations.goauthentik.io/media/seerr/). (Thanks to @BreizhHardware!)
- The [Home Assistant](https://integrations.goauthentik.io/miscellaneous/home-assistant/) guide now covers both supported community OIDC integrations, `christiaangoossens/hass-oidc-auth` and `cavefire/hass-openid`, with UI and YAML setup options. (Thanks to @christiaangoossens!)
- The [NetBird](https://integrations.goauthentik.io/networking/netbird/) guide was refreshed to match NetBird's current authentik provider setup, with separate paths for adding authentik as an external identity provider or fully replacing NetBird's embedded IdP. (Thanks to @dominic-r!)

## Upgrading

This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

Upgrades MUST be performed sequentially by major version. If you are two or more major releases behind, you must first upgrade to each intermediate major release before upgrading to this one. Refer to our [Upgrade documentation](../../install-config/upgrade.mdx) for more information on upgrade sequence.

The version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O compose.yml https://goauthentik.io/version/2026.5/lifecycle/container/compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2026.5
```

## Minor changes/fixes

- admin/files: allow configuring S3 signature version (#20639)
- admin/files: sign custom-domain S3 URLs for the final host (#21704)
- api: cleanup enums (#21201)
- api: make ordering null-aware (#22099)
- api: set authenticated session user agent nullable properties (#22059)
- blueprints: fix mismatched API schema and implementation (cherry-pick #22087 to version-2026.5) (#22171)
- blueprints: rework one-time import (#18074)
- core, web: update translations (#22129)
- core, web: Vendored client follow-ups (#21174)
- core: add cooldown to dependabot (#21286)
- core: add flag for future default behavior of requiring a binding to access an application (#16247)
- core: add logging when session decode fails (#21514)
- core: add support for hiding applications from the user dashboard (#21530)
- core: allow interfaces to specify alternative stylesheets (#20774)
- core: Application stats, device events & cleanup (#21225)
- core: Apply CSpell corrections. (#20191)
- core: complete rework to oobe and setup experience (#21753)
- core: redirect service accounts away from main UI like external users (#20900)
- core: refresh signed media URLs in flows (#21553)
- core: remove filter_not_expired for QS (#18274)
- core: simplify boolean (#21790)
- core: support hashed password in users API + automated install (#18686)
- core: survive the empty-queryset race in chunked_queryset (#21666)
- core: uncomment failFast in cspell config file (#21116)
- core: users/groups reduce number of database queries (#20431)
- core/applications: Optimize list applications when only_with_launch_url=true (#20428)
- crypto: improve discovery for mounted k8s TLS Secrets (#17636)
- docs,ci: fix main daily compose downloads + release template (#21448)
- docs: Improve docs on webauthn authenticator attachment (#22045)
- endpoints: remove `print` line (cherry-pick #22325 to version-2026.5) (#22327)
- endpoints/connectors/agent: cleanup leftover (#20808)
- enterprise: account lockdown (#18615)
- enterprise: fix account lockdown target handling (cherry-pick #22246 to version-2026.5) (#22252)
- enterprise/endpoints/connectors: add google_chrome (#19129)
- enterprise/endpoints/connectors: Fleet conditional access stage (#20978)
- enterprise/endpoints/connectors/agent: add independent secure enclave support for tap to login (#20766)
- enterprise/lifecycle: remove one review per object limitation (#21046)
- enterprise/providers/scim: add support for interactive OAuth2 (cherry-pick #22072 to version-2026.5) (#22337)
- enterprise/providers/ssf: more conformance fixes (#21521)
- enterprise/providers/ssf: test conformance (#21383)
- enterprise/search: move QL to open source (#21484)
- enterprise/stages/mtls: attempt fix freezegun (cherry-pick #22474 to version-2026.5) (#22501)
- enterprise/stages/mtls: fix traefik cert encoding (#20483)
- enterprise/stages/mtls: freeze time for expired certs (cherry-pick #22411 to version-2026.5) (#22415)
- events: add helper to log deprecation configuration_warning message (#21115)
- events: add index on Event.user.pk (#19576)
- events: add option to configure webhook CA (#20823)
- events: don't log cacheentry events (#21597)
- events: fix exception in volume endpoint, adjust simple table size (#21230)
- Fix redirect URI in Seafile integration documentation (#20532)
- flows: add warning message for expired password reset links (#21395)
- flows: preserve signed background URLs in CSS (#21868)
- flows: remove link to overview for non-internal user (cherry-pick #22362 to version-2026.5) (#22371)
- internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-2026.5 (#22290)
- internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-2026.5 (#22291)
- internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-2026.5 (#22292)
- internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-2026.5 (#22293)
- internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-2026.5 (#22294)
- internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-2026.5 (#22295)
- internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-2026.5 (#22296)
- internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-2026.5 (#22297)
- internal: remove unix sockets on shutdown (#21081)
- internal/outpost: serialize websocket writes to prevent panic (#21728)
- internal/outpost/ak: fix ws URL on outpost restart (#21041)
- internal/web: remove authentication for metrics (#21077)
- lib/config: explicit some defaults (#21079)
- lib/config: support printing multiple values (#21080)
- lifecycle: disable gunicorn control socket (#21408)
- lifecycle/ak: Add manage support (cherry-pick #22176 to version-2026.5) (#22221)
- lifecycle/container: allow cross-compilation from arm64 to amd64 (#21817)
- lifecycle/container: fix OCI image labels (#21574)
- lifecycle/container: fix rust builds and pin toolchain version (#20300)
- lifecycle/container: only mount required packages directories (#21859)
- lifecycle/worker_process: fix healthchecks and metrics not reloading db connections after a failure (#21992)
- locale: fix de_DE locale placeholder (#22130)
- outposts: Create separate metrics service in Kubernetes (#21229)
- outposts: fix stale version in OutpostState (cherry-pick #22487 to version-2026.5) (#22505)
- outposts/controllers/k8s: add option to disable strict x509 checks (#21210)
- packages: use openapi-generator-ignore instead of deleting extra files (#21209)
- packages/ak-axum: init (#21313)
- packages/ak-axum/accept/catch_panic: add acceptor to catch panics in lower acceptors, streams and services (#21860)
- packages/ak-axum/accept/proxy_protocol: init (#21319)
- packages/ak-axum/accept/tls: init (#21318)
- packages/ak-axum/error: init (#21315)
- packages/ak-axum/extract/client_ip: init (#21321)
- packages/ak-axum/extract/host: init (#21323)
- packages/ak-axum/extract/scheme: init (#21322)
- packages/ak-axum/extract/trusted_proxy: init (#21320)
- packages/ak-axum/router: add X-Powered-By to all responses (#21940)
- packages/ak-axum/server: cleanup unix socket (#21477)
- packages/ak-axum/server: fix unix socket cleanup when allow_failure is unset (#21645)
- packages/ak-axum/server: init (#21317)
- packages/ak-axum/tracing: init (#21316)
- packages/ak-common, ak-axum: improve logging (#21476)
- packages/ak-common: rename from ak-lib (#21314)
- packages/ak-common: use imports where possible (#21478)
- packages/ak-common/arbiter: init (#21253)
- packages/ak-common/config: add set helper for tests (#21356)
- packages/ak-common/config: fix boolean parsing from env variable (#21835)
- packages/ak-common/config: fix string load broken after previous fix (#21854)
- packages/ak-common/config: init (#21256)
- packages/ak-common/db: init (#21357)
- packages/ak-common/mode: init (#21259)
- packages/ak-common/tls: init (#21262)
- packages/ak-common/tokio/proxy_protocol: init (#21311)
- packages/ak-common/tracing: get sentry config from API for outposts (#21625)
- packages/ak-common/tracing: init (#21263)
- packages/ak-common/tracing: make log level lowercase (#21991)
- packages/ak-lib: init (#21257)
- packages/client-go: init (#21139)
- packages/client-rust: fix portable sed usage (#21337)
- packages/client-rust: init (#21117)
- packages/client-ts: Fix TypeScript config, ESBuild warnings (#21863)
- packages/client-ts: init (#21120)
- packages/clients: only generate needed endpoints (#21578)
- packages/django-dramatiq-postgres: add index for (queue_name, state, eta) (#21175)
- packages/django-dramatiq-postgres: fix default value for HTTPServerThread (#21216)
- packages/django-postgres-cache: fix expiry and delete (#21307)
- packages/django-postgres-cache: rework to use ORM (#17771)
- packages/docusaurus-config: update config for docusaurus 3.10 (#21471)
- policies: remove BufferedPolicyAccessView (#20521)
- policies: remove BufferedPolicyAccessView leftovers (#21057)
- policies/event_matcher: Add query option to filter events (#21618)
- providers/oauth: make rp init logout oidc certification changes (#21815)
- providers/oauth: post_logout_redirect_uri support (#20011)
- providers/oauth2: Configure allowed grant types (#20363)
- providers/oauth2: evaluate property mappings in client credentials JWT flow (#20979)
- providers/oauth2: override RedirectURITypeEnum capitalization for generated API (#22037)
- providers/oauth2: require client_secret on device_code exchange for confidential clients (#21700)
- providers/proxy: fix oidc client not using socket in embedded outpost (#21280)
- providers/rac: add e2e tests (#21390)
- providers/saml: Add sls to saml overview (cherry-pick #22183 to version-2026.5) (#22368)
- providers/saml: generate issuer url when provider is set on app (#18022)
- providers/saml: handle XML declarations in unified endpoint (cherry-pick #22455 to version-2026.5) (#22539)
- providers/saml: make issuer url metadata url (cherry-pick #22178 to version-2026.5) (#22184)
- providers/saml: make unified saml endpoint (cherry-pick #20026 to version-2026.5) (#22187)
- providers/saml: Properly import audience from metadata. (cherry-pick #22181 to version-2026.5) (#22449)
- providers/saml: send logoutResponse on sp-init logout (#17691)
- providers/SCIM: Add discover support (#20658)
- providers/scim: add webex compatibility mode (#21208)
- providers/scim: ak_groups -> groups in tests (#20580)
- providers/scim: fix vCenter compatibility mode (#21830)
- providers/scim: use modified GroupMember class to support extra attributes on it (#20827)
- release: 2026.5.0-rc1
- release: 2026.5.0-rc2
- revert: web: Consistent use of "User Dashboard" (#22038) (#22046)
- root: add git attributes for generated/vendored (#21177)
- root: add more logging to worker requests (#21989)
- root: allow listening on multiple IPs (#20930)
- root: cleanup API generation (#21172)
- root: configure dependabot for cargo (#21118)
- root: configure freezegun to exclude cryptography (cherry-pick #22442 to version-2026.5) (#22448)
- root: ensure uv sync does not update uv.lock (#22084)
- root: fix `gen-changelog` and `gen-diff` (#20598)
- root: fix dependabot config for docker (#20380)
- root: fix gitignore binary paths (cherry-pick #22445 to version-2026.5) (#22485)
- root: fix log function to redirect output to stderr (#20858)
- root: fix rust build with uv-installed Python (#21858)
- root: fix rust setup (#21078)
- root: fix rustfmt config (#21312)
- root: fix scripts compose & gen-diff (#21389)
- root: fix test runner dropping exit code (#20630)
- root: include relative time for each test case in logs (#21445)
- root: init rust worker (#21324)
- root: init rust workspace (#20983)
- root: introduce allinone mode (#21990)
- root: makefile: remove spellcheck from lint-fix (#20924)
- root: misc API client and web typing fixes (#21388)
- root: only allow listen failure in dev (#21987)
- root: optimize api client generation speed (#21141)
- root: refreshed icon (cherry-pick #22265 to version-2026.5) (#22266)
- root: remove unused `django-cte` (#20090)
- root: run `npm i` with `npm@11.10.1` in all subdirectories (#20471)
- root: update rustls-webpki (#21769)
- root/channels: use group_send_blocking where possible (#21993)
- scripts/api_filter_schema: fix authentication (#21644)
- security: CVE-2026-25227 (#20239)
- security: CVE-2026-25748 (#20240)
- security: CVE-2026-25922 (#20241)
- source/saml: Add forceauthn to saml authnrequest (#20883)
- sources/ldap: Better Active Directory tests (#21281)
- sources/ldap: catch Google LDAP rate-limit errors during schema fetch (#21638)
- sources/ldap: Switch to new connection tracking, deprecated attribute-based connection (#21392)
- sources/oauth: correctly check requests' exception response (#21386)
- sources/oauth: ensure user ID is returned as str (#21880)
- sources/oauth: pick a single pkce method from OIDC discovery, not the whole list (#21689)
- sources/saml: improve exception handling for saml response parsing (#20125)
- stage/authenticator\*: expand attempt throttling to email- and sms-based 2FA (#21751)
- stage/invitation: Send invite via email UI (#19823)
- stages/authenticator_webauthn: Add WebAuthn client hints support (#20700)
- stages/authenticator_webauthn: save attestation certificate when creating credential (#20095)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#20305)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#20642)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#20905)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#21290)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#21612)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#21999)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#22128)
- stages/authenticator_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (cherry-pick #22322 to version-2026.5) (#22323)
- stages/invitation: Invitation wizard (#20399)
- stages/user_write: refuse to write id/pk claims onto the user model (#21667)
- tasks: better error message for Retry exceptions (#18235)
- tasks: fix the occasional DatabaseError for no updated fields (#20629)
- tasks: fix workers API URL missing trailing / (#20954)
- tasks: improved tests (#18978)
- tasks: threads instead of forks (#19476)
- tenants: add option to mark flag as deprecated (#22063)
- tenants: fix default schema in initial migration (#21114)
- tenants: fix system flags removeable (cherry-pick #22163 to version-2026.5) (#22182)
- tests: add mixin to launch traefik for tests requiring SSL (#22011)
- tests: refactor test harness to split apart a single file (#21391)
- translate: Updates for project authentik and language bg_BG (#22112)
- translate: Updates for project authentik and language cs_CZ (#22115)
- translate: Updates for project authentik and language de_DE (#21825)
- translate: Updates for project authentik and language de_DE (#22113)
- translate: Updates for project authentik and language es_ES (#22116)
- translate: Updates for project authentik and language fi_FI (#22114)
- translate: Updates for project authentik and language fr_FR (#21056)
- translate: Updates for project authentik and language fr_FR (#21214)
- translate: Updates for project authentik and language fr_FR (#21285)
- translate: Updates for project authentik and language fr_FR (#21378)
- translate: Updates for project authentik and language fr_FR (#21474)
- translate: Updates for project authentik and language fr_FR (#22008)
- translate: Updates for project authentik and language fr_FR (#22015)
- translate: Updates for project authentik and language fr_FR (#22117)
- translate: Updates for project authentik and language it_IT (#22123)
- translate: Updates for project authentik and language ja_JP (#22118)
- translate: Updates for project authentik and language no_NO (#21862)
- translate: Updates for project authentik and language no_NO (#22120)
- translate: Updates for project authentik and language pl_PL (#22124)
- translate: Updates for project authentik and language pt_BR (#22111)
- translate: Updates for project authentik and language pt_PT (#22122)
- translate: Updates for project authentik and language ru_RU (#22119)
- translate: Updates for project authentik and language tr_TR (#22125)
- translate: Updates for project authentik and language zh-Hans (#22121)
- web, website: Update name to application dashboard (cherry-pick #22190 to version-2026.5) (#22374)
- web: Apply CSpell corrections. (#20190)
- web: build system had some legacy stuff that I found confusing while working on the CSS ordering (#20698)
- web: Clear remember me before navigation. (#21647)
- web: Close modal on route navigation (#21622)
- web: CodeSpell -> CSpell migration (#20188)
- web: Consistent use of "User Dashboard" (#22038)
- web: fix a few visual nits reported after the latest release (#22012)
- web: Fix admin table horizontal scrolling (#20960)
- web: Fix element property names with custom attributes. (#20396)
- web: fix identification stage OUIA attributes (#22049)
- web: Fix issue where default user path is not preferred. (cherry-pick #22139 to version-2026.5) (#22364)
- web: Fix table visibility checks, search params. (#21623)
- web: Fix Vendored Lex package. Add Unit Tests (#22083)
- web: Gracefully handle missing element construction. (#21787)
- web: link file picker to docs (#20995)
- web: lint/small type errors (#21179)
- web: merge MFA devices and tokens into unified Credentials tab (#21705)
- web: Normalize use of `.toJSON()` over `.json()` (#21621)
- web: Packagify Logger (#20541)
- web: Radio and Checkbox Input Revisions (#21792)
- web: remove native fieldset borders from action groups (#21334)
- web: rename SCIM provider "User filtering" section to "Filtering" (#20879)
- web: revert `tree-sitter` removal from lockfile (#20377)
- web: Supply our font and color choices to rapidoc. (#20775)
- web: User Wizard, Modal Revisions Merge Branch (#21336)
- web/a11y: Modal revisions, component name normalization (#21205)
- web/a11y: Modals, Command Palette (Merge branch) (#17812)
- web/admin: add outposts view page (#21167)
- web/admin: Allow binding users/groups in policy binding wizard and existing stage in stage binding wizard (#21697)
- web/admin: Cleanup spacing in and around cards (#21199)
- web/admin: fix log viewer layout for application access check (#21594)
- web/admin: fix missing icon on app view page (#21251)
- web/admin: fix policy/stage wizard label, fix connector create wizard, cleanup (#21781)
- web/admin: fix user list avatar (#21531)
- web/admin: fix user wizard close button (cherry-pick #22222 to version-2026.5) (#22243)
- web/admin: Improve WS-Fed algo selection logic (#20881)
- web/admin: include avatar in user list page (#21518)
- web/admin: legacy modal fixes and fix log viewer in form layout (cherry-pick #22168 to version-2026.5) (#22173)
- web/admin: maintenance: centralize types that are used across stages (#20398)
- web/admin: maintenance: give dialogs default exports (#20397)
- web/admin: more and more polish (#21303)
- web/admin: polish recent events, various button alignments and labels (#21232)
- web/admin: redirect stage: adds mention of static url (#22060)
- web/admin: remove side-padding on user paths (#22088)
- web/admin: show app events on app page (#21203)
- web/admin: use bindings form for app entitlements (#22007)
- web/admin: User wizard label adjust and deactivate navigation when wizard is finished (cherry-pick #22133 to version-2026.5) (#22191)
- web/e2e: accept options in NavigatorFixture.waitForPathname (#21507)
- web/elements: Add preserve-order, no-search and no-status attributes to ak-dual-select (#20749)
- web/elements: add scrollbar helpers and apply to Interface (#21511)
- web/elements: Add static table class (#21181)
- web/elements: add viewport helpers and extend intersection observer (#21508)
- web/elements: allow table per-column options (#21250)
- web/elements: default @listen target to host element and add split-button Dropdown (#21512)
- web/flow: bug: inspector button not hiding when unavailable (#20717)
- web/flow: extract lifecycle events peripheral to stage management into their own controllers (#20898)
- web/flow: fix typo in RedirectStage (#20488)
- web/flow: generate a single API object for network transactions and use it for the lifetime of the FlowExecutor (#20030)
- web/flow: provide labels for the stage import-and-invoke table (#20834)
- web/flow: provide layout url as needed (#20991)
- web/flow: refactor flow executor so component selection is in an easy-to-maintain table (#19999)
- web/flow: separate flow inspector lifecycle from flow executor lifecycle (#20063)
- web/flow: separate out independent behavior tracks from IdentificationStage (autoredirect, webauthn, captcha, remember me) (#20578)
- web/flow: Tidy identification stage (#20261)
- web/flow/stages: permit the form handler to look in the light or shadowDOM for controls (#20832)
- web/flows: fix continuous flow leftovers (#21158)
- web/flows: Fix username autofocus. (#21646)
- web/flows: update flow background (#22032)
- web/maintenance: no unknown attributes part 2 (#19014)
- web/rac: Ignore empty remote clipboard payloads (#22067)
- Web/release202604/nits 2 (#22040)
- web/stages: better wording for webauthn authenticator attachments options (#22062)
- web/style/flow: flow css barrel file (#20833)
- web/styles: add ak-c-loading-skeleton CSS component (#21510)
- web/styles: switch to upstream RedHat variable fonts and brighten orange palette (#21509)
- web/table: fetch on first render when already visible (cherry-pick #22376 to version-2026.5) (#22438)

## Fixed in 2026.5.1

This release has been skipped.

## Fixed in 2026.5.2

- endpoints/connectors/agent: allow federated auth via ssh hostkey lookup (cherry-pick #22594 to version-2026.5) (#22597)
- enterprise/providers/scim: fix last_updated for OAuth interactive (cherry-pick #22678 to version-2026.5) (#22700)
- events: fix Event.log_deprecation not checking that cause is a string (cherry-pick #22598 to version-2026.5) (#22683)
- packages/ak-common/db: fix certificates options not allowing file paths (cherry-pick #22680 to version-2026.5) (#22685)
- packages/ak-common/db: fix conn_max_age causing spinning (cherry-pick #22679 to version-2026.5) (#22686)
- providers/oauth2: fix session decode when upgrading from 2026.2 (cherry-pick #22684 to version-2026.5) (#22692)
- security: CVE-2026-47201
- security: GHSA-wr38-7xg8-fqxr
- security: GHSA-xp7f-xjjx-gwm8

## Fixed in 2026.5.3

- blueprints: handle integrity exception when applying blueprints (cherry-pick #22599 to version-2026.5) (#22927)
- core: bump django from 5.2.14 to v5.2.15 (cherry-pick #22956 to version-2026.5) (#22962)
- endpoints/connectors/agent: fix exception with invalid auth type (cherry-pick #22943 to version-2026.5) (#22951)
- enterprise/providers/scim: fix interactive OAuth overriding refresh_token (cherry-pick #22858 to version-2026.5) (#22861)
- providers/oauth: skip post logout redirect matching if none are saved on the provider (cherry-pick #22718 to version-2026.5) (#22955)
- providers/radius: fix panic in log due to type (cherry-pick #22965 to version-2026.5) (#22967)
- tests/e2e: fix proxy tests failing due to in-use port (cherry-pick #22785 to version-2026.5) (#22792)
- web/admin: fix Docker outpost integration form CA Cert filter (cherry-pick #22863 to version-2026.5) (#22895)
- web/polyfill: polyfill customElements.getName for Safari < 17.4 (cherry-pick #22940 to version-2026.5) (#22963)

## Fixed in 2026.5.4

- brands: select_related models accessed in the hot path (cherry-pick #23162 to version-2026.5) (#23524)
- core: bump goauthentik/fips-debian and fips-python in /lifecycle/container (cherry-pick #23362 to version-2026.5) (#23384)
- core: bump pydantic from 2.13.3 to 2.13.4 (cherry-pick #22207 to version-2026.5) (#23570)
- core: fix Invitation Emails Ignoring Selected Template (cherry-pick #23122 to version-2026.5) (#23133)
- core: handle missing tenant in setup migration (cherry-pick #23034 to version-2026.5) (#23762)
- core: preserve encoded avatar URLs (cherry-pick #23225 to version-2026.5) (#23394)
- docs: Americanize and minor fixes (cherry-pick #22600 to version-2026.5) (#22604)
- packages/ak-common/config: coerce file:// and env:// values to their native type (cherry-pick #23758 to version-2026.5) (#23759)
- packages/django-dramatiq-postgres/broker: fix race condition in broker causing completed tasks to be repeated (cherry-pick #23218 to version-2026.5) (#23257)
- packages/django-dramatiq-postgres/broker: purge at start of loop to ensure it runs (cherry-pick #23185 to version-2026.5) (#23188)
- packages/django-postgres-cache: avoid regex queries when listing keys if possible (cherry-pick #23160 to version-2026.5) (#23423)
- packages/django-postgres-cache: fix naive datetime warning (cherry-pick #23033 to version-2026.5) (#23235)
- packages/django-postgres-cache: remove custom get_or_set implementation (cherry-pick #23182 to version-2026.5) (#23213)
- policies: skip cache invalidation on User last_login update (cherry-pick #23159 to version-2026.5) (#23421)
- providers/\*: fix missing declaration for can_discover for outgoing sync providers (cherry-pick #23035 to version-2026.5) (#23233)
- providers/ldap: remove incorrect validation for code authenticator extraction (cherry-pick #23006 to version-2026.5) (#23767)
- providers/oauth: Properly return error via post and for request objects (cherry-pick #23037 to version-2026.5) (#23529)
- providers/scim: account for users with no email during discovery (cherry-pick #23417 to version-2026.5) (#23485)
- providers/scim: allow failures during discovery (cherry-pick #23357 to version-2026.5) (#23365)
- root: Fix SECURITY.md versions (cherry-pick #23370 to version-2026.5) (#23372)
- root: bump pyo3 (cherry-pick #23036 to version-2026.5) (#23038)
- root: update crossbeam-epoch (cherry-pick #23794 to version-2026.5) (#23795)
- sources/ldap: avoid re-creating connections to LDAP server (cherry-pick #23520 to version-2026.5) (#23525)
- sources/ldap: optimize the connection endpoints (cherry-pick #23761 to version-2026.5) (#23765)
- stages/authenticator_webauthn: disable prevent_duplicate_devices by default (cherry-pick #23823 to version-2026.5) (#23826)
- tasks/schedules: fix paused schedules getting unpaused on startup (cherry-pick #23521 to version-2026.5) (#23527)
- tasks: add pre_delete for TasksModel to avoid OOM when deleting object with many tasks linked (cherry-pick #23664 to version-2026.5) (#23666)
- tasks: avoid useless query on monitoring_set (cherry-pick #23161 to version-2026.5) (#23424)
- web, core: Fix server-side message race condition, type mismatch. (cherry-pick #23151 to version-2026.5) (#23584)
- web/admin: fix spacing issues in wizard (cherry-pick #23484 to version-2026.5) (#23488)
- web/i18n: Fix stale flow locale, unsynchronized locale selector options (cherry-pick #23007 to version-2026.5) (#23148)
- web/stages/identification: Fix passkey autofill dropdown not showing on the identification stage (cherry-pick #23187 to version-2026.5) (#23189)
- web: Fix outline selector, lack of outline on focused checkboxes. (cherry-pick #23260 to version-2026.5) (#23825)
- web: Fix stale clipboard tokens, untranslated labels (cherry-pick #23063 to version-2026.5) (#23143)
- web: Fix user list default paths. (cherry-pick #23062 to version-2026.5) (#23127)
- web: Invitation Wizard Clean Up, Form Validation Fixes (cherry-pick #23316 to version-2026.5) (#23811)
- website: migrate brand assets to pkg (cherry-pick #22336 to version-2026.5) (#23222)

## Fixed in 2026.5.5

- api/search: add number and boolean support in AKQL queries on JSON fields (#23418) (cherry-pick #24028 to version-2026.5) (#24033)
- endpoints: handle exception in connector controller sync setup (cherry-pick #23852 to version-2026.5) (#23854)
- lib/sync/outgoing: fix discover running for each page (cherry-pick #24016 to version-2026.5) (#24019)
- packages/django-dramatiq-postgres/broker: close unusable PostgreSQL connections (cherry-pick #24023 to version-2026.5) (#24035)
- providers/scim: improve error display when error doesn't conform to scim schema (cherry-pick #23955 to version-2026.5) (#23957)
- security: automated internal backport of patch 1817.sec.patch to authentik-2026.5 (#24058)
- security: automated internal backport of patch 1822.sec.patch to authentik-2026.5 (#24059)
- security: automated internal backport of patch 1887.sec.patch to authentik-2026.5 (#24060)
- security: automated internal backport of patch 1919.sec.patch to authentik-2026.5 (#24061)
- security: automated internal backport of patch 1934.sec.patch to authentik-2026.5 (#24062)
- sources/oauth: improve id_token validation for apple source (cherry-pick #24017 to version-2026.5) (#24020)
- stages/email: fix ungrammatical expiry time in password reset templates (cherry-pick #22758 to version-2026.5) (#23952)
- tests/openid_conformance: migrate to upstream images (cherry-pick #23828 to version-2026.5) (#23834)
- web/admin: licensing: add usage totals (cherry-pick #23665 to version-2026.5) (#23668)
- web: Fix Log Viewer Intersection Observer. (cherry-pick #23861 to version-2026.5) (#23949)
- web: fix table refresh button not refreshing table data (cherry-pick #23780 to version-2026.5) (#23878)
- web/flows: fix race condition in continuous login and support source stages in authentication flows (cherry-pick #23049 to version-2026.5) (#23558)

## Fixed in 2026.5.6

- core: Form friendly error on uniqueness constraint. (cherry-pick #23864 to version-2026.5) (#23881)
- endpoints/connectors/agent: fix auth schema for device endpoints (cherry-pick #24164 to version-2026.5) (#24167)
- enterprise/endpoints/connectors/fleet: pass populate_policies (cherry-pick #24108 to version-2026.5) (#24112)
- internal/config: make storage file paths overwritable via env vars (cherry-pick #24177 to version-2026.5) (#24220)
- lifecycle/container: drop curl and runit (cherry-pick #24008 to version-2026.5) (#24114)
- packages/django-dramatiq-postgres/broker: use positive state filter for pending messages (cherry-pick #24074 to version-2026.5) (#24166)
- policies: filter policy engine (cherry-pick #24025 to version-2026.5) (#24168)
- providers/scim: exclude read-only id from group PATCH payload and fix null-members add check (cherry-pick #23950 to version-2026.5) (#24227)
- providers/scim: fix enum warning when de-serializing (cherry-pick #23553 to version-2026.5) (#24231)
- providers/scim: fix non-schema compliant group member removal (cherry-pick #23800 to version-2026.5) (#24229)
- root: fix make gen-changelog (cherry-pick #24122 to version-2026.5) (#24260)
- root: fix make gen-diff command (cherry-pick #22548 to version-2026.5) (#24121)
- root: in-process per-IP rate throttle (#23015) (#24217)
- stages/captcha: fix hcaptcha height (#20901) (#24216)
- web/admin: fix app view failing when no events permissions (cherry-pick #24131 to version-2026.5) (#24252)
- web/flow: revert locale-driven flow re-request from FlowExecutor (cherry-pick #24050 to version-2026.5) (#24068)

## Fixed in 2026.5.7

- blueprints: fix mismatched stage name in example 2fa login flow (cherry-pick #24668 to version-2026.5) (#24751)
- blueprints: handle invalid yaml, add dry run to apply_blueprint (cherry-pick #24813 to version-2026.5) (#24820)
- brands: fix schema for current brand's flags (cherry-pick #24376 to version-2026.5) (#24407)
- core: add user type-active-username index (cherry-pick #25223 to version-2026.5) (#25241)
- core: bump django from 5.2.15 to v5.2.16 (cherry-pick #24526 to version-2026.5) (#24532)
- core: bump django from 5.2.16 to v5.2.17 (cherry-pick #24793 to version-2026.5) (#24815)
- core: bump goauthentik/fips-debian from f18dbc4 to ed780d in /lifecycle/container (cherry-pick #25503 to version-2026.5) (#25508)
- core: bump goauthentik/fips-python from 3.14.6-slim-trixie-fips to 3.14.7-slim-trixie-fips in /lifecycle/container (cherry-pick #25049 to version-2026.5) (#25059)
- core: bump goauthentik/fips-python from 6abe1b to 3ebb7c in /lifecycle/container (cherry-pick #25504 to version-2026.5) (#25507)
- core: bump h2 from 0.4.15 to 0.4.16 (cherry-pick #25183 to version-2026.5) (#25185)
- core: bump library/golang from 1.26.2-trixie to 1.26.5-trixie in /lifecycle/container (#24414)
- core: fix group source connection source object (cherry-pick #24626 to version-2026.5) (#24674)
- core: return the intended status code from error views for all request methods (cherry-pick #24902 to version-2026.5) (#24957)
- core: set days=1 as default token duration for new installs (cherry-pick #25341 to version-2026.5) (#25386)
- crypto: don't dispatch discovery if one is queued (cherry-pick #25483 to version-2026.5) (#25511)
- endpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (cherry-pick #24587 to version-2026.5) (#24589)
- endpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (cherry-pick #24588 to version-2026.5) (#24592)
- endpoints/connectors/agent: fix auth schema correctly (cherry-pick #24327 to version-2026.5) (#24330)
- endpoints/connectors: fix integrity error when device with same name exists already (cherry-pick #25237 to version-2026.5) (#25339)
- endpoints: handle error in facts (cherry-pick #25028 to version-2026.5) (#25031)
- enterprise/endpoints/connectors/fleet: fix exception when host has no policies (cherry-pick #24355 to version-2026.5) (#24366)
- enterprise: increase cache duration and ensure summary is cached (cherry-pick #25187 to version-2026.5) (#25198)
- lib: avoid DNS resolution in fqdn_rand (cherry-pick #25728 to version-2026.5) (#25760)
- lib/expression: fix policy request context pollution (cherry-pick #25462 to version-2026.5) (#25466)
- lifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (cherry-pick #25883 to version-2026.5) (#25896)
- packages/django-dramatiq-postgres/broker: chunked purge queryset (cherry-pick #25102 to version-2026.5) (#25105)
- packages/django-dramatiq-postgres: minor fixes (cherry-pick #23181 to version-2026.5) (#24663)
- providers/oauth2: fix missing authorization event for oauth provider, add tests (cherry-pick #24819 to version-2026.5) (#24823)
- providers/radius: allow empty message authenticator (cherry-pick #25097 to version-2026.5) (#25196)
- providers/scim: fix display of SCIMRequestException (2026.8) (cherry-pick #24833 to version-2026.5) (#24954)
- providers/scim: fix scim changed detection for nested attributes (cherry-pick #24332 to version-2026.5) (#24442)
- providers/scim: ignore key casing in SCIM responses (cherry-pick #24441 to version-2026.5) (#24485)
- rbac: use constant-time comparison in SecretKeyFilter (cherry-pick #24888 to version-2026.5) (#24947)
- root: don't include debug info for rust release profile (cherry-pick #24664 to version-2026.5) (#24670)
- security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.5 (#25960)
- security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.5 (#25961)
- security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.5 (#25962)
- security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.5 (#25963)
- security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.5 (#25964)
- server/core: handle unsupported HTTP method (cherry-pick #22498 to version-2026.5) (#25364)
- stages/email: fix test_email ignoring the given stage (cherry-pick #25166 to version-2026.5) (#25189)
- stages/identification: dynamic captcha keys when stage embedded in identification stage (cherry-pick #24079 to version-2026.5) (#25500)
- tenants/settings: fix `flags` response (cherry-pick #25616 to version-2026.5) (#25829)
- web/admin: drop misleading delete consequences from user activation review (cherry-pick #24273 to version-2026.5) (#24786)
- web/admin: fix schedule form (cherry-pick #25778 to version-2026.5) (#25831)
- web: bump dompurify from 3.4.12 to 3.4.13 in /web (cherry-pick #24892 to version-2026.5) (#25001)
- web/elements/table: show scrollbar instead of overflowing off the page (cherry-pick #25232 to version-2026.5) (#25392)
- web/flows: fix missing required flag on password input (cherry-pick #24831 to version-2026.5) (#24836)
- web: preserve custom event action labels (cherry-pick #25655 to version-2026.5) (#25834)
- worker: fix healthcheck paths (cherry-pick #24481 to version-2026.5) (#25677)

## API Changes

### authentik (v 2026.5.0)

---

#### What's New

---

##### `POST` /core/users/&#123;id&#125;/set_password_hash/

##### `POST` /core/users/account_lockdown/

##### `GET` /endpoints/agents/psso/ise/

##### `POST` /endpoints/agents/psso/ise/

##### `GET` /endpoints/agents/psso/ise/&#123;uuid&#125;/

##### `PUT` /endpoints/agents/psso/ise/&#123;uuid&#125;/

##### `DELETE` /endpoints/agents/psso/ise/&#123;uuid&#125;/

##### `PATCH` /endpoints/agents/psso/ise/&#123;uuid&#125;/

##### `GET` /endpoints/agents/psso/ise/&#123;uuid&#125;/used_by/

##### `GET` /endpoints/google_chrome/connectors/

##### `POST` /endpoints/google_chrome/connectors/

##### `GET` /endpoints/google_chrome/connectors/&#123;connector_uuid&#125;/

##### `PUT` /endpoints/google_chrome/connectors/&#123;connector_uuid&#125;/

##### `DELETE` /endpoints/google_chrome/connectors/&#123;connector_uuid&#125;/

##### `PATCH` /endpoints/google_chrome/connectors/&#123;connector_uuid&#125;/

##### `GET` /endpoints/google_chrome/connectors/&#123;connector_uuid&#125;/used_by/

##### `GET` /events/events/stats/

##### `POST` /managed/blueprints/import/

##### `GET` /stages/account_lockdown/

##### `POST` /stages/account_lockdown/

##### `GET` /stages/account_lockdown/&#123;stage_uuid&#125;/

##### `PUT` /stages/account_lockdown/&#123;stage_uuid&#125;/

##### `DELETE` /stages/account_lockdown/&#123;stage_uuid&#125;/

##### `PATCH` /stages/account_lockdown/&#123;stage_uuid&#125;/

##### `GET` /stages/account_lockdown/&#123;stage_uuid&#125;/used_by/

##### `POST` /stages/invitation/invitations/&#123;invite_uuid&#125;/send_email/

##### `GET` /tasks/workers/

##### `DELETE` /ssf/streams/&#123;uuid&#125;/

#### What's Deleted

---

##### `POST` /flows/instances/import/

##### `GET` /tasks/workers

#### What's Changed

---

##### `GET` /admin/file/

###### Parameters:

Changed: `usage` in `query`

##### `DELETE` /admin/file/

###### Parameters:

Changed: `usage` in `query`

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `core_default_app_access`

        New optional properties:
        - `policies_buffered_access_view`
        * Added property `core_default_app_access` (boolean)

            > Configure if applications without any policy/group/user bindings should be accessible to any user.

        * Deleted property `policies_buffered_access_view` (boolean)

        * Changed property `enterprise_audit_include_expanded_diff` (boolean)

            > Include additional information in audit logs, may incur a performance penalty.

        * Changed property `flows_continuous_login` (boolean)

            > Upon successful authentication, re-start authentication in other open tabs.

        * Changed property `flows_refresh_others` (boolean)
            > Refresh other tabs after successful authentication.

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Changed property `flags` (object)

    New required properties:
    - `core_default_app_access`

    New optional properties:
    - `policies_buffered_access_view`
    * Added property `core_default_app_access` (boolean)

        > Configure if applications without any policy/group/user bindings should be accessible to any user.

    * Deleted property `policies_buffered_access_view` (boolean)

    * Changed property `enterprise_audit_include_expanded_diff` (boolean)

        > Include additional information in audit logs, may incur a performance penalty.

    * Changed property `flows_continuous_login` (boolean)

        > Upon successful authentication, re-start authentication in other open tabs.

    * Changed property `flows_refresh_others` (boolean)
        > Refresh other tabs after successful authentication.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `core_default_app_access`

        New optional properties:
        - `policies_buffered_access_view`
        * Added property `core_default_app_access` (boolean)

            > Configure if applications without any policy/group/user bindings should be accessible to any user.

        * Deleted property `policies_buffered_access_view` (boolean)

        * Changed property `enterprise_audit_include_expanded_diff` (boolean)

            > Include additional information in audit logs, may incur a performance penalty.

        * Changed property `flows_continuous_login` (boolean)

            > Upon successful authentication, re-start authentication in other open tabs.

        * Changed property `flows_refresh_others` (boolean)
            > Refresh other tabs after successful authentication.

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Changed property `flags` (object)

    New required properties:
    - `core_default_app_access`

    New optional properties:
    - `policies_buffered_access_view`
    * Added property `core_default_app_access` (boolean)

        > Configure if applications without any policy/group/user bindings should be accessible to any user.

    * Deleted property `policies_buffered_access_view` (boolean)

    * Changed property `enterprise_audit_include_expanded_diff` (boolean)

        > Include additional information in audit logs, may incur a performance penalty.

    * Changed property `flows_continuous_login` (boolean)

        > Upon successful authentication, re-start authentication in other open tabs.

    * Changed property `flows_refresh_others` (boolean)
        > Refresh other tabs after successful authentication.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flags` (object)

        New required properties:
        - `core_default_app_access`

        New optional properties:
        - `policies_buffered_access_view`
        * Added property `core_default_app_access` (boolean)

            > Configure if applications without any policy/group/user bindings should be accessible to any user.

        * Deleted property `policies_buffered_access_view` (boolean)

        * Changed property `enterprise_audit_include_expanded_diff` (boolean)

            > Include additional information in audit logs, may incur a performance penalty.

        * Changed property `flows_continuous_login` (boolean)

            > Upon successful authentication, re-start authentication in other open tabs.

        * Changed property `flows_refresh_others` (boolean)
            > Refresh other tabs after successful authentication.

##### `GET` /core/authenticated_sessions/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `user_agent` (object)

        > Get parsed user agent
        - Changed property `device` (object)

            > User agent device
            - Changed property `brand` (string)

            - Changed property `model` (string)

        - Changed property `os` (object)

            > User agent os
            - Changed property `major` (string)

            - Changed property `minor` (string)

            - Changed property `patch` (string)

            - Changed property `patch_minor` (string)

##### `GET` /core/brands/&#123;brand_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `flow_lockdown` (string)

##### `PUT` /core/brands/&#123;brand_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `flow_lockdown` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `flow_lockdown` (string)

##### `PATCH` /core/brands/&#123;brand_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `flow_lockdown` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `flow_lockdown` (string)

##### `POST` /events/events/export/

###### Parameters:

Added: `context_device` in `query`

> Context Device Primary Key

##### `GET` /lifecycle/iterations/latest/&#123;content_type&#125;/&#123;object_id&#125;/

###### Operation ID:

Changed: `lifecycle_iterations_latest_retrieve` to `lifecycle_iterations_list_latest`

###### Parameters:

Added: `ordering` in `query`

> Which field to use when ordering the results.

Added: `search` in `query`

> A search term.

Added: `user_is_reviewer` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

##### `GET` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `query` (string)

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.google_chrome`
        - `authentik.enterprise.stages.account_lockdown`
          Removed enum value:

        - `authentik.enterprise.search`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
        - `authentik_stages_account_lockdown.accountlockdownstage`

##### `PUT` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `query` (string)

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.enterprise.endpoints.connectors.google_chrome`
    - `authentik.enterprise.stages.account_lockdown`
      Removed enum value:

    - `authentik.enterprise.search`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
    - `authentik_stages_account_lockdown.accountlockdownstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `query` (string)

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.google_chrome`
        - `authentik.enterprise.stages.account_lockdown`
          Removed enum value:

        - `authentik.enterprise.search`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
        - `authentik_stages_account_lockdown.accountlockdownstage`

##### `PATCH` /policies/event_matcher/&#123;policy_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `query` (string)

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.enterprise.endpoints.connectors.google_chrome`
    - `authentik.enterprise.stages.account_lockdown`
      Removed enum value:

    - `authentik.enterprise.search`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
    - `authentik_stages_account_lockdown.accountlockdownstage`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `query` (string)

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.google_chrome`
        - `authentik.enterprise.stages.account_lockdown`
          Removed enum value:

        - `authentik.enterprise.search`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
        - `authentik_stages_account_lockdown.accountlockdownstage`

##### `GET` /providers/saml/&#123;id&#125;/metadata/

###### Parameters:

Changed: `force_binding` in `query`

##### `GET` /providers/wsfed/&#123;id&#125;/metadata/

###### Parameters:

Changed: `force_binding` in `query`

##### `GET` /core/applications/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `meta_hide` (boolean)
        > Hide this application from the user's My applications page.

##### `PUT` /core/applications/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `meta_hide` (boolean)
    > Hide this application from the user's My applications page.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `meta_hide` (boolean)
        > Hide this application from the user's My applications page.

##### `PATCH` /core/applications/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `meta_hide` (boolean)
    > Hide this application from the user's My applications page.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `meta_hide` (boolean)
        > Hide this application from the user's My applications page.

##### `GET` /core/authenticated_sessions/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatedSession Serializer
        - Changed property `user_agent` (object)

            > Get parsed user agent
            - Changed property `device` (object)

                > User agent device
                - Changed property `brand` (string)

                - Changed property `model` (string)

            - Changed property `os` (object)

                > User agent os
                - Changed property `major` (string)

                - Changed property `minor` (string)

                - Changed property `patch` (string)

                - Changed property `patch_minor` (string)

##### `POST` /core/brands/

###### Request:

Changed content type : `application/json`

- Added property `flow_lockdown` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `flow_lockdown` (string)

##### `GET` /core/brands/

###### Parameters:

Added: `flow_lockdown` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Brand Serializer
        - Added property `flow_lockdown` (string)

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `flow_lockdown` (string)

    - Changed property `flags` (object)

        New required properties:
        - `core_default_app_access`

        New optional properties:
        - `policies_buffered_access_view`
        * Added property `core_default_app_access` (boolean)

            > Configure if applications without any policy/group/user bindings should be accessible to any user.

        * Deleted property `policies_buffered_access_view` (boolean)

        * Changed property `enterprise_audit_include_expanded_diff` (boolean)

            > Include additional information in audit logs, may incur a performance penalty.

        * Changed property `flows_continuous_login` (boolean)

            > Upon successful authentication, re-start authentication in other open tabs.

        * Changed property `flows_refresh_others` (boolean)
            > Refresh other tabs after successful authentication.

##### `GET` /crypto/certificatekeypairs/

###### Parameters:

Changed: `key_type` in `query`

##### `POST` /endpoints/agents/connectors/check_in/

###### Request:

Changed content type : `application/json`

- Changed property `os` (object)

    > For example:
    > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
    > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;

    New optional properties:
    - `arch`

##### `GET` /events/events/volume/

###### Parameters:

Added: `context_device` in `query`

> Context Device Primary Key

Changed: `history_days` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Changed items (object): > Count of events of action created on day for a single event action

##### `GET` /events/transports/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webhook_ca` (string)
        > When set, the selected certificate is used to validate the certificate of the webhook server.

##### `PUT` /events/transports/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webhook_ca` (string)
    > When set, the selected certificate is used to validate the certificate of the webhook server.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webhook_ca` (string)
        > When set, the selected certificate is used to validate the certificate of the webhook server.

##### `PATCH` /events/transports/&#123;uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webhook_ca` (string)
    > When set, the selected certificate is used to validate the certificate of the webhook server.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webhook_ca` (string)
        > When set, the selected certificate is used to validate the certificate of the webhook server.

##### `GET` /flows/instances/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

        Added enum value:
        - `require_token`

##### `PUT` /flows/instances/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:
    - `require_token`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

        Added enum value:
        - `require_token`

##### `PATCH` /flows/instances/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:
    - `require_token`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

        Added enum value:
        - `require_token`

##### `POST` /lifecycle/iterations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `rule`

    New optional properties:
    - `min_reviewers`
    - `reviewer_groups`
    - `reviewers`
    * Added property `rule` (object)
        - Property `id` (string)

        - Property `name` (string)

        - Property `reviewer_groups` (array)

            Items (object):
            - Property `pk` (string)

            - Property `name` (string)

        - Property `min_reviewers` (integer)

        - Property `reviewers` (array)

            Items (object):
            - Property `pk` (integer)

            - Property `uuid` (string)

            - Property `username` (string)

                > Required. 150 characters or fewer. Letters, digits and @/./+/-/\_ only.

            - Property `name` (string)
                > User's display name.

    * Deleted property `reviewer_groups` (array)

    * Deleted property `min_reviewers` (integer)

    * Deleted property `reviewers` (array)

##### `POST` /policies/event_matcher/

###### Request:

Changed content type : `application/json`

- Added property `query` (string)

- Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:
    - `authentik.enterprise.endpoints.connectors.google_chrome`
    - `authentik.enterprise.stages.account_lockdown`
      Removed enum value:

    - `authentik.enterprise.search`

- Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:
    - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
    - `authentik_stages_account_lockdown.accountlockdownstage`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `query` (string)

    - Changed property `app` (string)

        > Match events created by selected application. When left empty, all applications are matched.

        Added enum values:
        - `authentik.enterprise.endpoints.connectors.google_chrome`
        - `authentik.enterprise.stages.account_lockdown`
          Removed enum value:

        - `authentik.enterprise.search`

    - Changed property `model` (string)

        > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

        Added enum values:
        - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
        - `authentik_stages_account_lockdown.accountlockdownstage`

##### `GET` /policies/event_matcher/

###### Parameters:

Added: `query` in `query`

Changed: `action` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Event Matcher Policy Serializer
        - Added property `query` (string)

        - Changed property `app` (string)

            > Match events created by selected application. When left empty, all applications are matched.

            Added enum values:
            - `authentik.enterprise.endpoints.connectors.google_chrome`
            - `authentik.enterprise.stages.account_lockdown`
              Removed enum value:

            - `authentik.enterprise.search`

        - Changed property `model` (string)

            > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

            Added enum values:
            - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
            - `authentik_stages_account_lockdown.accountlockdownstage`

##### `GET` /policies/geoip/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `countries_obj` (array)

        Changed items (object):
        - Changed property `code` (string)

            Removed enum values:
            - `AF`
            - `AX`
            - `AL`
            - `DZ`
            - `AS`
            - `AD`
            - `AO`
            - `AI`
            - `AQ`
            - `AG`
            - `AR`
            - `AM`
            - `AW`
            - `AU`
            - `AT`
            - `AZ`
            - `BS`
            - `BH`
            - `BD`
            - `BB`
            - `BY`
            - `BE`
            - `BZ`
            - `BJ`
            - `BM`
            - `BT`
            - `BO`
            - `BQ`
            - `BA`
            - `BW`
            - `BV`
            - `BR`
            - `IO`
            - `BN`
            - `BG`
            - `BF`
            - `BI`
            - `CV`
            - `KH`
            - `CM`
            - `CA`
            - `KY`
            - `CF`
            - `TD`
            - `CL`
            - `CN`
            - `CX`
            - `CC`
            - `CO`
            - `KM`
            - `CG`
            - `CD`
            - `CK`
            - `CR`
            - `CI`
            - `HR`
            - `CU`
            - `CW`
            - `CY`
            - `CZ`
            - `DK`
            - `DJ`
            - `DM`
            - `DO`
            - `EC`
            - `EG`
            - `SV`
            - `GQ`
            - `ER`
            - `EE`
            - `SZ`
            - `ET`
            - `FK`
            - `FO`
            - `FJ`
            - `FI`
            - `FR`
            - `GF`
            - `PF`
            - `TF`
            - `GA`
            - `GM`
            - `GE`
            - `DE`
            - `GH`
            - `GI`
            - `GR`
            - `GL`
            - `GD`
            - `GP`
            - `GU`
            - `GT`
            - `GG`
            - `GN`
            - `GW`
            - `GY`
            - `HT`
            - `HM`
            - `VA`
            - `HN`
            - `HK`
            - `HU`
            - `IS`
            - `IN`
            - `ID`
            - `IR`
            - `IQ`
            - `IE`
            - `IM`
            - `IL`
            - `IT`
            - `JM`
            - `JP`
            - `JE`
            - `JO`
            - `KZ`
            - `KE`
            - `KI`
            - `KW`
            - `KG`
            - `LA`
            - `LV`
            - `LB`
            - `LS`
            - `LR`
            - `LY`
            - `LI`
            - `LT`
            - `LU`
            - `MO`
            - `MG`
            - `MW`
            - `MY`
            - `MV`
            - `ML`
            - `MT`
            - `MH`
            - `MQ`
            - `MR`
            - `MU`
            - `YT`
            - `MX`
            - `FM`
            - `MD`
            - `MC`
            - `MN`
            - `ME`
            - `MS`
            - `MA`
            - `MZ`
            - `MM`
            - `NA`
            - `NR`
            - `NP`
            - `NL`
            - `NC`
            - `NZ`
            - `NI`
            - `NE`
            - `NG`
            - `NU`
            - `NF`
            - `KP`
            - `MK`
            - `MP`
            - `NO`
            - `OM`
            - `PK`
            - `PW`
            - `PS`
            - `PA`
            - `PG`
            - `PY`
            - `PE`
            - `PH`
            - `PN`
            - `PL`
            - `PT`
            - `PR`
            - `QA`
            - `RE`
            - `RO`
            - `RU`
            - `RW`
            - `BL`
            - `SH`
            - `KN`
            - `LC`
            - `MF`
            - `PM`
            - `VC`
            - `WS`
            - `SM`
            - `ST`
            - `SA`
            - `SN`
            - `RS`
            - `SC`
            - `SL`
            - `SG`
            - `SX`
            - `SK`
            - `SI`
            - `SB`
            - `SO`
            - `ZA`
            - `GS`
            - `KR`
            - `SS`
            - `ES`
            - `LK`
            - `SD`
            - `SR`
            - `SJ`
            - `SE`
            - `CH`
            - `SY`
            - `TW`
            - `TJ`
            - `TZ`
            - `TH`
            - `TL`
            - `TG`
            - `TK`
            - `TO`
            - `TT`
            - `TN`
            - `TR`
            - `TM`
            - `TC`
            - `TV`
            - `UG`
            - `UA`
            - `AE`
            - `GB`
            - `UM`
            - `US`
            - `UY`
            - `UZ`
            - `VU`
            - `VE`
            - `VN`
            - `VG`
            - `VI`
            - `WF`
            - `EH`
            - `YE`
            - `ZM`
            - `ZW`

##### `PUT` /policies/geoip/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `countries_obj` (array)

        Changed items (object):
        - Changed property `code` (string)

            Removed enum values:
            - `AF`
            - `AX`
            - `AL`
            - `DZ`
            - `AS`
            - `AD`
            - `AO`
            - `AI`
            - `AQ`
            - `AG`
            - `AR`
            - `AM`
            - `AW`
            - `AU`
            - `AT`
            - `AZ`
            - `BS`
            - `BH`
            - `BD`
            - `BB`
            - `BY`
            - `BE`
            - `BZ`
            - `BJ`
            - `BM`
            - `BT`
            - `BO`
            - `BQ`
            - `BA`
            - `BW`
            - `BV`
            - `BR`
            - `IO`
            - `BN`
            - `BG`
            - `BF`
            - `BI`
            - `CV`
            - `KH`
            - `CM`
            - `CA`
            - `KY`
            - `CF`
            - `TD`
            - `CL`
            - `CN`
            - `CX`
            - `CC`
            - `CO`
            - `KM`
            - `CG`
            - `CD`
            - `CK`
            - `CR`
            - `CI`
            - `HR`
            - `CU`
            - `CW`
            - `CY`
            - `CZ`
            - `DK`
            - `DJ`
            - `DM`
            - `DO`
            - `EC`
            - `EG`
            - `SV`
            - `GQ`
            - `ER`
            - `EE`
            - `SZ`
            - `ET`
            - `FK`
            - `FO`
            - `FJ`
            - `FI`
            - `FR`
            - `GF`
            - `PF`
            - `TF`
            - `GA`
            - `GM`
            - `GE`
            - `DE`
            - `GH`
            - `GI`
            - `GR`
            - `GL`
            - `GD`
            - `GP`
            - `GU`
            - `GT`
            - `GG`
            - `GN`
            - `GW`
            - `GY`
            - `HT`
            - `HM`
            - `VA`
            - `HN`
            - `HK`
            - `HU`
            - `IS`
            - `IN`
            - `ID`
            - `IR`
            - `IQ`
            - `IE`
            - `IM`
            - `IL`
            - `IT`
            - `JM`
            - `JP`
            - `JE`
            - `JO`
            - `KZ`
            - `KE`
            - `KI`
            - `KW`
            - `KG`
            - `LA`
            - `LV`
            - `LB`
            - `LS`
            - `LR`
            - `LY`
            - `LI`
            - `LT`
            - `LU`
            - `MO`
            - `MG`
            - `MW`
            - `MY`
            - `MV`
            - `ML`
            - `MT`
            - `MH`
            - `MQ`
            - `MR`
            - `MU`
            - `YT`
            - `MX`
            - `FM`
            - `MD`
            - `MC`
            - `MN`
            - `ME`
            - `MS`
            - `MA`
            - `MZ`
            - `MM`
            - `NA`
            - `NR`
            - `NP`
            - `NL`
            - `NC`
            - `NZ`
            - `NI`
            - `NE`
            - `NG`
            - `NU`
            - `NF`
            - `KP`
            - `MK`
            - `MP`
            - `NO`
            - `OM`
            - `PK`
            - `PW`
            - `PS`
            - `PA`
            - `PG`
            - `PY`
            - `PE`
            - `PH`
            - `PN`
            - `PL`
            - `PT`
            - `PR`
            - `QA`
            - `RE`
            - `RO`
            - `RU`
            - `RW`
            - `BL`
            - `SH`
            - `KN`
            - `LC`
            - `MF`
            - `PM`
            - `VC`
            - `WS`
            - `SM`
            - `ST`
            - `SA`
            - `SN`
            - `RS`
            - `SC`
            - `SL`
            - `SG`
            - `SX`
            - `SK`
            - `SI`
            - `SB`
            - `SO`
            - `ZA`
            - `GS`
            - `KR`
            - `SS`
            - `ES`
            - `LK`
            - `SD`
            - `SR`
            - `SJ`
            - `SE`
            - `CH`
            - `SY`
            - `TW`
            - `TJ`
            - `TZ`
            - `TH`
            - `TL`
            - `TG`
            - `TK`
            - `TO`
            - `TT`
            - `TN`
            - `TR`
            - `TM`
            - `TC`
            - `TV`
            - `UG`
            - `UA`
            - `AE`
            - `GB`
            - `UM`
            - `US`
            - `UY`
            - `UZ`
            - `VU`
            - `VE`
            - `VN`
            - `VG`
            - `VI`
            - `WF`
            - `EH`
            - `YE`
            - `ZM`
            - `ZW`

##### `PATCH` /policies/geoip/&#123;policy_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `countries_obj` (array)

        Changed items (object):
        - Changed property `code` (string)

            Removed enum values:
            - `AF`
            - `AX`
            - `AL`
            - `DZ`
            - `AS`
            - `AD`
            - `AO`
            - `AI`
            - `AQ`
            - `AG`
            - `AR`
            - `AM`
            - `AW`
            - `AU`
            - `AT`
            - `AZ`
            - `BS`
            - `BH`
            - `BD`
            - `BB`
            - `BY`
            - `BE`
            - `BZ`
            - `BJ`
            - `BM`
            - `BT`
            - `BO`
            - `BQ`
            - `BA`
            - `BW`
            - `BV`
            - `BR`
            - `IO`
            - `BN`
            - `BG`
            - `BF`
            - `BI`
            - `CV`
            - `KH`
            - `CM`
            - `CA`
            - `KY`
            - `CF`
            - `TD`
            - `CL`
            - `CN`
            - `CX`
            - `CC`
            - `CO`
            - `KM`
            - `CG`
            - `CD`
            - `CK`
            - `CR`
            - `CI`
            - `HR`
            - `CU`
            - `CW`
            - `CY`
            - `CZ`
            - `DK`
            - `DJ`
            - `DM`
            - `DO`
            - `EC`
            - `EG`
            - `SV`
            - `GQ`
            - `ER`
            - `EE`
            - `SZ`
            - `ET`
            - `FK`
            - `FO`
            - `FJ`
            - `FI`
            - `FR`
            - `GF`
            - `PF`
            - `TF`
            - `GA`
            - `GM`
            - `GE`
            - `DE`
            - `GH`
            - `GI`
            - `GR`
            - `GL`
            - `GD`
            - `GP`
            - `GU`
            - `GT`
            - `GG`
            - `GN`
            - `GW`
            - `GY`
            - `HT`
            - `HM`
            - `VA`
            - `HN`
            - `HK`
            - `HU`
            - `IS`
            - `IN`
            - `ID`
            - `IR`
            - `IQ`
            - `IE`
            - `IM`
            - `IL`
            - `IT`
            - `JM`
            - `JP`
            - `JE`
            - `JO`
            - `KZ`
            - `KE`
            - `KI`
            - `KW`
            - `KG`
            - `LA`
            - `LV`
            - `LB`
            - `LS`
            - `LR`
            - `LY`
            - `LI`
            - `LT`
            - `LU`
            - `MO`
            - `MG`
            - `MW`
            - `MY`
            - `MV`
            - `ML`
            - `MT`
            - `MH`
            - `MQ`
            - `MR`
            - `MU`
            - `YT`
            - `MX`
            - `FM`
            - `MD`
            - `MC`
            - `MN`
            - `ME`
            - `MS`
            - `MA`
            - `MZ`
            - `MM`
            - `NA`
            - `NR`
            - `NP`
            - `NL`
            - `NC`
            - `NZ`
            - `NI`
            - `NE`
            - `NG`
            - `NU`
            - `NF`
            - `KP`
            - `MK`
            - `MP`
            - `NO`
            - `OM`
            - `PK`
            - `PW`
            - `PS`
            - `PA`
            - `PG`
            - `PY`
            - `PE`
            - `PH`
            - `PN`
            - `PL`
            - `PT`
            - `PR`
            - `QA`
            - `RE`
            - `RO`
            - `RU`
            - `RW`
            - `BL`
            - `SH`
            - `KN`
            - `LC`
            - `MF`
            - `PM`
            - `VC`
            - `WS`
            - `SM`
            - `ST`
            - `SA`
            - `SN`
            - `RS`
            - `SC`
            - `SL`
            - `SG`
            - `SX`
            - `SK`
            - `SI`
            - `SB`
            - `SO`
            - `ZA`
            - `GS`
            - `KR`
            - `SS`
            - `ES`
            - `LK`
            - `SD`
            - `SR`
            - `SJ`
            - `SE`
            - `CH`
            - `SY`
            - `TW`
            - `TJ`
            - `TZ`
            - `TH`
            - `TL`
            - `TG`
            - `TK`
            - `TO`
            - `TT`
            - `TN`
            - `TR`
            - `TM`
            - `TC`
            - `TV`
            - `UG`
            - `UA`
            - `AE`
            - `GB`
            - `UM`
            - `US`
            - `UY`
            - `UZ`
            - `VU`
            - `VE`
            - `VN`
            - `VG`
            - `VI`
            - `WF`
            - `EH`
            - `YE`
            - `ZM`
            - `ZW`

##### `GET` /providers/saml/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `url_issuer`
    - `url_unified`
    - `url_unified_init`
    * Added property `issuer_override` (string)

        > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

    * Added property `sign_logout_response` (boolean)

    * Added property `url_issuer` (string)

        > Get Issuer/EntityID URL

    * Added property `url_unified` (string)

        > Get unified SAML endpoint URL (handles SSO and SLO)

    * Added property `url_unified_init` (string)

        > Get IdP-initiated SAML URL

    * Deleted property `issuer` (string)
        > Also known as EntityID

##### `PUT` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `issuer_override` (string)

    > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

- Added property `sign_logout_response` (boolean)

- Deleted property `issuer` (string)
    > Also known as EntityID

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `url_issuer`
    - `url_unified`
    - `url_unified_init`
    * Added property `issuer_override` (string)

        > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

    * Added property `sign_logout_response` (boolean)

    * Added property `url_issuer` (string)

        > Get Issuer/EntityID URL

    * Added property `url_unified` (string)

        > Get unified SAML endpoint URL (handles SSO and SLO)

    * Added property `url_unified_init` (string)

        > Get IdP-initiated SAML URL

    * Deleted property `issuer` (string)
        > Also known as EntityID

##### `PATCH` /providers/saml/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `issuer_override` (string)

    > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

- Added property `sign_logout_response` (boolean)

- Deleted property `issuer` (string)
    > Also known as EntityID

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `url_issuer`
    - `url_unified`
    - `url_unified_init`
    * Added property `issuer_override` (string)

        > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

    * Added property `sign_logout_response` (boolean)

    * Added property `url_issuer` (string)

        > Get Issuer/EntityID URL

    * Added property `url_unified` (string)

        > Get unified SAML endpoint URL (handles SSO and SLO)

    * Added property `url_unified_init` (string)

        > Get IdP-initiated SAML URL

    * Deleted property `issuer` (string)
        > Also known as EntityID

##### `POST` /providers/saml/import_metadata/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `url_issuer`
    - `url_unified`
    - `url_unified_init`
    * Added property `issuer_override` (string)

        > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

    * Added property `sign_logout_response` (boolean)

    * Added property `url_issuer` (string)

        > Get Issuer/EntityID URL

    * Added property `url_unified` (string)

        > Get unified SAML endpoint URL (handles SSO and SLO)

    * Added property `url_unified_init` (string)

        > Get IdP-initiated SAML URL

    * Deleted property `issuer` (string)
        > Also known as EntityID

##### `GET` /providers/scim/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `auth_oauth_token_expires`
    - `auth_oauth_token_last_updated`
    - `auth_oauth_url_callback`
    - `auth_oauth_url_start`
    * Added property `auth_oauth_token_last_updated` (string)

    * Added property `auth_oauth_token_expires` (string)

    * Added property `auth_oauth_url_callback` (string)

    * Added property `auth_oauth_url_start` (string)

    * Changed property `compatibility_mode` (string)

        > Alter authentik behavior for vendor-specific SCIM implementations.

        Added enum values:
        - `webex`
        - `vcenter`

    * Changed property `auth_mode` (string)

        Added enum value:
        - `oauth_interactive`

##### `PUT` /providers/scim/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum values:
    - `webex`
    - `vcenter`

- Changed property `auth_mode` (string)

    Added enum value:
    - `oauth_interactive`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `auth_oauth_token_expires`
    - `auth_oauth_token_last_updated`
    - `auth_oauth_url_callback`
    - `auth_oauth_url_start`
    * Added property `auth_oauth_token_last_updated` (string)

    * Added property `auth_oauth_token_expires` (string)

    * Added property `auth_oauth_url_callback` (string)

    * Added property `auth_oauth_url_start` (string)

    * Changed property `compatibility_mode` (string)

        > Alter authentik behavior for vendor-specific SCIM implementations.

        Added enum values:
        - `webex`
        - `vcenter`

    * Changed property `auth_mode` (string)

        Added enum value:
        - `oauth_interactive`

##### `PATCH` /providers/scim/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum values:
    - `webex`
    - `vcenter`

- Changed property `auth_mode` (string)

    Added enum value:
    - `oauth_interactive`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `auth_oauth_token_expires`
    - `auth_oauth_token_last_updated`
    - `auth_oauth_url_callback`
    - `auth_oauth_url_start`
    * Added property `auth_oauth_token_last_updated` (string)

    * Added property `auth_oauth_token_expires` (string)

    * Added property `auth_oauth_url_callback` (string)

    * Added property `auth_oauth_url_start` (string)

    * Changed property `compatibility_mode` (string)

        > Alter authentik behavior for vendor-specific SCIM implementations.

        Added enum values:
        - `webex`
        - `vcenter`

    * Changed property `auth_mode` (string)

        Added enum value:
        - `oauth_interactive`

##### `GET` /providers/ssf/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `oidc_auth_providers_obj`
    * Added property `oidc_auth_providers_obj` (array)

        Items (object): > Provider Serializer
        - Property `pk` (integer)

        - Property `name` (string)

        - Property `authentication_flow` (string)

            > Flow used for authentication when the associated application is accessed by an un-authenticated user.

        - Property `authorization_flow` (string)

            > Flow used when authorizing this provider.

        - Property `invalidation_flow` (string)

            > Flow used ending the session from a provider.

        - Property `property_mappings` (array)

            Items (string):

        - Property `component` (string)

            > Get object component so that we know how to edit the object

        - Property `assigned_application_slug` (string)

            > Internal application name, used in URLs.

        - Property `assigned_application_name` (string)

            > Application's display Name.

        - Property `assigned_backchannel_application_slug` (string)

            > Internal application name, used in URLs.

        - Property `assigned_backchannel_application_name` (string)

            > Application's display Name.

        - Property `verbose_name` (string)

            > Return object's verbose_name

        - Property `verbose_name_plural` (string)

            > Return object's plural verbose_name

        - Property `meta_model_name` (string)
            > Return internal model name

    * Added property `push_verify_certificates` (boolean)

##### `PUT` /providers/ssf/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `push_verify_certificates` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `oidc_auth_providers_obj`
    * Added property `oidc_auth_providers_obj` (array)

    * Added property `push_verify_certificates` (boolean)

##### `PATCH` /providers/ssf/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `push_verify_certificates` (boolean)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `oidc_auth_providers_obj`
    * Added property `oidc_auth_providers_obj` (array)

    * Added property `push_verify_certificates` (boolean)

##### `POST` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
    - `authentik_stages_account_lockdown.accountlockdownstage`

##### `PATCH` /rbac/permissions/assigned_by_roles/&#123;uuid&#125;/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

    Added enum values:
    - `authentik_endpoints_connectors_google_chrome.googlechromeconnector`
    - `authentik_stages_account_lockdown.accountlockdownstage`

##### `GET` /rbac/permissions/roles/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `autocomplete`
    * Added property `autocomplete` (object)

##### `GET` /sources/group_connections/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `group_obj`
    * Added property `group_obj` (object)
        - Property `pk` (string)

        - Property `num_pk` (integer)

            > Get a numerical, int32 ID for the group

        - Property `name` (string)

        - Property `is_superuser` (boolean)

            > Users added to this group will be superusers.

        - Property `attributes` (object)

##### `PUT` /sources/group_connections/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `group_obj`
    * Added property `group_obj` (object)

##### `PATCH` /sources/group_connections/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `group_obj`
    * Added property `group_obj` (object)

##### `GET` /sources/saml/&#123;slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `force_authn` (boolean)
        > When enabled, the IdP will re-authenticate the user even if a session exists.

##### `PUT` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `force_authn` (boolean)
    > When enabled, the IdP will re-authenticate the user even if a session exists.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `force_authn` (boolean)
        > When enabled, the IdP will re-authenticate the user even if a session exists.

##### `PATCH` /sources/saml/&#123;slug&#125;/

###### Request:

Changed content type : `application/json`

- Added property `force_authn` (boolean)
    > When enabled, the IdP will re-authenticate the user even if a session exists.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `force_authn` (boolean)
        > When enabled, the IdP will re-authenticate the user even if a session exists.

##### `GET` /sources/user_connections/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `user_obj`
    * Added property `user_obj` (object)
        - Property `pk` (integer)

        - Property `username` (string)

            > Required. 150 characters or fewer. Letters, digits and @/./+/-/\_ only.

        - Property `name` (string)

            > User's display name.

        - Property `is_active` (boolean)

            > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

        - Property `last_login` (string)

        - Property `email` (string)

        - Property `attributes` (object)

        - Property `uid` (string)

##### `PUT` /sources/user_connections/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `user_obj`
    * Added property `user_obj` (object)

##### `PATCH` /sources/user_connections/ldap/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    New required properties:
    - `user_obj`
    * Added property `user_obj` (object)

##### `GET` /ssf/streams/&#123;uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `status` (string)

        Enum values:
        - `enabled`
        - `paused`
        - `disabled`
        - `disabled_deleted`

    - Changed property `provider_obj` (object)

        > SSFProvider Serializer

        New required properties:
        - `oidc_auth_providers_obj`
        * Added property `oidc_auth_providers_obj` (array)

        * Added property `push_verify_certificates` (boolean)

    - Changed property `delivery_method` (string)

        Added enum values:
        - `urn:ietf:rfc:8935`
        - `urn:ietf:rfc:8936`

    - Changed property `events_requested` (array)

        Changed items (string):

        Added enum values:
        - `https://schemas.openid.net/secevent/caep/event-type/token-claims-change`
        - `https://schemas.openid.net/secevent/caep/event-type/assurance-level-change`
        - `https://schemas.openid.net/secevent/caep/event-type/device-compliance-change`
        - `https://schemas.openid.net/secevent/caep/event-type/session-established`
        - `https://schemas.openid.net/secevent/caep/event-type/session-presented`
        - `https://schemas.openid.net/secevent/caep/event-type/risk-level-change`

##### `GET` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

            Added enum value:
            - `require_token`

##### `PUT` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

            Added enum value:
            - `require_token`

##### `PATCH` /stages/invitation/invitations/&#123;invite_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

            Added enum value:
            - `require_token`

##### `POST` /core/applications/

###### Request:

Changed content type : `application/json`

- Added property `meta_hide` (boolean)
    > Hide this application from the user's My applications page.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `meta_hide` (boolean)
        > Hide this application from the user's My applications page.

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Application Serializer
        - Added property `meta_hide` (boolean)
            > Hide this application from the user's My applications page.

##### `GET` /core/user_consent/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `application` (object)

        > Application Serializer
        - Added property `meta_hide` (boolean)
            > Hide this application from the user's My applications page.

##### `GET` /endpoints/devices/&#123;device_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `connections_obj` (array)

        Changed items (object):
        - Changed property `latest_snapshot` (object)
            - Changed property `vendor` (string)

                Added enum value:
                - `chrome.google.com`

    - Changed property `facts` (object)
        - Changed property `vendor` (string)

            Added enum value:
            - `chrome.google.com`

        - Changed property `data` (object)
            - Changed property `os` (object)

                > For example:
                > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;

                New optional properties:
                - `arch`

##### `PUT` /endpoints/devices/&#123;device_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `facts` (object)
        - Changed property `vendor` (string)

            Added enum value:
            - `chrome.google.com`

        - Changed property `data` (object)
            - Changed property `os` (object)

                > For example:
                > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;

                New optional properties:
                - `arch`

##### `PATCH` /endpoints/devices/&#123;device_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `facts` (object)
        - Changed property `vendor` (string)

            Added enum value:
            - `chrome.google.com`

        - Changed property `data` (object)
            - Changed property `os` (object)

                > For example:
                > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;

                New optional properties:
                - `arch`

##### `GET` /events/events/

###### Parameters:

Added: `context_device` in `query`

> Context Device Primary Key

##### `GET` /events/rules/

###### Parameters:

Changed: `severity` in `query`

##### `POST` /events/transports/

###### Request:

Changed content type : `application/json`

- Added property `webhook_ca` (string)
    > When set, the selected certificate is used to validate the certificate of the webhook server.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `webhook_ca` (string)
        > When set, the selected certificate is used to validate the certificate of the webhook server.

##### `GET` /events/transports/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > NotificationTransport Serializer
        - Added property `webhook_ca` (string)
            > When set, the selected certificate is used to validate the certificate of the webhook server.

##### `POST` /flows/instances/

###### Request:

Changed content type : `application/json`

- Changed property `authentication` (string)

    > Required level of authentication and authorization to access a flow.

    Added enum value:
    - `require_token`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `authentication` (string)

        > Required level of authentication and authorization to access a flow.

        Added enum value:
        - `require_token`

##### `GET` /flows/instances/

###### Parameters:

Changed: `denied_action` in `query`

Changed: `designation` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Flow Serializer
        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

            Added enum value:
            - `require_token`

##### `GET` /lifecycle/iterations/open/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

        New required properties:
        - `rule`

        New optional properties:
        - `min_reviewers`
        - `reviewer_groups`
        - `reviewers`
        * Added property `rule` (object)

        * Deleted property `reviewer_groups` (array)

        * Deleted property `min_reviewers` (integer)

        * Deleted property `reviewers` (array)

##### `POST` /policies/geoip/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `countries_obj` (array)

        Changed items (object):
        - Changed property `code` (string)

            Removed enum values:
            - `AF`
            - `AX`
            - `AL`
            - `DZ`
            - `AS`
            - `AD`
            - `AO`
            - `AI`
            - `AQ`
            - `AG`
            - `AR`
            - `AM`
            - `AW`
            - `AU`
            - `AT`
            - `AZ`
            - `BS`
            - `BH`
            - `BD`
            - `BB`
            - `BY`
            - `BE`
            - `BZ`
            - `BJ`
            - `BM`
            - `BT`
            - `BO`
            - `BQ`
            - `BA`
            - `BW`
            - `BV`
            - `BR`
            - `IO`
            - `BN`
            - `BG`
            - `BF`
            - `BI`
            - `CV`
            - `KH`
            - `CM`
            - `CA`
            - `KY`
            - `CF`
            - `TD`
            - `CL`
            - `CN`
            - `CX`
            - `CC`
            - `CO`
            - `KM`
            - `CG`
            - `CD`
            - `CK`
            - `CR`
            - `CI`
            - `HR`
            - `CU`
            - `CW`
            - `CY`
            - `CZ`
            - `DK`
            - `DJ`
            - `DM`
            - `DO`
            - `EC`
            - `EG`
            - `SV`
            - `GQ`
            - `ER`
            - `EE`
            - `SZ`
            - `ET`
            - `FK`
            - `FO`
            - `FJ`
            - `FI`
            - `FR`
            - `GF`
            - `PF`
            - `TF`
            - `GA`
            - `GM`
            - `GE`
            - `DE`
            - `GH`
            - `GI`
            - `GR`
            - `GL`
            - `GD`
            - `GP`
            - `GU`
            - `GT`
            - `GG`
            - `GN`
            - `GW`
            - `GY`
            - `HT`
            - `HM`
            - `VA`
            - `HN`
            - `HK`
            - `HU`
            - `IS`
            - `IN`
            - `ID`
            - `IR`
            - `IQ`
            - `IE`
            - `IM`
            - `IL`
            - `IT`
            - `JM`
            - `JP`
            - `JE`
            - `JO`
            - `KZ`
            - `KE`
            - `KI`
            - `KW`
            - `KG`
            - `LA`
            - `LV`
            - `LB`
            - `LS`
            - `LR`
            - `LY`
            - `LI`
            - `LT`
            - `LU`
            - `MO`
            - `MG`
            - `MW`
            - `MY`
            - `MV`
            - `ML`
            - `MT`
            - `MH`
            - `MQ`
            - `MR`
            - `MU`
            - `YT`
            - `MX`
            - `FM`
            - `MD`
            - `MC`
            - `MN`
            - `ME`
            - `MS`
            - `MA`
            - `MZ`
            - `MM`
            - `NA`
            - `NR`
            - `NP`
            - `NL`
            - `NC`
            - `NZ`
            - `NI`
            - `NE`
            - `NG`
            - `NU`
            - `NF`
            - `KP`
            - `MK`
            - `MP`
            - `NO`
            - `OM`
            - `PK`
            - `PW`
            - `PS`
            - `PA`
            - `PG`
            - `PY`
            - `PE`
            - `PH`
            - `PN`
            - `PL`
            - `PT`
            - `PR`
            - `QA`
            - `RE`
            - `RO`
            - `RU`
            - `RW`
            - `BL`
            - `SH`
            - `KN`
            - `LC`
            - `MF`
            - `PM`
            - `VC`
            - `WS`
            - `SM`
            - `ST`
            - `SA`
            - `SN`
            - `RS`
            - `SC`
            - `SL`
            - `SG`
            - `SX`
            - `SK`
            - `SI`
            - `SB`
            - `SO`
            - `ZA`
            - `GS`
            - `KR`
            - `SS`
            - `ES`
            - `LK`
            - `SD`
            - `SR`
            - `SJ`
            - `SE`
            - `CH`
            - `SY`
            - `TW`
            - `TJ`
            - `TZ`
            - `TH`
            - `TL`
            - `TG`
            - `TK`
            - `TO`
            - `TT`
            - `TN`
            - `TR`
            - `TM`
            - `TC`
            - `TV`
            - `UG`
            - `UA`
            - `AE`
            - `GB`
            - `UM`
            - `US`
            - `UY`
            - `UZ`
            - `VU`
            - `VE`
            - `VN`
            - `VG`
            - `VI`
            - `WF`
            - `EH`
            - `YE`
            - `ZM`
            - `ZW`

##### `GET` /policies/geoip/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > GeoIP Policy Serializer
        - Changed property `countries_obj` (array)

            Changed items (object):
            - Changed property `code` (string)

                Removed enum values:
                - `AF`
                - `AX`
                - `AL`
                - `DZ`
                - `AS`
                - `AD`
                - `AO`
                - `AI`
                - `AQ`
                - `AG`
                - `AR`
                - `AM`
                - `AW`
                - `AU`
                - `AT`
                - `AZ`
                - `BS`
                - `BH`
                - `BD`
                - `BB`
                - `BY`
                - `BE`
                - `BZ`
                - `BJ`
                - `BM`
                - `BT`
                - `BO`
                - `BQ`
                - `BA`
                - `BW`
                - `BV`
                - `BR`
                - `IO`
                - `BN`
                - `BG`
                - `BF`
                - `BI`
                - `CV`
                - `KH`
                - `CM`
                - `CA`
                - `KY`
                - `CF`
                - `TD`
                - `CL`
                - `CN`
                - `CX`
                - `CC`
                - `CO`
                - `KM`
                - `CG`
                - `CD`
                - `CK`
                - `CR`
                - `CI`
                - `HR`
                - `CU`
                - `CW`
                - `CY`
                - `CZ`
                - `DK`
                - `DJ`
                - `DM`
                - `DO`
                - `EC`
                - `EG`
                - `SV`
                - `GQ`
                - `ER`
                - `EE`
                - `SZ`
                - `ET`
                - `FK`
                - `FO`
                - `FJ`
                - `FI`
                - `FR`
                - `GF`
                - `PF`
                - `TF`
                - `GA`
                - `GM`
                - `GE`
                - `DE`
                - `GH`
                - `GI`
                - `GR`
                - `GL`
                - `GD`
                - `GP`
                - `GU`
                - `GT`
                - `GG`
                - `GN`
                - `GW`
                - `GY`
                - `HT`
                - `HM`
                - `VA`
                - `HN`
                - `HK`
                - `HU`
                - `IS`
                - `IN`
                - `ID`
                - `IR`
                - `IQ`
                - `IE`
                - `IM`
                - `IL`
                - `IT`
                - `JM`
                - `JP`
                - `JE`
                - `JO`
                - `KZ`
                - `KE`
                - `KI`
                - `KW`
                - `KG`
                - `LA`
                - `LV`
                - `LB`
                - `LS`
                - `LR`
                - `LY`
                - `LI`
                - `LT`
                - `LU`
                - `MO`
                - `MG`
                - `MW`
                - `MY`
                - `MV`
                - `ML`
                - `MT`
                - `MH`
                - `MQ`
                - `MR`
                - `MU`
                - `YT`
                - `MX`
                - `FM`
                - `MD`
                - `MC`
                - `MN`
                - `ME`
                - `MS`
                - `MA`
                - `MZ`
                - `MM`
                - `NA`
                - `NR`
                - `NP`
                - `NL`
                - `NC`
                - `NZ`
                - `NI`
                - `NE`
                - `NG`
                - `NU`
                - `NF`
                - `KP`
                - `MK`
                - `MP`
                - `NO`
                - `OM`
                - `PK`
                - `PW`
                - `PS`
                - `PA`
                - `PG`
                - `PY`
                - `PE`
                - `PH`
                - `PN`
                - `PL`
                - `PT`
                - `PR`
                - `QA`
                - `RE`
                - `RO`
                - `RU`
                - `RW`
                - `BL`
                - `SH`
                - `KN`
                - `LC`
                - `MF`
                - `PM`
                - `VC`
                - `WS`
                - `SM`
                - `ST`
                - `SA`
                - `SN`
                - `RS`
                - `SC`
                - `SL`
                - `SG`
                - `SX`
                - `SK`
                - `SI`
                - `SB`
                - `SO`
                - `ZA`
                - `GS`
                - `KR`
                - `SS`
                - `ES`
                - `LK`
                - `SD`
                - `SR`
                - `SJ`
                - `SE`
                - `CH`
                - `SY`
                - `TW`
                - `TJ`
                - `TZ`
                - `TH`
                - `TL`
                - `TG`
                - `TK`
                - `TO`
                - `TT`
                - `TN`
                - `TR`
                - `TM`
                - `TC`
                - `TV`
                - `UG`
                - `UA`
                - `AE`
                - `GB`
                - `UM`
                - `US`
                - `UY`
                - `UZ`
                - `VU`
                - `VE`
                - `VN`
                - `VG`
                - `VI`
                - `WF`
                - `EH`
                - `YE`
                - `ZM`
                - `ZW`

##### `GET` /providers/oauth2/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `grant_types` (array)

        Items (string):

        Enum values:
        - `authorization_code`
        - `implicit`
        - `hybrid`
        - `refresh_token`
        - `client_credentials`
        - `password`
        - `urn:ietf:params:oauth:grant-type:device_code`

    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

            Enum values:
            - `authorization`
            - `logout`

##### `PUT` /providers/oauth2/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `grant_types` (array)

- Changed property `redirect_uris` (array)

    Changed items (object): > A single allowed redirect URI entry
    - Added property `redirect_uri_type` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `grant_types` (array)

    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `PATCH` /providers/oauth2/&#123;id&#125;/

###### Request:

Changed content type : `application/json`

- Added property `grant_types` (array)

- Changed property `redirect_uris` (array)

    Changed items (object): > A single allowed redirect URI entry
    - Added property `redirect_uri_type` (object)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `grant_types` (array)

    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `GET` /providers/proxy/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `PUT` /providers/proxy/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `PATCH` /providers/proxy/&#123;id&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `POST` /providers/saml/

###### Request:

Changed content type : `application/json`

- Added property `issuer_override` (string)

    > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

- Added property `sign_logout_response` (boolean)

- Deleted property `issuer` (string)
    > Also known as EntityID

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `url_issuer`
    - `url_unified`
    - `url_unified_init`
    * Added property `issuer_override` (string)

        > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

    * Added property `sign_logout_response` (boolean)

    * Added property `url_issuer` (string)

        > Get Issuer/EntityID URL

    * Added property `url_unified` (string)

        > Get unified SAML endpoint URL (handles SSO and SLO)

    * Added property `url_unified_init` (string)

        > Get IdP-initiated SAML URL

    * Deleted property `issuer` (string)
        > Also known as EntityID

##### `GET` /providers/saml/

###### Parameters:

Added: `issuer_override` in `query`

Added: `sign_logout_response` in `query`

Deleted: `issuer` in `query`

Changed: `logout_method` in `query`

Changed: `sls_binding` in `query`

Changed: `sp_binding` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLProvider Serializer

        New required properties:
        - `url_issuer`
        - `url_unified`
        - `url_unified_init`
        * Added property `issuer_override` (string)

            > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

        * Added property `sign_logout_response` (boolean)

        * Added property `url_issuer` (string)

            > Get Issuer/EntityID URL

        * Added property `url_unified` (string)

            > Get unified SAML endpoint URL (handles SSO and SLO)

        * Added property `url_unified_init` (string)

            > Get IdP-initiated SAML URL

        * Deleted property `issuer` (string)
            > Also known as EntityID

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum values:
    - `webex`
    - `vcenter`

- Changed property `auth_mode` (string)

    Added enum value:
    - `oauth_interactive`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `auth_oauth_token_expires`
    - `auth_oauth_token_last_updated`
    - `auth_oauth_url_callback`
    - `auth_oauth_url_start`
    * Added property `auth_oauth_token_last_updated` (string)

    * Added property `auth_oauth_token_expires` (string)

    * Added property `auth_oauth_url_callback` (string)

    * Added property `auth_oauth_url_start` (string)

    * Changed property `compatibility_mode` (string)

        > Alter authentik behavior for vendor-specific SCIM implementations.

        Added enum values:
        - `webex`
        - `vcenter`

    * Changed property `auth_mode` (string)

        Added enum value:
        - `oauth_interactive`

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SCIMProvider Serializer

        New required properties:
        - `auth_oauth_token_expires`
        - `auth_oauth_token_last_updated`
        - `auth_oauth_url_callback`
        - `auth_oauth_url_start`
        * Added property `auth_oauth_token_last_updated` (string)

        * Added property `auth_oauth_token_expires` (string)

        * Added property `auth_oauth_url_callback` (string)

        * Added property `auth_oauth_url_start` (string)

        * Changed property `compatibility_mode` (string)

            > Alter authentik behavior for vendor-specific SCIM implementations.

            Added enum values:
            - `webex`
            - `vcenter`

        * Changed property `auth_mode` (string)

            Added enum value:
            - `oauth_interactive`

##### `POST` /providers/ssf/

###### Request:

Changed content type : `application/json`

- Added property `push_verify_certificates` (boolean)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `oidc_auth_providers_obj`
    * Added property `oidc_auth_providers_obj` (array)

    * Added property `push_verify_certificates` (boolean)

##### `GET` /providers/ssf/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFProvider Serializer

        New required properties:
        - `oidc_auth_providers_obj`
        * Added property `oidc_auth_providers_obj` (array)

        * Added property `push_verify_certificates` (boolean)

##### `GET` /providers/wsfed/

###### Parameters:

Added: `issuer_override` in `query`

Added: `sign_logout_response` in `query`

Deleted: `issuer` in `query`

Changed: `logout_method` in `query`

Changed: `sls_binding` in `query`

Changed: `sp_binding` in `query`

##### `GET` /rbac/permissions/assigned_by_roles/

###### Parameters:

Changed: `model` in `query`

##### `POST` /sources/group_connections/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `group_obj`
    * Added property `group_obj` (object)

##### `GET` /sources/group_connections/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Group Source Connection

        New required properties:
        - `group_obj`
        * Added property `group_obj` (object)

##### `GET` /sources/kerberos/

###### Parameters:

Changed: `kadmin_type` in `query`

##### `GET` /sources/oauth/

###### Parameters:

Changed: `group_matching_mode` in `query`

Changed: `user_matching_mode` in `query`

##### `GET` /sources/plex/

###### Parameters:

Changed: `group_matching_mode` in `query`

Changed: `user_matching_mode` in `query`

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Added property `force_authn` (boolean)
    > When enabled, the IdP will re-authenticate the user even if a session exists.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `force_authn` (boolean)
        > When enabled, the IdP will re-authenticate the user even if a session exists.

##### `GET` /sources/saml/

###### Parameters:

Added: `force_authn` in `query`

Changed: `name_id_policy` in `query`

Changed: `user_matching_mode` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SAMLSource Serializer
        - Added property `force_authn` (boolean)
            > When enabled, the IdP will re-authenticate the user even if a session exists.

##### `GET` /sources/telegram/

###### Parameters:

Changed: `group_matching_mode` in `query`

Changed: `user_matching_mode` in `query`

##### `POST` /sources/user_connections/ldap/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

    New required properties:
    - `user_obj`
    * Added property `user_obj` (object)

##### `GET` /sources/user_connections/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > User source connection

        New required properties:
        - `user_obj`
        * Added property `user_obj` (object)

##### `GET` /ssf/streams/

###### Parameters:

Changed: `delivery_method` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > SSFStream Serializer
        - Added property `status` (string)

        - Changed property `provider_obj` (object)

            > SSFProvider Serializer

            New required properties:
            - `oidc_auth_providers_obj`
            * Added property `oidc_auth_providers_obj` (array)

            * Added property `push_verify_certificates` (boolean)

        - Changed property `delivery_method` (string)

            Added enum values:
            - `urn:ietf:rfc:8935`
            - `urn:ietf:rfc:8936`

        - Changed property `events_requested` (array)

            Changed items (string):

            Added enum values:
            - `https://schemas.openid.net/secevent/caep/event-type/token-claims-change`
            - `https://schemas.openid.net/secevent/caep/event-type/assurance-level-change`
            - `https://schemas.openid.net/secevent/caep/event-type/device-compliance-change`
            - `https://schemas.openid.net/secevent/caep/event-type/session-established`
            - `https://schemas.openid.net/secevent/caep/event-type/session-presented`
            - `https://schemas.openid.net/secevent/caep/event-type/risk-level-change`

##### `GET` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webauthn_hints` (array)

        Items (string):

        Enum values:
        - `security-key`
        - `client-device`
        - `hybrid`

    - Added property `email_otp_throttling_factor` (number)

    - Added property `sms_otp_throttling_factor` (number)

    - Added property `totp_otp_throttling_factor` (number)

    - Added property `static_otp_throttling_factor` (number)

##### `PUT` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_hints` (array)

- Added property `email_otp_throttling_factor` (number)

- Added property `sms_otp_throttling_factor` (number)

- Added property `totp_otp_throttling_factor` (number)

- Added property `static_otp_throttling_factor` (number)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webauthn_hints` (array)

    - Added property `email_otp_throttling_factor` (number)

    - Added property `sms_otp_throttling_factor` (number)

    - Added property `totp_otp_throttling_factor` (number)

    - Added property `static_otp_throttling_factor` (number)

##### `PATCH` /stages/authenticator/validate/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_hints` (array)

- Added property `email_otp_throttling_factor` (number)

- Added property `sms_otp_throttling_factor` (number)

- Added property `totp_otp_throttling_factor` (number)

- Added property `static_otp_throttling_factor` (number)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `webauthn_hints` (array)

    - Added property `email_otp_throttling_factor` (number)

    - Added property `sms_otp_throttling_factor` (number)

    - Added property `totp_otp_throttling_factor` (number)

    - Added property `static_otp_throttling_factor` (number)

##### `GET` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `hints` (array)

    - Added property `prevent_duplicate_devices` (boolean)
        > When enabled, a given device can only be registered once.

##### `PUT` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `hints` (array)

- Added property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `hints` (array)

    - Added property `prevent_duplicate_devices` (boolean)
        > When enabled, a given device can only be registered once.

##### `PATCH` /stages/authenticator/webauthn/&#123;stage_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Added property `hints` (array)

- Added property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Added property `hints` (array)

    - Added property `prevent_duplicate_devices` (boolean)
        > When enabled, a given device can only be registered once.

##### `POST` /stages/invitation/invitations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `flow_obj` (object)

        > Flow Serializer
        - Changed property `authentication` (string)

            > Required level of authentication and authorization to access a flow.

            Added enum value:
            - `require_token`

##### `GET` /stages/invitation/invitations/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Invitation Serializer
        - Changed property `flow_obj` (object)

            > Flow Serializer
            - Changed property `authentication` (string)

                > Required level of authentication and authorization to access a flow.

                Added enum value:
                - `require_token`

##### `POST` /stages/prompt/prompts/preview/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

    Added enum values:
    - `alert_info`
    - `alert_warning`
    - `alert_danger`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `fields` (array)

        Changed items (object): > Serializer for a single Prompt field
        - Changed property `type` (string)

            Added enum values:
            - `alert_info`
            - `alert_warning`
            - `alert_danger`

##### `GET` /core/user_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > UserConsent Serializer
        - Changed property `application` (object)

            > Application Serializer
            - Added property `meta_hide` (boolean)
                > Hide this application from the user's My applications page.

##### `GET` /endpoints/devices/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object):
        - Changed property `facts` (object)
            - Changed property `vendor` (string)

                Added enum value:
                - `chrome.google.com`

            - Changed property `data` (object)
                - Changed property `os` (object)

                    > For example:
                    > &#123;"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"&#125;
                    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                    > &#123;"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"&#125;
                    > &#123;"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"&#125;

                    New optional properties:
                    - `arch`

##### `GET` /flows/bindings/

###### Parameters:

Changed: `invalid_response_action` in `query`

##### `GET` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-session-end` component:
    - Added property `overview_url` (string)

    Updated `ak-provider-iframe-logout` component:
    - Changed property `logout_urls` (array)

        Changed items (object): > Data for a single logout URL

        New required properties:
        - `url`
        * Added property `url` (string)

        * Added property `provider_name` (string)

        * Added property `binding` (string)

        * Added property `saml_request` (string)

        * Added property `saml_response` (string)

        * Added property `saml_relay_state` (string)

    Updated `ak-provider-saml-native-logout` component:
    - Added property `saml_binding` (string)

        Enum values:
        - `redirect`
        - `post`

    - Added property `saml_response` (string)

    - Added property `saml_relay_state` (string)

    - Deleted property `relay_state` (string)

    - Deleted property `binding` (string)

    Updated `ak-stage-prompt` component:
    - Changed property `fields` (array)

        Changed items (object): > Serializer for a single Prompt field
        - Changed property `type` (string)

            Added enum values:
            - `alert_info`
            - `alert_warning`
            - `alert_danger`

##### `POST` /flows/executor/&#123;flow_slug&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

    Updated `ak-stage-session-end` component:
    - Added property `overview_url` (string)

    Updated `ak-provider-iframe-logout` component:
    - Changed property `logout_urls` (array)

        Changed items (object): > Data for a single logout URL

        New required properties:
        - `url`
        * Added property `url` (string)

        * Added property `provider_name` (string)

        * Added property `binding` (string)

        * Added property `saml_request` (string)

        * Added property `saml_response` (string)

        * Added property `saml_relay_state` (string)

    Updated `ak-provider-saml-native-logout` component:
    - Added property `saml_binding` (string)

    - Added property `saml_response` (string)

    - Added property `saml_relay_state` (string)

    - Deleted property `relay_state` (string)

    - Deleted property `binding` (string)

    Updated `ak-stage-prompt` component:
    - Changed property `fields` (array)

        Changed items (object): > Serializer for a single Prompt field
        - Changed property `type` (string)

            Added enum values:
            - `alert_info`
            - `alert_warning`
            - `alert_danger`

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Added property `grant_types` (array)

- Changed property `redirect_uris` (array)

    Changed items (object): > A single allowed redirect URI entry
    - Added property `redirect_uri_type` (object)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `grant_types` (array)

    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `GET` /providers/oauth2/

###### Parameters:

Changed: `client_type` in `query`

Changed: `issuer_mode` in `query`

Changed: `sub_mode` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > OAuth2Provider Serializer
        - Added property `grant_types` (array)

        - Changed property `redirect_uris` (array)

            Changed items (object): > A single allowed redirect URI entry
            - Added property `redirect_uri_type` (object)

##### `POST` /providers/proxy/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `GET` /providers/proxy/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > ProxyProvider Serializer
        - Changed property `redirect_uris` (array)

            Changed items (object): > A single allowed redirect URI entry
            - Added property `redirect_uri_type` (object)

##### `POST` /stages/authenticator/validate/

###### Request:

Changed content type : `application/json`

- Added property `webauthn_hints` (array)

- Added property `email_otp_throttling_factor` (number)

- Added property `sms_otp_throttling_factor` (number)

- Added property `totp_otp_throttling_factor` (number)

- Added property `static_otp_throttling_factor` (number)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `webauthn_hints` (array)

    - Added property `email_otp_throttling_factor` (number)

    - Added property `sms_otp_throttling_factor` (number)

    - Added property `totp_otp_throttling_factor` (number)

    - Added property `static_otp_throttling_factor` (number)

##### `GET` /stages/authenticator/validate/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorValidateStage Serializer
        - Added property `webauthn_hints` (array)

        - Added property `email_otp_throttling_factor` (number)

        - Added property `sms_otp_throttling_factor` (number)

        - Added property `totp_otp_throttling_factor` (number)

        - Added property `static_otp_throttling_factor` (number)

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Added property `hints` (array)

- Added property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Added property `hints` (array)

    - Added property `prevent_duplicate_devices` (boolean)
        > When enabled, a given device can only be registered once.

##### `GET` /stages/authenticator/webauthn/

###### Parameters:

Deleted: `friendly_name` in `query`

Deleted: `stage_uuid` in `query`

Changed: `authenticator_attachment` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > AuthenticatorWebAuthnStage Serializer
        - Added property `hints` (array)

        - Added property `prevent_duplicate_devices` (boolean)
            > When enabled, a given device can only be registered once.

##### `GET` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

        Added enum values:
        - `alert_info`
        - `alert_warning`
        - `alert_danger`

##### `PUT` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

    Added enum values:
    - `alert_info`
    - `alert_warning`
    - `alert_danger`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

        Added enum values:
        - `alert_info`
        - `alert_warning`
        - `alert_danger`

##### `PATCH` /stages/prompt/prompts/&#123;prompt_uuid&#125;/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

    Added enum values:
    - `alert_info`
    - `alert_warning`
    - `alert_danger`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `type` (string)

        Added enum values:
        - `alert_info`
        - `alert_warning`
        - `alert_danger`

##### `GET` /stages/user_login/

###### Parameters:

Changed: `geoip_binding` in `query`

Changed: `network_binding` in `query`

##### `GET` /tasks/tasks/

###### Parameters:

Changed: `state` in `query`

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `app` (object)

    > Application Serializer
    - Added property `meta_hide` (boolean)
        > Hide this application from the user's My applications page.

- Changed property `provider` (object)

    Updated `authentik_providers_ssf.ssfprovider` provider_model:
    - Added property `push_verify_certificates` (boolean)

    Updated `authentik_providers_saml.samlprovider` provider_model:
    - Added property `issuer_override` (string)

        > Also known as EntityID. Providing a value overrides the default issuer generated by authentik.

    - Added property `sign_logout_response` (boolean)

    - Deleted property `issuer` (string)
        > Also known as EntityID

    Updated `authentik_providers_scim.scimprovider` provider_model:
    - Changed property `compatibility_mode` (string)

        > Alter authentik behavior for vendor-specific SCIM implementations.

        Added enum values:
        - `webex`
        - `vcenter`

    - Changed property `auth_mode` (string)

        Added enum value:
        - `oauth_interactive`

        Updated `authentik_providers_oauth2.oauth2provider` provider_model:

    - Added property `grant_types` (array)

    - Changed property `redirect_uris` (array)

        Changed items (object): > A single allowed redirect URI entry
        - Added property `redirect_uri_type` (object)

##### `POST` /stages/prompt/prompts/

###### Request:

Changed content type : `application/json`

- Changed property `type` (string)

    Added enum values:
    - `alert_info`
    - `alert_warning`
    - `alert_danger`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
    - Changed property `type` (string)

        Added enum values:
        - `alert_info`
        - `alert_warning`
        - `alert_danger`

##### `GET` /stages/prompt/prompts/

###### Parameters:

Changed: `type` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
    - Changed property `results` (array)

        Changed items (object): > Prompt Serializer
        - Changed property `type` (string)

            Added enum values:
            - `alert_info`
            - `alert_warning`
            - `alert_danger`

#### Result

---

API changes broke backward compatibility

### authentik (v 2026.5.6)

---

#### What's Changed

---

##### `POST` /endpoints/agents/connectors/auth_fed/

##### `POST` /endpoints/agents/connectors/enroll/

##### `GET` /endpoints/agents/connectors/agent_config/

##### `POST` /endpoints/agents/connectors/check_in/

#### Result

---

API changes are backward compatible

---

## Release 2026.8

## Highlights

- **Privileged access management (PAM)**:  Users can request access to applications or specific application entitlements. Designated approvers can approve or deny requests and set when access expires.
- **Agent accounts**:  Service accounts that act on behalf of a parent user, enabling automation and integrations while preserving delegated access and auditability.
- **User switching**: Users can keep multiple accounts signed in within the same browser and switch between them from the User interface.
- **User offboarding**:  Schedule users for deactivation or deletion, with optional session and token revocation.
- **Object attributes**: Define custom fields for users, groups, application entitlements, and other objects, with validation built into the Admin interface and API.
- **Self-hosted event maps**:  Use the new bundled event map without external requests, or configure a self-hosted map for each brand.
- **OAuth 2.0 and OpenID Connect improvements**: Exchange tokens between trusted providers and use key-bound ID tokens for stronger protection against token theft. Also added support for on-behalf-of (OBO) and Dynamic Client Registration (DCR).

## Breaking changes

### `hash_password` management command security improvements

The `hash_password` management command no longer accepts a password as a positional command-line argument (password was visible in the process list). Run the command without arguments to enter the password in a hidden interactive prompt:

```bash
docker compose run --rm server hash_password
```

For automation, pipe the password through standard input:

```bash
printf '%s' "$PASSWORD" | docker compose run --rm server hash_password
```

### "Prevent duplicate device" in WebAuthn setup stage removed

The **Prevent duplicate devices** option of the [WebAuthn authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx) has been removed. It compared attestation certificates, which manufacturers deliberately share across entire production batches, so it rejected legitimate enrollments of a second security key bought at the same time as the first. The option was disabled by default in 2026.5.4 and is now gone; no configuration is required to replace it, and no action is needed when upgrading.

### Forwarded headers are now restricted to trusted proxies

Starting with authentik 2026.8, the authentik server only uses forwarded request headers such as `X-Forwarded-Proto`, `X-Forwarded-Host`, and `X-Forwarded-For` when the connection comes from a trusted proxy network. Previous versions did not apply this restriction consistently to all forwarded headers.

This change prevents clients from supplying forged proxy headers and more strictly enforces the existing trusted proxy configuration.

Before upgrading, verify that your reverse proxy sends the [required proxy headers](../../install-config/reverse-proxy.mdx#required-proxy-headers) and that every address or network from which it connects directly to authentik is included in [`AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS`](../../install-config/reverse-proxy.mdx#trusted-proxy-networks).

An incorrect configuration can cause authentik to interpret HTTPS requests as HTTP, resulting in blocked mixed content, an endless loading indicator, or authentication errors.

## New features and improvements

### Privileged access management (PAM)&#x20;

Users can now request access to applications and application entitlements from the User interface. They can browse the resources that they are eligible to request and track whether each request is pending, approved, denied, or revoked. Approved access expires automatically after the configured duration.

Administrators define request rules that control who can request and approve access. Rules support approval by individual users, groups, or policies, minimum reviewer counts, request and grant expiration limits, reviewer notifications, and custom flows that collect request details. Reviewers can approve or deny pending requests and revoke active grants. Each action is recorded in the event log.

For more details, refer to the [access requests documentation](../../add-secure-apps/access-requests/index.mdx).

### Agent accounts&#x20;

authentik now supports "Agent" service accounts that act on behalf of a parent user when accessing the authentik API. Agents are designed for automation, integrations, and other machine identities that need delegated access while preserving a clear link to the user they represent. Administrators can control how agents inherit policy access, set expiration rules, manage them through the API, and trace their activity through audit events. Users can optionally create agent accounts via the user interface.

For more details, refer to the [agent accounts documentation](../../users-sources/user/account-types/agent-accounts.mdx).

### User switching

Users can now keep multiple authentik accounts signed in within the same browser and switch between them from the account menu in the User interface. They can also add another account without signing out of their current accounts.

Administrators enable the feature by selecting a **User switch flow** for the brand. Because this is a normal authentik flow, policies can control whether a switch requires a password, MFA, or a shorter verification process. Successful switches are recorded in the event log. For configuration details, refer to the [user switching documentation](../../users-sources/user/user-switching.mdx).

### Scheduled user offboarding&#x20;

Administrators can schedule a user for deactivation or deletion at a specific date and time, with the option to revoke the user's sessions and tokens.

Scheduled offboardings can be reviewed or canceled before they run. authentik retries failed actions and records the result in the event log, providing a clear history of who scheduled the offboarding and which actions were selected. For more details, refer to the [user offboarding documentation](../../sys-mgmt/user-offboarding.mdx).

### Object attributes

Administrators can now define custom text, number, and Boolean fields under **Directory** > **Object attributes**. Fields can be required, unique, or validated against a regular expression.

These fields appear when editing users, groups, application entitlements, and device access groups, and the same validation applies when objects are managed through the API.

authentik also includes definitions for common identity, contact, address, Unix, and employee attributes. These definitions are disabled by default and can be enabled as needed. For more information, refer to the [object attributes documentation](../../sys-mgmt/object-attributes.mdx).

### Self-hosted event maps&#x20;

The events map now uses a basemap bundled with authentik and does not make external requests by default, making it suitable for air-gapped and restricted-network deployments. Nearby events are grouped together, with columns showing the event volume and the types of events recorded in each area.

Users can select an area to filter the event list, and each brand can use the bundled map or configure a self-hosted map under **Map tiles**. For more details, refer to the [events documentation](../../sys-mgmt/events/index.mdx).

### OAuth 2.0 and OpenID Connect

#### OpenID Certification

As of 2026.8, authentik is officially **OpenID Certified™** by the OpenID Foundation — for both [OpenID Provider profiles](https://openid.net/certification/certified-openid-providers-profiles/) (Basic, Implicit, Hybrid, Config, and Form Post OP) and [logout profiles](https://openid.net/certification/certified-openid-providers-for-logout-profiles/) (RP-Initiated, Front-Channel, and Back-Channel).

#### Token exchange

[OAuth 2.0 token exchange](../../add-secure-apps/providers/oauth2/token_exchange.mdx) allows applications to exchange a token from a trusted provider or source for an authentik access token representing the same user. This makes it easier for connected services to act on a user's behalf without sharing the original token between services.

Token exchange is disabled by default and can be enabled under the provider's **Grant Types** setting. Trusted providers and sources are configured using the existing JWT federation settings.

#### On-behalf-of (OBO) token exchange

authentik now supports RFC 8693 delegation. Clients can supply an authentik Actor token using `actor_token` and `actor_token_type` to receive a token that identifies both the user and the Actor acting on the user's behalf through the `act` claim. This enables services and agents to preserve user context while making delegated requests.

For more information, refer to the [OBO documentation](../../add-secure-apps/providers/oauth2/token_exchange.mdx#exchange-a-token-on-behalf-of-a-user-obo).

#### Dynamic client registration

Applications can now use OAuth 2.0 and OpenID Connect Dynamic Client Registration (DCR) to register themselves with authentik, removing the need for administrators to create each application and provider manually. Administrators retain control through policy bindings and configurable restrictions on grant types, scope mappings, and token validity. This simplifies and automates client onboarding, particularly in environments where applications are created frequently or on demand.

For more information, refer to the [DCR documentation](../../add-secure-apps/providers/oauth2/dynamic-client-registration.mdx)

#### OpenID key binding

OpenID Connect providers can now issue key-bound ID tokens. These tokens require the client to prove that it holds the associated key, providing stronger protection if a token is stolen. Key binding is available for authorization code, device code, and refresh flows.

### Nested LDAP group synchronization

LDAP sources can now preserve the source directory's nested group hierarchy in authentik. Enable **Sync Group Parents** to create parent relationships between synchronized groups. For configuration details, refer to the [LDAP source documentation](../../users-sources/sources/protocols/ldap/index.mdx#additional-settings).

### Expiring policy bindings

[Policy, group, and user bindings](../../customize/policies/bindings.mdx) can now have an expiration date and time. An expired binding no longer grants access or contributes a successful policy result, which makes temporary application, flow, and stage access possible without requiring an administrator to remove the binding later.

### Base URL system setting

authentik now has a **Base URL** [system setting](../../sys-mgmt/settings.mdx) that records the external URL where the instance is available. It can be configured under **System** > **Settings**, through the API, or with [`AUTHENTIK_WEB__BASE_URL`](../../install-config/configuration/configuration.mdx#authentik_web__base_url) during installation.

Enter only the scheme and host, even if authentik is served under a subpath. This setting will become required starting with authentik 2026.11, so we recommend configuring it now.

### PostgreSQL connection-pooler support

authentik now supports using a transaction-mode PostgreSQL connection pooler alongside a separate direct database connection for operations that require a stable session. Existing PostgreSQL settings continue to handle normal traffic, while the new direct settings can point to a direct or session-pooled endpoint. For configuration details, refer to [Session-scoped operations and transaction-mode poolers](../../install-config/configuration/configuration.mdx#session-scoped-operations-and-transaction-mode-poolers).

### Server and proxy outpost rewrite in Rust

As part of our ongoing project to improve the performance and resource consumption of authentik, the authentik server (only the entrypoint for requests, the core remains Django) and proxy outpost, previously written in Golang, have been rewritten in Rust. We aimed this rewrite to be a 1-to-1 match with the previous code.

This currently does not bring any improvements, but is a stepping stone for us to couple the Django core and the proxying Rust closer together, to avoid wasting resources. Stay tuned for more in following releases!

### Task status reflects task logs

A task can log an error and still finish, for example a sync that failed for a single object. Those tasks were marked successful, and because the **System Tasks** page hides successful tasks by default, they were invisible. They now show as errors or warnings, so failures that were already occurring may start appearing there after upgrading. Tasks that ran before the upgrade keep their old status until they run again.

### Small general improvements

- **Application Dashboard**: Users can switch between the existing card grid and a new compact list view. The selected view is remembered in the browser.
- **AKQL**: Queries against JSON fields now match numeric and Boolean values in addition to strings.
- **CAPTCHA providers**: The [Captcha stage](../../add-secure-apps/flows-stages/stages/captcha/index.mdx) now supports JSON verification requests and the self-hostable Cap CAPTCHA provider.
- **GitLab SCIM**: SCIM providers now include a compatibility mode for GitLab.
- **OAuth and OpenID Connect**: Providers can sign with Ed448 keys, OAuth sources can store longer authorization URLs, and Twitter sources can retrieve a user's email address.
- **SAML providers**: Authentication requests that set `ForceAuthn` now require fresh authentication.
- **WS-Federation**:  Providers can issue SAML 1.1 assertions, enabling WS-Federation integration with [Microsoft 365 and Entra ID](https://integrations.goauthentik.io/platforms/microsoft-ws-federation/).
- **User event history**: Account changes made by administrators now appear in the affected user's event history.
- **Password hash imports**: [Bootstrap and API password hash imports](../../install-config/automated-install.mdx#authentik_bootstrap_password_hash) now reject malformed values before they are stored.
- **Enterprise licensing**:  The license status card now shows when a license expires today or the number of days remaining.
- **Performance**: Group lists use fewer database queries, and S3-backed file storage reuses clients instead of creating them for each operation.
- **Authenticators**: Deleting an authenticator stage no longer deletes enrolled devices that reference it.
- **Runtime health checks**: Server and worker health checks now run through the Rust entrypoint.
- **Upgrades**: The lifecycle tooling now prevents unsupported major-version skips before migrations begin.

## New integration guides

An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added. A big thanks to our contributors!

- [Appsmith](https://integrations.goauthentik.io/platforms/appsmith/)
- [Atlantis](https://integrations.goauthentik.io/infrastructure/atlantis/)
- [Box](https://integrations.goauthentik.io/platforms/box/)
- [Chatwoot](https://integrations.goauthentik.io/infrastructure/chatwoot/)
- [Cisco Secure Firewall Management Center](https://integrations.goauthentik.io/networking/cisco-fmc/) (Thanks to @riversdev0!)
- [Convex](https://integrations.goauthentik.io/development/convex/)
- [Coolify](https://integrations.goauthentik.io/infrastructure/coolify/)
- [Cursor](https://integrations.goauthentik.io/development/cursor/)
- [Dashy](https://integrations.goauthentik.io/dashboards/dashy/) (Thanks to @nicedevil007!)
- [Directus](https://integrations.goauthentik.io/platforms/directus/)
- [Discourse](https://integrations.goauthentik.io/chat-communication-collaboration/discourse/)
- [Docker Platforms](https://integrations.goauthentik.io/platforms/docker-platforms/)
- [Dozzle](https://integrations.goauthentik.io/monitoring/dozzle/)
- [Dropbox Sign](https://integrations.goauthentik.io/documentation/dropbox-sign/)
- [ExcaliDash](https://integrations.goauthentik.io/dashboards/excalidash/)
- [FortiAnalyzer](https://integrations.goauthentik.io/monitoring/fortianalyzer/) (Thanks to @nicedevil007!)
- [GitGuardian](https://integrations.goauthentik.io/security/gitguardian/)
- [Gotify](https://integrations.goauthentik.io/monitoring/gotify/) (Thanks to @nicedevil007!)
- [HubSpot](https://integrations.goauthentik.io/platforms/hubspot/)
- [Icinga Web 2](https://integrations.goauthentik.io/monitoring/icinga/) (Thanks to @nicedevil007!)
- [IIS](https://integrations.goauthentik.io/infrastructure/iis/)
- [Infisical](https://integrations.goauthentik.io/security/infisical/)
- [Incus](https://integrations.goauthentik.io/hypervisors-orchestrators/incus/)
- [Kavita](https://integrations.goauthentik.io/media/kavita/)
- [mailcow Logs Viewer](https://integrations.goauthentik.io/chat-communication-collaboration/mailcow-logs-viewer/) (Thanks to @nicedevil007!)
- [Maintainerr](https://integrations.goauthentik.io/media/maintainerr/) (Thanks to @enoch85!)
- [Memos](https://integrations.goauthentik.io/chat-communication-collaboration/memos/)
- [Microsoft 365 via WS-Federation](https://integrations.goauthentik.io/platforms/microsoft-ws-federation/)
- [n8n](https://integrations.goauthentik.io/development/n8n/)
- [Nexterm](https://integrations.goauthentik.io/infrastructure/nexterm/) (Thanks to @Nerdy-Technician!)
- [NocoDB](https://integrations.goauthentik.io/development/nocodb/)
- [Notion](https://integrations.goauthentik.io/documentation/notion/)
- [Omnissa Workspace ONE Access](https://integrations.goauthentik.io/device-management/omnissa-workspace-one-access/) (Thanks to @nicedevil007!)
- [OpenCloud](https://integrations.goauthentik.io/chat-communication-collaboration/opencloud/)
- [OpenObserve](https://integrations.goauthentik.io/monitoring/openobserve/)
- [Personio](https://integrations.goauthentik.io/platforms/personio/) (Thanks to @nicedevil007!)
- [Plane](https://integrations.goauthentik.io/chat-communication-collaboration/plane/)
- [Productive](https://integrations.goauthentik.io/platforms/productive/)
- [SnapOtter](https://integrations.goauthentik.io/media/snapotter/)
- [Stirling PDF](https://integrations.goauthentik.io/documentation/stirling-pdf/)
- [ToolJet](https://integrations.goauthentik.io/platforms/tooljet/)
- [Veeam Backup & Replication](https://integrations.goauthentik.io/infrastructure/veeam-backup-replication/) (Thanks to @nicedevil007!)

## New source guides

The following source guides were recently added. A big thanks to our contributors!

- [GitLab](../../users-sources/sources/social-logins/gitlab/index.mdx) (Thanks to @4www!)
- [JumpCloud](../../users-sources/sources/social-logins/jumpcloud/index.mdx)

## Upgrading

This release does not introduce new configuration options, but it more strictly enforces trusted proxy configuration. Review the [breaking change](#forwarded-headers-are-now-restricted-to-trusted-proxies) before upgrading. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../../install-config/upgrade.mdx).

When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommend that you always upgrade any outposts at the same time you upgrade your authentik instance.

### Docker Compose

To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:

```shell
wget -O compose.yml https://goauthentik.io/version/2026.8/lifecycle/container/compose.yml
docker compose up -d
```

The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.

### Kubernetes

Upgrade the Helm Chart to the new version, using the following commands:

```shell
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2026.8
```

## Deprecations

### PostgreSQL custom connection options are deprecated

The `AUTHENTIK_POSTGRESQL__CONN_OPTIONS` and its replica equivalent are deprecated and will be removed in an upcoming version. It was never properly used and may cause future breakages. If you're looking for a specific usage, open an issue to discuss alternative solutions.

## Minor changes/fixes

- api: replace orjson with msgspec (#23528)
- blueprints Add `EQ` and `NEQ` modes to the `!Condition` tag (#20315)
- blueprints: emit draft-07 definitions instead of $defs (#24981)
- blueprints: fix ignoring hidden paths (#24222)
- blueprints: fix mismatched stage name in example 2fa login flow (#24668)
- blueprints: fix YAMLTag repr raising on unresolved tags (#23607)
- blueprints: handle invalid yaml, add dry run to `apply_blueprint` (#24813)
- blueprints: run initial migration before flows are created (#24880)
- brands: expose authenticated flags correct in current brand (#24577)
- brands: fix schema for current brand's flags (#24376)
- core, flows: drop maximum-scale=1 from viewport meta (#23261)
- core, internal, packages: fix British spellings flagged by cspell (#22819)
- core, web, docs: introduce base URL (#24159)
- core, web: Remove stale compatibility paths (#22192)
- core: Actors (#24353)
- core: add `admin_authenticated_session_deleted` signal for admin deleted session (#24434)
- core: add user switching (#22659)
- core: adjust label for clarity for `core_default_app_access` (#24326)
- core: Agent instructions. (#23363)
- core: align django-channels-postgres psycopg\[pool] floor with #22201 (#22363)
- core: cache S3 file storage clients (#23168)
- core: Defer status posts until GitHub Actions finishes. (#22340)
- core: delete all user sessions when user is deactivated (#25088)
- core: delete expired actor tokens (#24767)
- core: fix group source connection source object (#24626)
- core: fix object attributes not setting `allow_blank` (#24298)
- core: fix `user_type` check to correctly prevent `internal_service_account` (#23848)
- core: harden npm install against supply-chain attacks (#22245)
- core: make all m2m models explicit (#23315)
- core: object attributes - minor fixes (#24292)
- core: Object attributes (#21544)
- core: prompt securely when hashing passwords (#24126)
- core: return the intended status code from error views for all request methods (#24902)
- core: run debugpy within worker process so it's DAP-attachable again (#23401)
- core: scope user `path_startswith` filter to the path subtree (#25093)
- core: update psycopg\[pool] requirement from \<4,>=3 to >=3.3.4,\<4 (#22201)
- core: validate imported password hashes at the API boundary (#24130)
- core/groups: fix n+1 queries for list groups when `include_users=false` (#23216)
- crypto: cache parsed certificates and private keys across model instances (#24454)
- docs/social-logins: Add jumpcloud oidc and saml (#24048)
- endpoints: handle error in facts (#25028)
- endpoints/agent: fix Secure Enclave key dropped on first Platform SSO user registration (#24587)
- endpoints/agent: return 400 instead of 500 for invalid Platform SSO token requests (#24588)
- endpoints/connectors/agent: fix auth schema correctly (#24327)
- enterprise: fix `enterprise_test` skipping tests when used as class decorator (#24138)
- enterprise: simplify tests (#18404)
- enterprise/agents: add (#24598)
- enterprise/agents: fix enterprise required check for agents (#24814)
- enterprise/core: add scheduled user offboarding (#23624)
- enterprise/endpoints/connectors/agent: add `login_hint` to `auth_ia` (#25122)
- enterprise/endpoints/connectors/fleet: decrease page size (#24908)
- enterprise/endpoints/connectors/fleet: decrease page size (#24995)
- enterprise/endpoints/connectors/fleet: fix exception when host has no policies (#24355)
- enterprise/lifecycle: cleanup API (#23647)
- enterprise/providers/oauth2: dynamic client registration (#24225)
- enterprise/providers/ssf: log event user when sending SSF event (#24359)
- enterprise/providers/ws\_fed: add SAML 1.1 support (#23851)
- enterprise/requests: Add ability to request access (#24183)
- enterprise/requests: fix API schema for grant requests (#25111)
- enterprise/requests: integrate agents with requests (#24844)
- enterprise/requests: only show requests tab when usable (#24705)
- enterprise/requests: optimize db for requestable apps (#24984)
- enterprise/stages/source: configurable failure action (#24963)
- events: add missing webhook property mappers to slack webhook function (#17377)
- events: fix typo (#24161)
- events: migrate `top_per_user` to serializer for params (#23779)
- events: prevent migration changes when event actions modified (#24251)
- events: show account changes in user event history (#24323)
- fix release notes docker compose mention (#23386)
- flows: fix flow executor authentication with jwt (#16646)
- internal: Automated internal backport: CVE-2026-40165.sec.patch to authentik-main (#22298)
- internal: Automated internal backport: CVE-2026-40166.sec.patch to authentik-main (#22299)
- internal: Automated internal backport: CVE-2026-40172.sec.patch to authentik-main (#22300)
- internal: Automated internal backport: CVE-2026-41569.sec.patch to authentik-main (#22301)
- internal: Automated internal backport: CVE-2026-41577.sec.patch to authentik-main (#22302)
- internal: Automated internal backport: CVE-2026-42849.sec.patch to authentik-main (#22303)
- internal: Automated internal backport: GHSA-5wcc-hf24-rf5h.sec.patch to authentik-main (#22304)
- internal: Automated internal backport: GHSA-973w-j457-rp2m.sec.patch to authentik-main (#22305)
- internal: remove custom Vary header (#24078)
- internal/outpost/ak: handle empty outpost list during refresh (#23827)
- internal/outpost/ldap: remove Printf in MemberForGroup loop (#22952)
- lib: move ExpiringModel to lib from core (#24109)
- lib/evaluator: use lazy proxy for http session (#24893)
- lib/sync: add Sync base model for storing past sync history (#23184)
- lib/sync/outgoing: allow discovery to be deactivated (#24667)
- lifecycle: prevent version skipping upgrades (#24160)
- lifecycle/container: increase start time to 120s (#23896)
- outpost: grab log level from api config (#24459)
- outpost: retry API retrieval (#24483)
- outpost/proxy: fix envoy request routing (#24528)
- outpost/proxy: rewrite in rust (#21856)
- outpost/proxy: send X-Forwarded-Proto with the backchannel Host override so the token issuer matches (#24489)
- outposts/proxy: include query string in post-authentication redirect (#25043)
- packages: migrate shared pins to the pnpm catalog: protocol (#23784)
- packages/ak-axum: Correctly canonicalize IP when checking for trusted reverse proxy (#24479)
- packages/ak-axum: mark all unix requests as trusted (#24534)
- packages/ak-axum: re-add X-Forwarded-Host consideration (#24482)
- packages/ak-common/db: ignore empty passwords (#24127)
- packages/ak-common/db: truncate application name (#24552)
- packages/ak-common/tracing: make console subscriber optional (#24219)
- packages/django-dramatiq-postgres: minor fixes (#23181)
- packages/django-dramatiq-postgres/broker: chunked purge queryset (#25102)
- packages/django-postgres-dramatiq: add support for task dependencies (#23064)
- policies: list engine (#24174)
- policies: make policy bindings expire-able (#24116)
- providers/oauth: Logout remove static html (#23002)
- providers/oauth2: add support for ed448 (#24013)
- providers/oauth2: add token exchange targeting (#24874)
- providers/oauth2: automatically invalidate ProviderInfoView cached claims (#24944)
- providers/oauth2: cache ProviderInfoView `get_claims` (#24890)
- providers/oauth2: enforce VSCHAR for `client_id` and `client_secret` (#23760)
- providers/oauth2: fix `client_credentials` regression (#24900)
- providers/oauth2: fix dcr missing `csrf_exempt` (#24983)
- providers/oauth2: fix iframe logout stage progression (#23919)
- providers/oauth2: fix missing authorization event for oauth provider, add tests (#24819)
- providers/oauth2: fix token exchange provider lookup for actor/subject (#25110)
- providers/oauth2: move DCR to OSS (#24949)
- providers/oauth2: OpenID key binding support (#22590)
- providers/oauth2: optimize JWKS conversion (#24889)
- providers/oauth2: refactor token parsing logic (#24904)
- providers/oauth2: run invalidation flow for unauthenticated end-session requests (#23773)
- providers/oauth2: send back-channel logout requests when a user is deactivated (#24718)
- providers/oauth2: token exchange (#23900)
- providers/oauth2: token exchange delegation (#24356)
- providers/oauth2: ui/ux fixes around DCR (#24600)
- providers/radius: allow empty message authenticator (#25097)
- providers/saml: catch InvalidVersion from cryptography when parsing metadata (#21185)
- providers/saml: support authnrequest forceauthn flag (#22489)
- providers/scim: Add GitLab compatibility mode (#22906)
- providers/scim: fix display of SCIMRequestException (2026.8) (#24833)
- providers/scim: fix group membership removals (#25024)
- providers/scim: fix scim changed detection for nested attributes (#24332)
- providers/scim: ignore key casing in SCIM responses (#24441)
- providers/scim: rework discovery with pageSize (#24490)
- rbac: use constant-time comparison in SecretKeyFilter (#24888)
- root, web, docs, packages/\*-config: Fix pnpm symlinks, version ranges (#23592)
- root, web, docs: Update pnpm to 11.9.0 (#23582)
- root: add .nvmrc (#24440)
- root: Add .nvmrc to CODEOWNERS (#24444)
- root: add a pnpm catalog drift lint + config cleanup (#23781)
- root: add optional pyroscope for profiling (#24887)
- root: assign packages/theme to @goauthentik/frontend (#23344)
- root: avoid looping indefinitely on embedded outpost start (#24553)
- root: avoid looping indefinitely on embedded outpost start (take 2) (#24824)
- root: bind-mount .npmrc into Dockerfile npm ci stages (#22462)
- root: bump requests & fix double slash (#23501)
- root: bump version to 2026.8.0-rc1 (#22167)
- root: don't fail fast cspell (#24223)
- root: don't include debug info for rust release profile (#24664)
- root: fix "make gen" failing with "the input device is not a TTY" (#23546)
- root: fix agents test instructions (#24119)
- root: fix CODEOWNERS paths (#24259)
- root: fix context processor name (#24421)
- root: fix docker compose pg volume path for compatibility with pg18 (#23883)
- root: fix fast shutdown log message (#24565)
- root: fix schema and API clients (#22735)
- root: flag British spellings in cspell (#22821)
- root: gitignore release generation artifacts (#22549)
- root: Ignore local cached TypeScript build info. (#24579)
- root: in-process per-IP rate throttle (#23015)
- root: limit request body size (#24666)
- root: make clippy run on all targets (#24551)
- root: make tests run when running make all (#22186)
- root: move server and worker healthcheck to rust (#23556)
- root: pin pnpm 11.20.0 everywhere (#24789)
- root: PostgreSQL direct-endpoint support for LISTEN/NOTIFY and advisory locks (#23013)
- root: Replace (npm + Corepack) with pnpm (#22830)
- root: rewrite server in rust (#24320)
- root: Update CODEOWNERS for spellcheck dictionaries (#22408)
- root: update gen-changelog to filter unnecessary commits (#22550)
- root: Update PR template (#22185)
- source/oauth: add cas source integration (#24737)
- sources/ldap: derive TLS SNI name from hostname, not full server URI (#22456)
- sources/ldap: implement nested group parentship sync (#19069)
- sources/oauth: allow long authorization URLs on OAuth sources (#24132)
- sources/oauth: Fallback to `id` field when `sub` is missing in OIDC callback (#22672)
- sources/oauth: prevent requests being made to disabled oauth social sources (#23822)
- sources/oauth: support email retrieval for Twitter login (#20468)
- sources/saml: add audience override field for SAML sources (#25029)
- sources/saml: fix issuer generation and change to `issuer_override` (#22177)
- sources/saml: fix `issuer_override` default (#24221)
- sources/telegram: restore `next=` redirect after `pre_authentication_flow` (#22762)
- stages/authenticator\_duo: clarify duplicate Duo user enrollment (#23588)
- stages/authenticator\_validate: fix intermittently failing throttling test (#24568)
- stages/authenticator\_validate: skip flaky test (#24554)
- stages/authenticator\_webauthn: remove prevent\_duplicate\_devices (#24450)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#22772)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#23562)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#24039)
- stages/authenticator\_webauthn: Update FIDO MDS3 & Passkey aaguid blobs (#24487)
- stages/authenticator: protect devices from stage deletion (#24324)
- stages/captcha: add Cap and JSON verification support (#22373)
- stages/captcha: fix hcaptcha height (#20901)
- stages/email: fix `test_email` ignoring the given stage (#25166)
- stages/user\_login: refuse to log in an unsaved pending user (#21691)
- stages/user\_write: only write user when data changes (#24158)
- tasks: aggregate status from logs instead of legacy field (#24792)
- tasks: ignore integrity error on tasklog insertion (#23178)
- tests: add security regression tests for OAuth JWT-bearer and flow session handling (#23190)
- tests/e2e: bump endpoints version in e2e test container (#22704)
- tests/e2e: bump selenium and ak-agent to fix endpoint tests (#22942)
- tests/openid\_conformance: Add more conformance coverage (#22174)
- Update SAML configuration for SonarQube integration (#23220)
- web, docs, packages/\*: Fix pnpm Workspace Catalogs (#23944)
- web, locale: Normalize legacy locale file names (#24024)
- web, packages/geo, server/static: Air Gapped Maps Merge Branch (#24254)
- web: add build start/end log to build script (#24296)
- web: add grid/list view toggle to user application library (#22132)
- web: break preformatted desc list elements (#20372)
- web: contain long text in tables and application cards (#24621)
- web: decode lit-localize over-escaped entities across all localized strings (#23264)
- web: exclude dependabot-materialized link deps from workspace glob (#24297)
- web: fix British spellings flagged by cspell (#22820)
- web: Fix `content_left`/`content_right` layouts. (#25025)
- web: fix email angle brackets rendering as HTML entities in localized UI (#23262)
- web: fix file search input interactions (#24609)
- web: Fix issue where 0 value is not preserved. (#24460)
- web: Fix mangled nested CSS in compatibility mode. (#25053)
- web: Flesh out frontend, E2E, agent instructions. (#22388)
- web: hide plain action icons while loading (#24618)
- web: improve base url helper text (#24455)
- web: improve user header at intermediate widths (#24608)
- web: migrate brand assets to npm pkg (#22361)
- web: Recovery Token CSS Safe Mode (#23152)
- web: remove orphaned chromedriver dependency (#22251)
- web: rework ak-search-select dropdown as an anchored popover (retire ak-portal) (#24104)
- web/admin: better table filter (#24368)
- web/admin: drop misleading delete consequences from user activation review (#24273)
- web/admin: enterprise status card properties (#24170)
- web/admin: fix alignment of task list filters (#24752)
- web/admin: fix leftover toggles in tables (#24436)
- web/admin: fix missing preview banner for object attributes (#24982)
- web/admin: hide previous loglist when no previous logs available (#23954)
- web/admin: maint/clean ldap source connectivity (#22941)
- web/admin: QOL: Add "Expiring in `n` days" and "Expiring today" notices to LicenseStatusCard (#24300)
- web/admin: refactor user detail page layout (#23578)
- web/admin: ui fixes for requests (#24458)
- web/admin/stages/captcha: fix float values in score thresholds fix provider parsing (#22782)
- web/bug: fix regex recursion error in compatibility mode (#22338)
- web/bug: harmonize and make routine the display of schedules, part 2: Description lists (#23856)
- web/bug: harmonize and make routine the display of tasks (part 2: description list abuse) (#23839)
- web/bug: harmonize and make routine the display of tasks (part 3: problem children) (#23840)
- web/bug: harmonize and make routine the display of tasks (part 4: schedule-list cards) (#23855)
- web/bug: harmonize and make routine the display of tasks (part 6: sch… (#23859)
- web/bug/22387 device user bindings failing (#23042)
- web/cleanup/dedupe default config (#23622)
- web/cleanup/there is no memo (#23641)
- web/common: allow line-break in dom-purify (#24755)
- web/components: update styling for user account switcher (#24749)
- web/css: de-dupe and simplify CSS customizations (#23195)
- web/css: enabling layers, part 3: vendoring (#23366)
- web/css/enabling layers 2 (#23265)
- web/dependencies: move the sync components into the components folder. (#22242)
- web/dependency: move the notifications components into the components folder (#22241)
- web/doc: add documentation and wc-analyzer tags to ak-secret-text-input (#23134)
- web/elements: Add location to sessions (#24422)
- web/elements: add past-tense submitted formatter to Form (#23041)
- web/elements: extract mermaid runtime, modernize `<ak-diagram>` (#22980)
- web/elements: fix prioritization in form serialization for dotted input-fields (#24987)
- web/elements: key the message list so stacked toasts don't share state (#24361)
- web/elements: P5 Drawer component with all capabilities (#21545)
- web/elements: update the progress bar (#24134)
- web/elements/ak-dual-select: fix inverted pagination arrow colors in dark theme (#22608)
- web/enterprise: add UI for pending offboardings (#24266)
- web/fix: clarify some secrets remain secret (#23132)
- web/flows: Add new flow background image (#24511)
- web/flows: fix missing required flag on password input (#24831)
- web/flows: fix untranslated user field labels in identification stage (#23518)
- web/maint: harmonize and make routine the display of tasks (part 1: cards) (#23837)
- web/maint: Put API-aware status indicators in `components`; fix missing state (#22936)
- web/maint: upgrade ak-divider (#24082)
- web/maint: upgrade ak-toggle-group (#24038)
- web/maint/dependency: maint 1 (#22506)
- web/maintenance: bump Typescript compiler to version 7 (#22172)
- web/maintenance: eliminate the need for `DEFAULT_CONFIG` boilerplate everywhere (#22892)
- web/maintenance: Replace routine form endpoints (#23554)
- web/maintenance/explicit model endpoints (#22897)
- web/tests: fix `strict mode` issues in two tests (#23339)
- web/user: fix request access URL from agent not working (#25113)
- web/xliff: fix zh-Hans translation (#24512)
- worker: fix healthcheck paths (#24481)

## Fixed in 2026.8.1

- core/sources: forward kwargs when updating an existing connection (#25204)
- core/sources: reuse group property mapping manager across groups (#24699)
- core: add user type-active-username index (#25223)
- core: declare `authorization_flow and invalidation_flow` as nullable in root provider list (#25243)
- core: set days=1 as default token duration for new installs (#25341)
- crypto: don't dispatch discovery if one is queued (#25483)
- endpoints/connectors: fix integrity error when device with same name exists already (#25237)
- lib/expression: fix policy request context pollution (#25462)
- lib/expression: use literal fallback in `ak_obj_attr` (#25414)
- outpost/event: fix websocket connection with `AUTHENTIK_INSECURE=true` (#25472)
- outpost/proxy: avoid breaking header parsing in non-compliant backends (#25439)
- outpost/proxy: fix double host sent on token introspection (#25234)
- outposts: fix docker controller for proxy outpost (#25353)
- packages/ak-axum: extract the rightmost untrusted IP from X-Forwarded-For (#25397)
- providers/saml: remove redundant backchannel logout call (#25086)
- root: SECURITY.md vulnerability reporting channel (#25365)
- root: update SECURITY.md supported versions (#25351)
- server/core: handle unsupported HTTP method (#22498)
- server/core: relay negotiated websocket subprotocol and stop offering extensions upstream (#25487)
- sources/ldap/freeipa: handle list-valued krbLastPwdChange (#20600)
- sources/oauth: cover object group property mappings (#25195)
- sources: don't 500 on an object-shaped `groups` claim (#25208)
- stages/identification: dynamic captcha keys when stage embedded in identification stage (#24079)
- stages/identification: only join Source subtypes that can render a login button (#25238)
- tenants: fix base URL validation rejecting internal hostnames (#25560)
- web/admin/events: Allow selecting public cert only on transport form verification (#24771)
- web/elements/table: show scrollbar instead of overflowing off the page (#25232)
- web/user: fix missing enterprise check on agents tab in user interface (#25371)
- web: Auto focus password field after login error. (#25026)
- web: Fix Sentry Initialization (#25450)
- web: Fix imports when in compatibility mode. (#25526)
- web: Fix issues surrounding text field focus behavior. (#25159)
- web: keep sticky form actions below nav menus (#25336)
- web: keep the search-select dropdown inside its modal (#24812)

## Fixed in 2026.8.2

- core: explicitly check `is_active` in auth backends (#25729)
- core: fix bulk session revocation (#25816)
- lib: avoid DNS resolution in `fqdn_rand` (#25728)
- lib/expression: fix PickleError due to resolver match when using `ak_call_policy` (#25763)
- lifecycle: fix server prometheus metrics getting registered early with pid instead of worker ID (#25883)
- packages/django-dramatiq-postgres: prevent crashing consumer thread on schedules with unknown actors (#25656)
- rbac: guard for non-existent object in object permission API (#25601)
- security: automated internal backport of patch 1751-secrets-read-permission.sec.patch to authentik-2026.8 (#25965)
- security: automated internal backport of patch 1877-group-hierarchy-roles.sec.patch to authentik-2026.8 (#25966)
- security: automated internal backport of patch 1914-saml.sec.patch to authentik-2026.8 (#25967)
- security: automated internal backport of patch 2032-authenticator-email-recipient-override.sec.patch to authentik-2026.8 (#25968)
- security: automated internal backport of patch 2190-libxml2-doctype.sec.patch to authentik-2026.8 (#25969)
- tenants/settings: fix `flags` response (#25616)
- web/admin: align command palette navigation with sidebar (#25732)
- web/admin: fix schedule form (#25778)
- web/admin: oauth provider: explain what happens when no signing key is selected (#25756)
- web: fix switches in table toolbars (#25730)
- web: preserve custom event action labels (#25655)
- web: show pre-selected value in paginated search-selects (#25609)

## Fixed in 2026.8.3

- admin/files: make file search case-insensitive (#25736)
- api: include JSON field relation models in search autocomplete (#26153)
- blueprints: fix `employee_department` typo (#26046)
- change docker compose to compose (#26087)
- core: fix migrations (version-2026.8) (cherry-pick #26208) (#26209)
- events: Note in logs when an agent makes a call (#26146)
- flows: strip `login_hint` from next on cancel to prevent loop (#26111)
- outposts: refresh sessions when impersonation changes (#26086)
- packages/ak-axum/extract/client\_ip: support X-Forwarded-For with ports (#25682)
- policies: fix policybinding cache invalidation (#25989)
- providers/ldap: fix memory leak in the cached searcher (#26028)
- providers/oauth: handle token exchange when no signing key is set (#26049)
- providers/oauth2: only expose URL-based avatars as picture claim (#26080)
- root: document CNA in SECURITY.md (#26124)
- root: fix metric gauges for multiprocessor mode (#25882)
- server: preserve websocket close code when proxying to outposts (#26090)
- sources/saml: Register ID attributes (#25706)
- web/flows: fix hardcoded locale in identification stage's `OR_LIST_FORMATTERS` (#26017)
- web/scim: Add gitlab compatibility option to form (#26154)

## API Changes

### authentik (v 2026.8.3)

**Notice**: There are breaking changes with authentik v 2026.5

***

#### What's New

***

##### `GET` /agents/agents/

##### `POST` /agents/agents/

##### `GET` /agents/agents/\{id}/

##### `PUT` /agents/agents/\{id}/

##### `DELETE` /agents/agents/\{id}/

##### `PATCH` /agents/agents/\{id}/

##### `GET` /core/application\_entitlements/requestable/

##### `GET` /core/applications/requestable/

##### `GET` /core/object\_attributes/

##### `POST` /core/object\_attributes/

##### `GET` /core/object\_attributes/\{attribute\_id}/

##### `PUT` /core/object\_attributes/\{attribute\_id}/

##### `DELETE` /core/object\_attributes/\{attribute\_id}/

##### `PATCH` /core/object\_attributes/\{attribute\_id}/

##### `POST` /core/users/switch/

##### `GET` /lifecycle/user\_offboarding/

##### `POST` /lifecycle/user\_offboarding/

##### `GET` /lifecycle/user\_offboarding/\{id}/

##### `DELETE` /lifecycle/user\_offboarding/\{id}/

##### `GET` /providers/oauth2-dcr/

##### `POST` /providers/oauth2-dcr/

##### `GET` /providers/oauth2-dcr/\{pbm\_uuid}/

##### `PUT` /providers/oauth2-dcr/\{pbm\_uuid}/

##### `DELETE` /providers/oauth2-dcr/\{pbm\_uuid}/

##### `PATCH` /providers/oauth2-dcr/\{pbm\_uuid}/

##### `GET` /requests/grant-requests/

##### `POST` /requests/grant-requests/

##### `GET` /requests/grant-requests/\{uuid}/

##### `DELETE` /requests/grant-requests/\{uuid}/

##### `PATCH` /requests/grant-requests/\{uuid}/fulfill/

##### `DELETE` /requests/grant-requests/\{uuid}/revoke/

##### `POST` /requests/grant-requests/agent/

##### `GET` /requests/grant-requests/pending\_review/

##### `GET` /requests/rule-bindings/

##### `POST` /requests/rule-bindings/

##### `GET` /requests/rule-bindings/\{uuid}/

##### `PUT` /requests/rule-bindings/\{uuid}/

##### `DELETE` /requests/rule-bindings/\{uuid}/

##### `PATCH` /requests/rule-bindings/\{uuid}/

##### `GET` /requests/rule-bindings/\{uuid}/used\_by/

##### `GET` /requests/rule-child-bindings/

##### `POST` /requests/rule-child-bindings/

##### `GET` /requests/rule-child-bindings/\{uuid}/

##### `PUT` /requests/rule-child-bindings/\{uuid}/

##### `DELETE` /requests/rule-child-bindings/\{uuid}/

##### `PATCH` /requests/rule-child-bindings/\{uuid}/

##### `GET` /requests/rule-child-bindings/\{uuid}/used\_by/

##### `GET` /requests/rules/

##### `POST` /requests/rules/

##### `GET` /requests/rules/\{uuid}/

##### `PUT` /requests/rules/\{uuid}/

##### `DELETE` /requests/rules/\{uuid}/

##### `PATCH` /requests/rules/\{uuid}/

##### `GET` /requests/rules/\{uuid}/used\_by/

#### What's Changed

***

##### `GET` /admin/models/

###### Parameters:

Added: `filter_has_attributes` in `query`

##### `GET` /admin/settings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `base_url` (string)

    > Configure the base URL under which this authentik instance is reachable, e.g. [https://authentik.company](https://authentik.company)

  - Changed property `flags` (object)
    - Changed property `core_default_app_access` (boolean)
      > Applications with no policies bound can be accessed by any user.

##### `PUT` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `base_url` (string)

  > Configure the base URL under which this authentik instance is reachable, e.g. [https://authentik.company](https://authentik.company)

- Changed property `flags` (object)
  - Changed property `core_default_app_access` (boolean)
    > Applications with no policies bound can be accessed by any user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `base_url` (string)

    > Configure the base URL under which this authentik instance is reachable, e.g. [https://authentik.company](https://authentik.company)

  - Changed property `flags` (object)
    - Changed property `core_default_app_access` (boolean)
      > Applications with no policies bound can be accessed by any user.

##### `PATCH` /admin/settings/

###### Request:

Changed content type : `application/json`

- Added property `base_url` (string)

  > Configure the base URL under which this authentik instance is reachable, e.g. [https://authentik.company](https://authentik.company)

- Changed property `flags` (object)
  - Changed property `core_default_app_access` (boolean)
    > Applications with no policies bound can be accessed by any user.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `base_url` (string)

    > Configure the base URL under which this authentik instance is reachable, e.g. [https://authentik.company](https://authentik.company)

  - Changed property `flags` (object)
    - Changed property `core_default_app_access` (boolean)
      > Applications with no policies bound can be accessed by any user.

##### `GET` /admin/system/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `base_url`

  * Added property `base_url` (string)
    > Configured external base URL. Can be empty

##### `POST` /admin/system/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `base_url`

  * Added property `base_url` (string)
    > Configured external base URL. Can be empty

##### `GET` /core/brands/\{brand\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `branding_map_tiles` (string)

    > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

  - Added property `flow_user_switch` (string)

  - Added property `flow_request` (string)

##### `PUT` /core/brands/\{brand\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `branding_map_tiles` (string)

  > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

- Added property `flow_user_switch` (string)

- Added property `flow_request` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `branding_map_tiles` (string)

    > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

  - Added property `flow_user_switch` (string)

  - Added property `flow_request` (string)

##### `PATCH` /core/brands/\{brand\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `branding_map_tiles` (string)

  > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

- Added property `flow_user_switch` (string)

- Added property `flow_request` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `branding_map_tiles` (string)

    > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

  - Added property `flow_user_switch` (string)

  - Added property `flow_request` (string)

##### `POST` /core/users/export/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `content_type` (object)

    New required properties:

    - `fully_qualified_model`

    * Added property `fully_qualified_model` (string)

##### `POST` /endpoints/agents/connectors/auth\_ia/

###### Parameters:

Added: `login_hint` in `query`

##### `GET` /endpoints/device\_bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `PUT` /endpoints/device\_bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `PATCH` /endpoints/device\_bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `POST` /events/events/export/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `content_type` (object)

    New required properties:

    - `fully_qualified_model`

    * Added property `fully_qualified_model` (string)

##### `GET` /events/events/stats/

###### Parameters:

Changed: `actions` in `query`

##### `GET` /events/events/top\_per\_user/

###### Parameters:

Added: `actions` in `query`

Added: `brand_name` in `query`

> Brand name

Added: `client_ip` in `query`

Added: `context_authorized_app` in `query`

> Context Authorized application

Added: `context_device` in `query`

> Context Device Primary Key

Added: `context_model_app` in `query`

> Context Model App

Added: `context_model_name` in `query`

> Context Model Name

Added: `context_model_pk` in `query`

> Context Model Primary Key

Added: `ordering` in `query`

> Which field to use when ordering the results.

Added: `search` in `query`

> A search term.

Added: `username` in `query`

> Username

Changed: `top_n` in `query`

##### `POST` /lifecycle/reviews/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `reviewer` (object)

    > Partial User Serializer, does not include child relations.

    New required properties:

    - `uid`

    New optional properties:

    - `uuid`

    * Added property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    * Added property `last_login` (string)

    * Added property `email` (string)

    * Added property `attributes` (object)

    * Added property `uid` (string)

    * Deleted property `uuid` (string)

##### `GET` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `PUT` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `PATCH` /policies/bindings/\{policy\_binding\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `GET` /policies/event\_matcher/\{policy\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.agents`
    - `authentik.enterprise.requests`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_core.objectattribute`
    - `authentik_core.actor`
    - `authentik_providers_oauth2.oauth2dynamicclientregistration`
    - `authentik_agents.agent`
    - `authentik_lifecycle.useroffboarding`
    - `authentik_requests.requestrulechildbinding`
    - `authentik_requests.requestrulebinding`
    - `authentik_requests.requestrule`
    - `authentik_requests.grantrequest`

##### `PUT` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

  > Match created events with this action type. When left empty, all action types will be matched.

  Added enum values:

  - `user_offboarded`
  - `access_request_created`
  - `access_request_approved`
  - `access_request_denied`
  - `access_request_revoked`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.enterprise.agents`
  - `authentik.enterprise.requests`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_core.objectattribute`
  - `authentik_core.actor`
  - `authentik_providers_oauth2.oauth2dynamicclientregistration`
  - `authentik_agents.agent`
  - `authentik_lifecycle.useroffboarding`
  - `authentik_requests.requestrulechildbinding`
  - `authentik_requests.requestrulebinding`
  - `authentik_requests.requestrule`
  - `authentik_requests.grantrequest`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.agents`
    - `authentik.enterprise.requests`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_core.objectattribute`
    - `authentik_core.actor`
    - `authentik_providers_oauth2.oauth2dynamicclientregistration`
    - `authentik_agents.agent`
    - `authentik_lifecycle.useroffboarding`
    - `authentik_requests.requestrulechildbinding`
    - `authentik_requests.requestrulebinding`
    - `authentik_requests.requestrule`
    - `authentik_requests.grantrequest`

##### `PATCH` /policies/event\_matcher/\{policy\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

  > Match created events with this action type. When left empty, all action types will be matched.

  Added enum values:

  - `user_offboarded`
  - `access_request_created`
  - `access_request_approved`
  - `access_request_denied`
  - `access_request_revoked`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.enterprise.agents`
  - `authentik.enterprise.requests`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_core.objectattribute`
  - `authentik_core.actor`
  - `authentik_providers_oauth2.oauth2dynamicclientregistration`
  - `authentik_agents.agent`
  - `authentik_lifecycle.useroffboarding`
  - `authentik_requests.requestrulechildbinding`
  - `authentik_requests.requestrulebinding`
  - `authentik_requests.requestrule`
  - `authentik_requests.grantrequest`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.agents`
    - `authentik.enterprise.requests`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_core.objectattribute`
    - `authentik_core.actor`
    - `authentik_providers_oauth2.oauth2dynamicclientregistration`
    - `authentik_agents.agent`
    - `authentik_lifecycle.useroffboarding`
    - `authentik_requests.requestrulechildbinding`
    - `authentik_requests.requestrulebinding`
    - `authentik_requests.requestrule`
    - `authentik_requests.grantrequest`

##### `GET` /providers/all/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New optional properties:

  - `authorization_flow`
  - `invalidation_flow`

  * Changed property `authorization_flow` (string)

    > Flow used when authorizing this provider.

  * Changed property `invalidation_flow` (string)
    > Flow used ending the session from a provider.

##### `GET` /providers/oauth2/\{id}/setup\_urls/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `dcr_registration`

  * Added property `dcr_registration` (string)

##### `GET` /reports/exports/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `content_type` (object)

    New required properties:

    - `fully_qualified_model`

    * Added property `fully_qualified_model` (string)

##### `GET` /tasks/schedules/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_task_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `PUT` /tasks/schedules/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_task_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `PATCH` /tasks/schedules/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_task_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `pbm_uuid`

  * Added property `pbm_uuid` (string)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  * Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `pbm_uuid`

  * Added property `pbm_uuid` (string)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  * Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /core/applications/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `pbm_uuid`

  * Added property `pbm_uuid` (string)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  * Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /core/brands/

###### Request:

Changed content type : `application/json`

- Added property `branding_map_tiles` (string)

  > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

- Added property `flow_user_switch` (string)

- Added property `flow_request` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `branding_map_tiles` (string)

    > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

  - Added property `flow_user_switch` (string)

  - Added property `flow_request` (string)

##### `GET` /core/brands/

###### Parameters:

Added: `flow_request` in `query`

Added: `flow_user_switch` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Brand Serializer

    - Added property `branding_map_tiles` (string)

      > URL template for the vector tile source used by the events map. Supports XYZ templates with \{z}, \{x} and \{y} placeholders, or pmtiles\:// archive URLs. When empty, the frontend uses the bundled hexworld basemap. This value is part of the brand information served to unauthenticated clients; do not embed API keys or other credentials in it.

    - Added property `flow_user_switch` (string)

    - Added property `flow_request` (string)

##### `GET` /core/brands/current/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `branding_map_tiles`

  * Added property `branding_map_tiles` (string)

  * Added property `flow_user_switch` (string)

  * Added property `flow_request` (string)

##### `GET` /endpoints/agents/connectors/agent\_config/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `system_config` (object)

    > Serialize authentik Config into DRF Object

    - Changed property `capabilities` (array)

      Changed items (string):

      Added enum values:

      - `can_request`
      - `can_agent_self_service`

##### `POST` /endpoints/agents/psso/register/user/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `is_current`

  * Added property `is_current` (boolean)
    > Return whether this user owns the current browser session.

##### `POST` /endpoints/device\_bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `GET` /endpoints/device\_bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    New required properties:

    - `expires`
    - `expiring`

    * Added property `expires` (string)

    * Added property `expiring` (boolean)

##### `GET` /events/events/\{event\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

##### `PUT` /events/events/\{event\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

  Added enum values:

  - `user_offboarded`
  - `access_request_created`
  - `access_request_approved`
  - `access_request_denied`
  - `access_request_revoked`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

##### `PATCH` /events/events/\{event\_uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

  Added enum values:

  - `user_offboarded`
  - `access_request_created`
  - `access_request_approved`
  - `access_request_denied`
  - `access_request_revoked`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

##### `GET` /events/events/volume/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Count of events of action created on day for a single event action

  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

##### `POST` /lifecycle/iterations/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `reviews` (array)

    Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

    - Changed property `reviewer` (object)

      > Partial User Serializer, does not include child relations.

      New required properties:

      - `uid`

      New optional properties:

      - `uuid`

      * Added property `is_active` (boolean)

        > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

      * Added property `last_login` (string)

      * Added property `email` (string)

      * Added property `attributes` (object)

      * Added property `uid` (string)

      * Deleted property `uuid` (string)

  - Changed property `rule` (object)

    > Mixin to validate that a valid enterprise license
    > exists before allowing to save the object

    - Changed property `reviewer_groups` (array)

      Changed items (object): > Partial Group Serializer, does not include child relations.

      New required properties:

      - `num_pk`

      * Added property `num_pk` (integer)

        > Get a numerical, int32 ID for the group

      * Added property `is_superuser` (boolean)

        > Users added to this group will be superusers.

      * Added property `attributes` (object)

    - Changed property `reviewers` (array)

      Changed items (object): > Partial User Serializer, does not include child relations.

      New required properties:

      - `uid`

      New optional properties:

      - `uuid`

      * Added property `is_active` (boolean)

        > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

      * Added property `last_login` (string)

      * Added property `email` (string)

      * Added property `attributes` (object)

      * Added property `uid` (string)

      * Deleted property `uuid` (string)

##### `GET` /lifecycle/iterations/latest/\{content\_type}/\{object\_id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

  - Changed property `reviews` (array)

    Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

    - Changed property `reviewer` (object)

      > Partial User Serializer, does not include child relations.

      New required properties:

      - `uid`

      New optional properties:

      - `uuid`

      * Added property `is_active` (boolean)

        > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

      * Added property `last_login` (string)

      * Added property `email` (string)

      * Added property `attributes` (object)

      * Added property `uid` (string)

      * Deleted property `uuid` (string)

  - Changed property `rule` (object)

    > Mixin to validate that a valid enterprise license
    > exists before allowing to save the object

    - Changed property `reviewer_groups` (array)

      Changed items (object): > Partial Group Serializer, does not include child relations.

      New required properties:

      - `num_pk`

      * Added property `num_pk` (integer)

        > Get a numerical, int32 ID for the group

      * Added property `is_superuser` (boolean)

        > Users added to this group will be superusers.

      * Added property `attributes` (object)

    - Changed property `reviewers` (array)

      Changed items (object): > Partial User Serializer, does not include child relations.

      New required properties:

      - `uid`

      New optional properties:

      - `uuid`

      * Added property `is_active` (boolean)

        > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

      * Added property `last_login` (string)

      * Added property `email` (string)

      * Added property `attributes` (object)

      * Added property `uid` (string)

      * Deleted property `uuid` (string)

##### `GET` /lifecycle/rules/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `reviewer_groups_obj` (array)

    Changed items (object): > Partial Group Serializer, does not include child relations.

    New required properties:

    - `num_pk`

    * Added property `num_pk` (integer)

      > Get a numerical, int32 ID for the group

    * Added property `is_superuser` (boolean)

      > Users added to this group will be superusers.

    * Added property `attributes` (object)

  - Changed property `reviewers_obj` (array)

    Changed items (object): > Partial User Serializer, does not include child relations.

    New required properties:

    - `uid`

    New optional properties:

    - `uuid`

    * Added property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    * Added property `last_login` (string)

    * Added property `email` (string)

    * Added property `attributes` (object)

    * Added property `uid` (string)

    * Deleted property `uuid` (string)

##### `PUT` /lifecycle/rules/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `reviewer_groups_obj` (array)

    Changed items (object): > Partial Group Serializer, does not include child relations.

    New required properties:

    - `num_pk`

    * Added property `num_pk` (integer)

      > Get a numerical, int32 ID for the group

    * Added property `is_superuser` (boolean)

      > Users added to this group will be superusers.

    * Added property `attributes` (object)

  - Changed property `reviewers_obj` (array)

    Changed items (object): > Partial User Serializer, does not include child relations.

    New required properties:

    - `uid`

    New optional properties:

    - `uuid`

    * Added property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    * Added property `last_login` (string)

    * Added property `email` (string)

    * Added property `attributes` (object)

    * Added property `uid` (string)

    * Deleted property `uuid` (string)

##### `PATCH` /lifecycle/rules/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `reviewer_groups_obj` (array)

    Changed items (object): > Partial Group Serializer, does not include child relations.

    New required properties:

    - `num_pk`

    * Added property `num_pk` (integer)

      > Get a numerical, int32 ID for the group

    * Added property `is_superuser` (boolean)

      > Users added to this group will be superusers.

    * Added property `attributes` (object)

  - Changed property `reviewers_obj` (array)

    Changed items (object): > Partial User Serializer, does not include child relations.

    New required properties:

    - `uid`

    New optional properties:

    - `uuid`

    * Added property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    * Added property `last_login` (string)

    * Added property `email` (string)

    * Added property `attributes` (object)

    * Added property `uid` (string)

    * Deleted property `uuid` (string)

##### `GET` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /outposts/instances/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /policies/bindings/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `expires`
  - `expiring`

  * Added property `expires` (string)

  * Added property `expiring` (boolean)

##### `GET` /policies/bindings/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > PolicyBinding Serializer

    New required properties:

    - `expires`
    - `expiring`

    * Added property `expires` (string)

    * Added property `expiring` (boolean)

##### `POST` /policies/event\_matcher/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

  > Match created events with this action type. When left empty, all action types will be matched.

  Added enum values:

  - `user_offboarded`
  - `access_request_created`
  - `access_request_approved`
  - `access_request_denied`
  - `access_request_revoked`

- Changed property `app` (string)

  > Match events created by selected application. When left empty, all applications are matched.

  Added enum values:

  - `authentik.enterprise.agents`
  - `authentik.enterprise.requests`

- Changed property `model` (string)

  > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

  Added enum values:

  - `authentik_core.objectattribute`
  - `authentik_core.actor`
  - `authentik_providers_oauth2.oauth2dynamicclientregistration`
  - `authentik_agents.agent`
  - `authentik_lifecycle.useroffboarding`
  - `authentik_requests.requestrulechildbinding`
  - `authentik_requests.requestrulebinding`
  - `authentik_requests.requestrule`
  - `authentik_requests.grantrequest`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `action` (string)

    > Match created events with this action type. When left empty, all action types will be matched.

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

  - Changed property `app` (string)

    > Match events created by selected application. When left empty, all applications are matched.

    Added enum values:

    - `authentik.enterprise.agents`
    - `authentik.enterprise.requests`

  - Changed property `model` (string)

    > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

    Added enum values:

    - `authentik_core.objectattribute`
    - `authentik_core.actor`
    - `authentik_providers_oauth2.oauth2dynamicclientregistration`
    - `authentik_agents.agent`
    - `authentik_lifecycle.useroffboarding`
    - `authentik_requests.requestrulechildbinding`
    - `authentik_requests.requestrulebinding`
    - `authentik_requests.requestrule`
    - `authentik_requests.grantrequest`

##### `GET` /policies/event\_matcher/

###### Parameters:

Changed: `action` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Matcher Policy Serializer

    - Changed property `action` (string)

      > Match created events with this action type. When left empty, all action types will be matched.

      Added enum values:

      - `user_offboarded`
      - `access_request_created`
      - `access_request_approved`
      - `access_request_denied`
      - `access_request_revoked`

    - Changed property `app` (string)

      > Match events created by selected application. When left empty, all applications are matched.

      Added enum values:

      - `authentik.enterprise.agents`
      - `authentik.enterprise.requests`

    - Changed property `model` (string)

      > Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.

      Added enum values:

      - `authentik_core.objectattribute`
      - `authentik_core.actor`
      - `authentik_providers_oauth2.oauth2dynamicclientregistration`
      - `authentik_agents.agent`
      - `authentik_lifecycle.useroffboarding`
      - `authentik_requests.requestrulechildbinding`
      - `authentik_requests.requestrulebinding`
      - `authentik_requests.requestrule`
      - `authentik_requests.grantrequest`

##### `GET` /providers/all/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /providers/google\_workspace/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `PUT` /providers/google\_workspace/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)
  > When enabled, authentik will attempt to discover existing resources in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `PATCH` /providers/google\_workspace/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)
  > When enabled, authentik will attempt to discover existing resources in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `GET` /providers/google\_workspace/\{id}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_sync_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /providers/microsoft\_entra/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `PUT` /providers/microsoft\_entra/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)
  > When enabled, authentik will attempt to discover existing resources in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `PATCH` /providers/microsoft\_entra/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)
  > When enabled, authentik will attempt to discover existing resources in the remote system.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `GET` /providers/microsoft\_entra/\{id}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_sync_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /providers/scim/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)

    > When enabled, authentik will attempt to discover existing resources in the remote system.

  - Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum value:

    - `gitlab`

##### `PUT` /providers/scim/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)

  > When enabled, authentik will attempt to discover existing resources in the remote system.

- Changed property `compatibility_mode` (string)

  > Alter authentik behavior for vendor-specific SCIM implementations.

  Added enum value:

  - `gitlab`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)

    > When enabled, authentik will attempt to discover existing resources in the remote system.

  - Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum value:

    - `gitlab`

##### `PATCH` /providers/scim/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)

  > When enabled, authentik will attempt to discover existing resources in the remote system.

- Changed property `compatibility_mode` (string)

  > Alter authentik behavior for vendor-specific SCIM implementations.

  Added enum value:

  - `gitlab`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)

    > When enabled, authentik will attempt to discover existing resources in the remote system.

  - Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum value:

    - `gitlab`

##### `GET` /providers/scim/\{id}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_sync_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /providers/ssf/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `oidc_auth_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PUT` /providers/ssf/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `oidc_auth_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `PATCH` /providers/ssf/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `oidc_auth_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /providers/wsfed/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `saml_version` (object)

    > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

    Enum values:

    - `1.1`
    - `2.0`

  * Added property `url_issuer` (string)
    > Get Issuer/EntityID URL

##### `PUT` /providers/wsfed/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `saml_version` (object)
  > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `saml_version` (object)

    > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

  * Added property `url_issuer` (string)
    > Get Issuer/EntityID URL

##### `PATCH` /providers/wsfed/\{id}/

###### Request:

Changed content type : `application/json`

- Added property `saml_version` (object)
  > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `saml_version` (object)

    > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

  * Added property `url_issuer` (string)
    > Get Issuer/EntityID URL

##### `POST` /rbac/permissions/assigned\_by\_roles/\{uuid}/assign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_core.objectattribute`
  - `authentik_core.actor`
  - `authentik_providers_oauth2.oauth2dynamicclientregistration`
  - `authentik_agents.agent`
  - `authentik_lifecycle.useroffboarding`
  - `authentik_requests.requestrulechildbinding`
  - `authentik_requests.requestrulebinding`
  - `authentik_requests.requestrule`
  - `authentik_requests.grantrequest`

##### `PATCH` /rbac/permissions/assigned\_by\_roles/\{uuid}/unassign/

###### Request:

Changed content type : `application/json`

- Changed property `model` (string)

  Added enum values:

  - `authentik_core.objectattribute`
  - `authentik_core.actor`
  - `authentik_providers_oauth2.oauth2dynamicclientregistration`
  - `authentik_agents.agent`
  - `authentik_lifecycle.useroffboarding`
  - `authentik_requests.requestrulechildbinding`
  - `authentik_requests.requestrulebinding`
  - `authentik_requests.requestrule`
  - `authentik_requests.grantrequest`

##### `GET` /reports/exports/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

    - Changed property `content_type` (object)

      New required properties:

      - `fully_qualified_model`

      * Added property `fully_qualified_model` (string)

##### `GET` /root/config/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `capabilities` (array)

    Changed items (string):

    Added enum values:

    - `can_request`
    - `can_agent_self_service`

##### `GET` /sources/kerberos/\{slug}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_sync_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /sources/ldap/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_group_hierarchy` (boolean)
    > Sync group parentage/hierarchy from LDAP directories.

##### `PUT` /sources/ldap/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `sync_group_hierarchy` (boolean)
  > Sync group parentage/hierarchy from LDAP directories.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_group_hierarchy` (boolean)
    > Sync group parentage/hierarchy from LDAP directories.

##### `PATCH` /sources/ldap/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `sync_group_hierarchy` (boolean)
  > Sync group parentage/hierarchy from LDAP directories.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `sync_group_hierarchy` (boolean)
    > Sync group parentage/hierarchy from LDAP directories.

##### `GET` /sources/ldap/\{slug}/sync/status/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `last_sync_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /sources/oauth/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `request_token_url` (string)

    > URL used to request the initial token. This URL is only required for OAuth 1.

  - Changed property `authorization_url` (string)

    > URL the user is redirect to to conest the flow.

  - Changed property `access_token_url` (string)

    > URL used by authentik to retrieve tokens.

  - Changed property `profile_url` (string)

    > URL used by authentik to get user information.

  - Changed property `provider_type` (string)

    Removed enum value:

    - `azuread`

##### `PUT` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `request_token_url` (string)

  > URL used to request the initial token. This URL is only required for OAuth 1.

- Changed property `authorization_url` (string)

  > URL the user is redirect to to conest the flow.

- Changed property `access_token_url` (string)

  > URL used by authentik to retrieve tokens.

- Changed property `profile_url` (string)

  > URL used by authentik to get user information.

- Changed property `provider_type` (string)

  Removed enum value:

  - `azuread`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `request_token_url` (string)

    > URL used to request the initial token. This URL is only required for OAuth 1.

  - Changed property `authorization_url` (string)

    > URL the user is redirect to to conest the flow.

  - Changed property `access_token_url` (string)

    > URL used by authentik to retrieve tokens.

  - Changed property `profile_url` (string)

    > URL used by authentik to get user information.

  - Changed property `provider_type` (string)

    Removed enum value:

    - `azuread`

##### `PATCH` /sources/oauth/\{slug}/

###### Request:

Changed content type : `application/json`

- Changed property `request_token_url` (string)

  > URL used to request the initial token. This URL is only required for OAuth 1.

- Changed property `authorization_url` (string)

  > URL the user is redirect to to conest the flow.

- Changed property `access_token_url` (string)

  > URL used by authentik to retrieve tokens.

- Changed property `profile_url` (string)

  > URL used by authentik to get user information.

- Changed property `provider_type` (string)

  Removed enum value:

  - `azuread`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `request_token_url` (string)

    > URL used to request the initial token. This URL is only required for OAuth 1.

  - Changed property `authorization_url` (string)

    > URL the user is redirect to to conest the flow.

  - Changed property `access_token_url` (string)

    > URL used by authentik to retrieve tokens.

  - Changed property `profile_url` (string)

    > URL used by authentik to get user information.

  - Changed property `provider_type` (string)

    Removed enum value:

    - `azuread`

##### `GET` /sources/saml/\{slug}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `issuer_override` (string)

    > Also known as Entity ID. Defaults to the Metadata URL.

  * Added property `url_issuer` (string)

    > Get the resolved Issuer, falling back to the metadata URL when unset

  * Deleted property `issuer` (string)
    > Also known as Entity ID. Defaults the Metadata URL.

##### `PUT` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `issuer_override` (string)

  > Also known as Entity ID. Defaults to the Metadata URL.

- Deleted property `issuer` (string)
  > Also known as Entity ID. Defaults the Metadata URL.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `issuer_override` (string)

    > Also known as Entity ID. Defaults to the Metadata URL.

  * Added property `url_issuer` (string)

    > Get the resolved Issuer, falling back to the metadata URL when unset

  * Deleted property `issuer` (string)
    > Also known as Entity ID. Defaults the Metadata URL.

##### `PATCH` /sources/saml/\{slug}/

###### Request:

Changed content type : `application/json`

- Added property `issuer_override` (string)

  > Also known as Entity ID. Defaults to the Metadata URL.

- Deleted property `issuer` (string)
  > Also known as Entity ID. Defaults the Metadata URL.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `issuer_override` (string)

    > Also known as Entity ID. Defaults to the Metadata URL.

  * Added property `url_issuer` (string)

    > Get the resolved Issuer, falling back to the metadata URL when unset

  * Deleted property `issuer` (string)
    > Also known as Entity ID. Defaults the Metadata URL.

##### `GET` /ssf/streams/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider_obj` (object)

    > SSFProvider Serializer

    - Changed property `oidc_auth_providers_obj` (array)

      Changed items (object): > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /tasks/schedules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object):

    - Changed property `last_task_status` (string)

      Added enum value:

      - `waiting_for_dependencies`

##### `POST` /core/applications/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `pbm_uuid`

  * Added property `pbm_uuid` (string)

  * Changed property `provider_obj` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

  * Changed property `backchannel_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /core/applications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Application Serializer

    New required properties:

    - `pbm_uuid`

    * Added property `pbm_uuid` (string)

    * Changed property `provider_obj` (object)

      > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

    * Changed property `backchannel_providers_obj` (array)

      Changed items (object): > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /core/user\_consent/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `application` (object)

    > Application Serializer

    New required properties:

    - `pbm_uuid`

    * Added property `pbm_uuid` (string)

    * Changed property `provider_obj` (object)

      > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

    * Changed property `backchannel_providers_obj` (array)

      Changed items (object): > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /core/users/me/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`

  New required properties:

  - `users`

  * Added property `users` (array)

    Items (object): > User Serializer for information a user can retrieve about themselves

    - Property `pk` (integer)

    - Property `username` (string)

      > Required. 150 characters or fewer. Letters, digits and @/./+/-/\_ only.

    - Property `name` (string)

      > User's display name.

    - Property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    - Property `is_superuser` (boolean)

    - Property `is_current` (boolean)

      > Return whether this user owns the current browser session.

    - Property `groups` (array)

      Items (object):

      - Property `name` (string)

      - Property `pk` (string)

    - Property `roles` (array)

      Items (object):

    - Property `email` (string)

    - Property `avatar` (string)

      > User's avatar, either a http/https URL or a data URI

    - Property `uid` (string)

    - Property `settings` (object)

      > Get user settings with brand and group settings applied

    - Property `type` (string)

      Enum values:

      - `internal`
      - `external`
      - `service_account`
      - `internal_service_account`

    - Property `system_permissions` (array)

      > Get all system permissions assigned to the user

      Items (string):

  * Changed property `user` (object)

    > User Serializer for information a user can retrieve about themselves

    New required properties:

    - `is_current`

    * Added property `is_current` (boolean)
      > Return whether this user owns the current browser session.

##### `POST` /events/events/

###### Request:

Changed content type : `application/json`

- Changed property `action` (string)

  Added enum values:

  - `user_offboarded`
  - `access_request_created`
  - `access_request_approved`
  - `access_request_denied`
  - `access_request_revoked`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

##### `GET` /events/events/

###### Parameters:

Changed: `actions` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Event Serializer

    - Changed property `action` (string)

      Added enum values:

      - `user_offboarded`
      - `access_request_created`
      - `access_request_approved`
      - `access_request_denied`
      - `access_request_revoked`

##### `GET` /events/notifications/\{uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Changed property `action` (string)

      Added enum values:

      - `user_offboarded`
      - `access_request_created`
      - `access_request_approved`
      - `access_request_denied`
      - `access_request_revoked`

##### `PUT` /events/notifications/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

  > Event Serializer

  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Changed property `action` (string)

      Added enum values:

      - `user_offboarded`
      - `access_request_created`
      - `access_request_approved`
      - `access_request_denied`
      - `access_request_revoked`

##### `PATCH` /events/notifications/\{uuid}/

###### Request:

Changed content type : `application/json`

- Changed property `event` (object)

  > Event Serializer

  - Changed property `action` (string)

    Added enum values:

    - `user_offboarded`
    - `access_request_created`
    - `access_request_approved`
    - `access_request_denied`
    - `access_request_revoked`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `event` (object)

    > Event Serializer

    - Changed property `action` (string)

      Added enum values:

      - `user_offboarded`
      - `access_request_created`
      - `access_request_approved`
      - `access_request_denied`
      - `access_request_revoked`

##### `GET` /lifecycle/iterations/open/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

    - Changed property `reviews` (array)

      Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

      - Changed property `reviewer` (object)

        > Partial User Serializer, does not include child relations.

        New required properties:

        - `uid`

        New optional properties:

        - `uuid`

        * Added property `is_active` (boolean)

          > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

        * Added property `last_login` (string)

        * Added property `email` (string)

        * Added property `attributes` (object)

        * Added property `uid` (string)

        * Deleted property `uuid` (string)

    - Changed property `rule` (object)

      > Mixin to validate that a valid enterprise license
      > exists before allowing to save the object

      - Changed property `reviewer_groups` (array)

        Changed items (object): > Partial Group Serializer, does not include child relations.

        New required properties:

        - `num_pk`

        * Added property `num_pk` (integer)

          > Get a numerical, int32 ID for the group

        * Added property `is_superuser` (boolean)

          > Users added to this group will be superusers.

        * Added property `attributes` (object)

      - Changed property `reviewers` (array)

        Changed items (object): > Partial User Serializer, does not include child relations.

        New required properties:

        - `uid`

        New optional properties:

        - `uuid`

        * Added property `is_active` (boolean)

          > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

        * Added property `last_login` (string)

        * Added property `email` (string)

        * Added property `attributes` (object)

        * Added property `uid` (string)

        * Deleted property `uuid` (string)

##### `POST` /lifecycle/rules/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `reviewer_groups_obj` (array)

    Changed items (object): > Partial Group Serializer, does not include child relations.

    New required properties:

    - `num_pk`

    * Added property `num_pk` (integer)

      > Get a numerical, int32 ID for the group

    * Added property `is_superuser` (boolean)

      > Users added to this group will be superusers.

    * Added property `attributes` (object)

  - Changed property `reviewers_obj` (array)

    Changed items (object): > Partial User Serializer, does not include child relations.

    New required properties:

    - `uid`

    New optional properties:

    - `uuid`

    * Added property `is_active` (boolean)

      > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

    * Added property `last_login` (string)

    * Added property `email` (string)

    * Added property `attributes` (object)

    * Added property `uid` (string)

    * Deleted property `uuid` (string)

##### `GET` /lifecycle/rules/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Mixin to validate that a valid enterprise license > exists before allowing to save the object

    - Changed property `reviewer_groups_obj` (array)

      Changed items (object): > Partial Group Serializer, does not include child relations.

      New required properties:

      - `num_pk`

      * Added property `num_pk` (integer)

        > Get a numerical, int32 ID for the group

      * Added property `is_superuser` (boolean)

        > Users added to this group will be superusers.

      * Added property `attributes` (object)

    - Changed property `reviewers_obj` (array)

      Changed items (object): > Partial User Serializer, does not include child relations.

      New required properties:

      - `uid`

      New optional properties:

      - `uuid`

      * Added property `is_active` (boolean)

        > Designates whether this user should be treated as active. Unselect this instead of deleting accounts.

      * Added property `last_login` (string)

      * Added property `email` (string)

      * Added property `attributes` (object)

      * Added property `uid` (string)

      * Deleted property `uuid` (string)

##### `GET` /oauth2/access\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /oauth2/authorization\_codes/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /oauth2/refresh\_tokens/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `provider` (object)

    > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `POST` /outposts/instances/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /outposts/instances/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Outpost Serializer

    - Changed property `providers_obj` (array)

      Changed items (object): > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /outposts/ldap/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAPProvider Serializer

    - Changed property `application_slug` (string)
      > Prioritize backchannel slug over direct application slug

##### `POST` /providers/google\_workspace/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)
  > When enabled, authentik will attempt to discover existing resources in the remote system.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `GET` /providers/google\_workspace/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > GoogleWorkspaceProvider Serializer

    - Added property `discovery_enabled` (boolean)
      > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `POST` /providers/microsoft\_entra/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)
  > When enabled, authentik will attempt to discover existing resources in the remote system.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `GET` /providers/microsoft\_entra/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > MicrosoftEntraProvider Serializer

    - Added property `discovery_enabled` (boolean)
      > When enabled, authentik will attempt to discover existing resources in the remote system.

##### `GET` /providers/oauth2/\{id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `grant_types` (array)

    Changed items (string):

    Added enum value:

    - `urn:ietf:params:oauth:grant-type:token-exchange`

##### `PUT` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `grant_types` (array)

  Changed items (string):

  Added enum value:

  - `urn:ietf:params:oauth:grant-type:token-exchange`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `grant_types` (array)

    Changed items (string):

    Added enum value:

    - `urn:ietf:params:oauth:grant-type:token-exchange`

##### `PATCH` /providers/oauth2/\{id}/

###### Request:

Changed content type : `application/json`

- Changed property `grant_types` (array)

  Changed items (string):

  Added enum value:

  - `urn:ietf:params:oauth:grant-type:token-exchange`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `grant_types` (array)

    Changed items (string):

    Added enum value:

    - `urn:ietf:params:oauth:grant-type:token-exchange`

##### `POST` /providers/scim/

###### Request:

Changed content type : `application/json`

- Added property `discovery_enabled` (boolean)

  > When enabled, authentik will attempt to discover existing resources in the remote system.

- Changed property `compatibility_mode` (string)

  > Alter authentik behavior for vendor-specific SCIM implementations.

  Added enum value:

  - `gitlab`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `discovery_enabled` (boolean)

    > When enabled, authentik will attempt to discover existing resources in the remote system.

  - Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum value:

    - `gitlab`

##### `GET` /providers/scim/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SCIMProvider Serializer

    - Added property `discovery_enabled` (boolean)

      > When enabled, authentik will attempt to discover existing resources in the remote system.

    - Changed property `compatibility_mode` (string)

      > Alter authentik behavior for vendor-specific SCIM implementations.

      Added enum value:

      - `gitlab`

##### `POST` /providers/ssf/

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `oidc_auth_providers_obj` (array)

    Changed items (object): > Provider Serializer

    New optional properties:

    - `authorization_flow`
    - `invalidation_flow`

    * Changed property `authorization_flow` (string)

      > Flow used when authorizing this provider.

    * Changed property `invalidation_flow` (string)
      > Flow used ending the session from a provider.

##### `GET` /providers/ssf/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SSFProvider Serializer

    - Changed property `oidc_auth_providers_obj` (array)

      Changed items (object): > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `POST` /providers/wsfed/

###### Request:

Changed content type : `application/json`

- Added property `saml_version` (object)
  > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `saml_version` (object)

    > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

  * Added property `url_issuer` (string)
    > Get Issuer/EntityID URL

##### `GET` /providers/wsfed/

###### Parameters:

Added: `saml_version` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > WSFederationProvider Serializer

    New required properties:

    - `url_issuer`

    * Added property `saml_version` (object)

      > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

    * Added property `url_issuer` (string)
      > Get Issuer/EntityID URL

##### `POST` /sources/ldap/

###### Request:

Changed content type : `application/json`

- Added property `sync_group_hierarchy` (boolean)
  > Sync group parentage/hierarchy from LDAP directories.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `sync_group_hierarchy` (boolean)
    > Sync group parentage/hierarchy from LDAP directories.

##### `GET` /sources/ldap/

###### Parameters:

Added: `sync_group_hierarchy` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > LDAP Source Serializer

    - Added property `sync_group_hierarchy` (boolean)
      > Sync group parentage/hierarchy from LDAP directories.

##### `POST` /sources/oauth/

###### Request:

Changed content type : `application/json`

- Changed property `request_token_url` (string)

  > URL used to request the initial token. This URL is only required for OAuth 1.

- Changed property `authorization_url` (string)

  > URL the user is redirect to to conest the flow.

- Changed property `access_token_url` (string)

  > URL used by authentik to retrieve tokens.

- Changed property `profile_url` (string)

  > URL used by authentik to get user information.

- Changed property `provider_type` (string)

  Removed enum value:

  - `azuread`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `request_token_url` (string)

    > URL used to request the initial token. This URL is only required for OAuth 1.

  - Changed property `authorization_url` (string)

    > URL the user is redirect to to conest the flow.

  - Changed property `access_token_url` (string)

    > URL used by authentik to retrieve tokens.

  - Changed property `profile_url` (string)

    > URL used by authentik to get user information.

  - Changed property `provider_type` (string)

    Removed enum value:

    - `azuread`

##### `GET` /sources/oauth/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth Source Serializer

    - Changed property `request_token_url` (string)

      > URL used to request the initial token. This URL is only required for OAuth 1.

    - Changed property `authorization_url` (string)

      > URL the user is redirect to to conest the flow.

    - Changed property `access_token_url` (string)

      > URL used by authentik to retrieve tokens.

    - Changed property `profile_url` (string)

      > URL used by authentik to get user information.

    - Changed property `provider_type` (string)

      Removed enum value:

      - `azuread`

##### `POST` /sources/saml/

###### Request:

Changed content type : `application/json`

- Added property `issuer_override` (string)

  > Also known as Entity ID. Defaults to the Metadata URL.

- Deleted property `issuer` (string)
  > Also known as Entity ID. Defaults the Metadata URL.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`

  New required properties:

  - `url_issuer`

  * Added property `issuer_override` (string)

    > Also known as Entity ID. Defaults to the Metadata URL.

  * Added property `url_issuer` (string)

    > Get the resolved Issuer, falling back to the metadata URL when unset

  * Deleted property `issuer` (string)
    > Also known as Entity ID. Defaults the Metadata URL.

##### `GET` /sources/saml/

###### Parameters:

Added: `issuer_override` in `query`

Deleted: `issuer` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SAMLSource Serializer

    New required properties:

    - `url_issuer`

    * Added property `issuer_override` (string)

      > Also known as Entity ID. Defaults to the Metadata URL.

    * Added property `url_issuer` (string)

      > Get the resolved Issuer, falling back to the metadata URL when unset

    * Deleted property `issuer` (string)
      > Also known as Entity ID. Defaults the Metadata URL.

##### `GET` /ssf/streams/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SSFStream Serializer

    - Changed property `provider_obj` (object)

      > SSFProvider Serializer

      - Changed property `oidc_auth_providers_obj` (array)

        Changed items (object): > Provider Serializer

        New optional properties:

        - `authorization_flow`
        - `invalidation_flow`

        * Changed property `authorization_flow` (string)

          > Flow used when authorizing this provider.

        * Changed property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

##### `GET` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Deleted property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

##### `PUT` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Deleted property `prevent_duplicate_devices` (boolean)
  > When enabled, a given device can only be registered once.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Deleted property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

##### `PATCH` /stages/authenticator/webauthn/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Deleted property `prevent_duplicate_devices` (boolean)
  > When enabled, a given device can only be registered once.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Deleted property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

##### `GET` /stages/captcha/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `request_content_type` (string)

    Enum values:

    - `application/x-www-form-urlencoded`
    - `application/json`

##### `PUT` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `request_content_type` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `request_content_type` (string)

##### `PATCH` /stages/captcha/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `request_content_type` (string)

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `request_content_type` (string)

##### `GET` /stages/source/\{stage\_uuid}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `resume_on_match_failures` (array)

    > Source matching failure reasons for which the flow should resume.

    Items (string):

    Enum value:

    - `missing_property`

##### `PUT` /stages/source/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `resume_on_match_failures` (array)
  > Source matching failure reasons for which the flow should resume.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `resume_on_match_failures` (array)
    > Source matching failure reasons for which the flow should resume.

##### `PATCH` /stages/source/\{stage\_uuid}/

###### Request:

Changed content type : `application/json`

- Added property `resume_on_match_failures` (array)
  > Source matching failure reasons for which the flow should resume.

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Added property `resume_on_match_failures` (array)
    > Source matching failure reasons for which the flow should resume.

##### `GET` /tasks/tasks/\{message\_id}/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `state` (string)

    > Task status

    Added enum value:

    - `waiting_for_dependencies`

  - Changed property `aggregated_status` (string)

    Added enum value:

    - `waiting_for_dependencies`

##### `GET` /core/user\_consent/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > UserConsent Serializer

    - Changed property `application` (object)

      > Application Serializer

      New required properties:

      - `pbm_uuid`

      * Added property `pbm_uuid` (string)

      * Changed property `provider_obj` (object)

        > Provider Serializer

        New optional properties:

        - `authorization_flow`
        - `invalidation_flow`

        * Changed property `authorization_flow` (string)

          > Flow used when authorizing this provider.

        * Changed property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

      * Changed property `backchannel_providers_obj` (array)

        Changed items (object): > Provider Serializer

        New optional properties:

        - `authorization_flow`
        - `invalidation_flow`

        * Changed property `authorization_flow` (string)

          > Flow used when authorizing this provider.

        * Changed property `invalidation_flow` (string)
          > Flow used ending the session from a provider.

##### `GET` /events/notifications/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Notification Serializer

    - Changed property `event` (object)

      > Event Serializer

      - Changed property `action` (string)

        Added enum values:

        - `user_offboarded`
        - `access_request_created`
        - `access_request_approved`
        - `access_request_denied`
        - `access_request_revoked`

##### `GET` /oauth2/access\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /oauth2/authorization\_codes/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant

    - Changed property `provider` (object)

      > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `GET` /oauth2/refresh\_tokens/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > Serializer for BaseGrantModel and RefreshToken

    - Changed property `provider` (object)

      > Provider Serializer

      New optional properties:

      - `authorization_flow`
      - `invalidation_flow`

      * Changed property `authorization_flow` (string)

        > Flow used when authorizing this provider.

      * Changed property `invalidation_flow` (string)
        > Flow used ending the session from a provider.

##### `POST` /providers/oauth2/

###### Request:

Changed content type : `application/json`

- Changed property `grant_types` (array)

  Changed items (string):

  Added enum value:

  - `urn:ietf:params:oauth:grant-type:token-exchange`

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Changed property `grant_types` (array)

    Changed items (string):

    Added enum value:

    - `urn:ietf:params:oauth:grant-type:token-exchange`

##### `GET` /providers/oauth2/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > OAuth2Provider Serializer

    - Changed property `grant_types` (array)

      Changed items (string):

      Added enum value:

      - `urn:ietf:params:oauth:grant-type:token-exchange`

##### `POST` /stages/authenticator/webauthn/

###### Request:

Changed content type : `application/json`

- Deleted property `prevent_duplicate_devices` (boolean)
  > When enabled, a given device can only be registered once.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Deleted property `prevent_duplicate_devices` (boolean)
    > When enabled, a given device can only be registered once.

##### `GET` /stages/authenticator/webauthn/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > AuthenticatorWebAuthnStage Serializer

    - Deleted property `prevent_duplicate_devices` (boolean)
      > When enabled, a given device can only be registered once.

##### `POST` /stages/captcha/

###### Request:

Changed content type : `application/json`

- Added property `request_content_type` (string)

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `request_content_type` (string)

##### `GET` /stages/captcha/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > CaptchaStage Serializer

    - Added property `request_content_type` (string)

##### `POST` /stages/source/

###### Request:

Changed content type : `application/json`

- Added property `resume_on_match_failures` (array)
  > Source matching failure reasons for which the flow should resume.

###### Return Type:

Changed response : **201 Created**

- Changed content type : `application/json`
  - Added property `resume_on_match_failures` (array)
    > Source matching failure reasons for which the flow should resume.

##### `GET` /stages/source/

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object): > SourceStage Serializer

    - Added property `resume_on_match_failures` (array)
      > Source matching failure reasons for which the flow should resume.

##### `GET` /tasks/tasks/

###### Parameters:

Changed: `state` in `query`

Changed: `aggregated_status` in `query`

###### Return Type:

Changed response : **200 OK**

- Changed content type : `application/json`
  - Changed property `results` (array)

    Changed items (object):

    - Changed property `state` (string)

      > Task status

      Added enum value:

      - `waiting_for_dependencies`

    - Changed property `aggregated_status` (string)

      Added enum value:

      - `waiting_for_dependencies`

##### `PUT` /core/transactional/applications/

###### Request:

Changed content type : `application/json`

- Changed property `provider` (object)

  Updated `authentik_providers_microsoft_entra.microsoftentraprovider` provider\_model:

  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

  Updated `authentik_providers_google_workspace.googleworkspaceprovider` provider\_model:

  - Added property `discovery_enabled` (boolean)
    > When enabled, authentik will attempt to discover existing resources in the remote system.

  Updated `authentik_providers_scim.scimprovider` provider\_model:

  - Added property `discovery_enabled` (boolean)

    > When enabled, authentik will attempt to discover existing resources in the remote system.

  - Changed property `compatibility_mode` (string)

    > Alter authentik behavior for vendor-specific SCIM implementations.

    Added enum value:

    - `gitlab`

  Updated `authentik_providers_ws_federation.wsfederationprovider` provider\_model:

  - Added property `saml_version` (object)

    > SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1.

  Updated `authentik_providers_oauth2.oauth2provider` provider\_model:

  - Changed property `grant_types` (array)

    Changed items (string):

    Added enum value:

    - `urn:ietf:params:oauth:grant-type:token-exchange`

---

## Release 0.10

This update brings a lot of big features, such as:

- New OAuth2/OpenID Provider

  This new provider merges both OAuth2 and OpenID. It is based on the codebase of the old provider, which has been simplified and cleaned from the ground up. Support for Property Mappings has also been added. Because of this change, OpenID and OAuth2 Providers will have to be re-created.

- Proxy Provider

  Due to this new OAuth2 Provider, the Application Gateway Provider, now simply called "Proxy Provider" has been revamped as well. The new authentik Proxy integrates more tightly with authentik via the new Outposts system. The new proxy also supports multiple applications per proxy instance, can configure TLS based on authentik Keypairs, and more.

  See [Proxy](../../add-secure-apps/providers/proxy/index.mdx)

- Outpost System

  This is a new Object type, currently used only by the Proxy Provider. It manages the creation and permissions of service accounts, which are used by the outposts to communicate with authentik.

  See [Outposts](../../add-secure-apps/outposts/index.mdx)

- Flow Import/Export

  Flows can now be imported and exported. This feature can be used as a backup system, or to share complex flows with other people. Example flows have also been added to the documentation to help you get going with authentik.

## Under the hood

- authentik now runs on Django 3.1 and Channels with complete ASGI enabled
- uwsgi has been replaced with Gunicorn and uvicorn
- Elastic APM has been replaced with Sentry Performance metrics
- Flow title is now configurable separately from the name
- All logging output is now json

## Upgrading

### docker-compose

The docker-compose file has been updated, please download the latest from `https://docs.goauthentik.io/docker-compose.yml`.
By default, the new compose file uses a fixed version to prevent unintended updates.

Before updating the file, stop all containers. Then download the file, pull the new containers and start the database.

```shell
docker-compose down
docker-compose pull
docker-compose up --no-start
docker-compose start redis postgrseql
docker-compose run --rm server migrate
docker-compose up -d
```

### Helm

A few options have changed:

- `error_reporting` was changed from a simple boolean to a dictionary:

```yaml
error_reporting:
    enabled: false
    environment: customer
    send_pii: false
```

- The `apm` and `monitoring` blocks have been removed.
- `serverReplicas` and `workerReplicas` have been added

### Upgrading

This upgrade only applies if you are upgrading from a running 0.9 instance. authentik detects this on startup, and automatically executes this upgrade.

Because this upgrade brings the new OAuth2 Provider, the old providers will be lost in the process. Make sure to take note of the providers you want to bring over.

Another side-effect of this upgrade is the change of OAuth2 URLs, see [here](../../add-secure-apps/providers/oauth2/index.mdx).

---

## Release 0.11

This update brings these headline features:

- Add Backup and Restore, currently only externally schedulable, documented [here](https://github.com/goauthentik/authentik/blob/version-2022.1/website/docs/maintenance/backups/index.md)

- New Admin Dashboard with more metrics and Charts

  Shows successful and failed logins from the last 24 hours, as well as the most used applications

- Add search to all table views

- Outpost now supports a Docker Controller, which installs the Outpost on the same host as authentik, updates and manages it

- Add Token Identifier

  Tokens now have an identifier which is used to reference to them, so the Primary key is not shown in URLs

- `core/applications/list` API now shows applications the user has access to via policies

## Upgrading

This upgrade can be done as any other patch upgrade, the only external change is the new docker-compose file, which enabled the Docker Integration for Outposts. To use this feature, please download the latest docker-compose from [here](https://docs.goauthentik.io/docker-compose.yml).

Afterwards, you can simply run `docker-compose up -d` and then the normal upgrade command of `docker-compose run --rm server migrate`.

---

## Release 0.12

This update brings these headline features:

- Rewrite Outpost state Logic, which now supports multiple concurrent Outpost instances.
- Add Kubernetes Integration for Outposts, which deploys and maintains Outposts with High Availability in a Kubernetes Cluster
- Add System Task Overview to see all background tasks, their status, the log output, and retry them
- Alerts now disappear automatically
- Audit Logs are now searchable
- Users can now create their own Tokens to access the API
- docker-compose deployment now uses traefik 2.3

Fixes:

- Fix high CPU Usage of the proxy when Websocket connections fail

## Upgrading

### docker-compose

Docker-compose users should download the latest docker-compose file from [here](https://docs.goauthentik.io/docker-compose.yml). This includes the new traefik 2.3.

Afterwards, you can simply run `docker-compose up -d` and then the normal upgrade command of `docker-compose run --rm server migrate`.

### Kubernetes

For Kubernetes users, there are some changes to the helm values.

The values change from

```yaml
config:
    # Optionally specify fixed secret_key, otherwise generated automatically
    # secret_key: _k*@6h2u2@q-dku57hhgzb7tnx*ba9wodcb^s9g0j59@=y(@_o
    # Enable error reporting
    error_reporting:
        enabled: false
        environment: customer
        send_pii: false
    # Log level used by web and worker
    # Can be either debug, info, warning, error
    log_level: warning
```

to

```yaml
config:
    # Optionally specify fixed secret_key, otherwise generated automatically
    # secretKey: _k*@6h2u2@q-dku57hhgzb7tnx*ba9wodcb^s9g0j59@=y(@_o
    # Enable error reporting
    errorReporting:
        enabled: false
        environment: customer
        sendPii: false
    # Log level used by web and worker
    # Can be either debug, info, warning, error
    logLevel: warning
```

in order to be consistent with the rest of the settings.

There is also a new setting called `kubernetesIntegration`, which controls the Kubernetes integration for authentik. When enabled (the default), a Service Account is created, which allows authentik to deploy and update Outposts.

---

## Release 0.13 (passbook -> authentik)

After a long back and forth, we've finally switched to a more permanent name. Whilst the upgrade is pretty much seamless, there are some things you have to change before upgrading.

# Headline changes

- New name ([https://github.com/goauthentik/authentik/pull/361](https://github.com/goauthentik/authentik/pull/361))

- The web interface is now a semi-SPA Experience. This means that most operations are done through Asynchronous requests

  In this initial release, this brings features such as a refresh button, a generally better User experience due to shorter loading times
  and fewer visual context changes.

- The web interface now has a darkmode, which is enabled automatically based on your Operating system darkmode.

- Application Icons can now be uploaded directly to authentik, rather than just being loaded from a URL

## Smaller changes

- Add better support for Docker Service Connections with Certificates
- Fix application API not returning the same format as other APIs

## Upgrading

### docker-compose

Docker-compose users should download the latest docker-compose file from [here](https://goauthentik.io/version/0.13/docker-compose.yml).

If you decided to rename the folder you're running the docker-compose file from, be aware that this will also change the name, that docker-compose will give the database volume. To mitigate this, either

- Keep the original directory name
- Move the directory and set `COMPOSE_PROJECT_NAME` to the name of the old directory (see [here](https://docs.docker.com/compose/reference/envvars/#compose_project_name))
- Create a backup, rename the directory and restore from backup.

The only manual change you have to do is replace the `PASSBOOK_` prefix in your `.env` file, so `PASSBOOK_SECRET_KEY` gets changed to `AUTHENTIK_SECRET_KEY`.

Additionally, the database name and username have to be changed, so add this block to your `.env` file:

```shell
PG_USER=passbook
PG_DB=passbook
```

Afterwards, you can simply run `docker-compose up -d` and then the normal upgrade command of `docker-compose run --rm server migrate`.

### Kubernetes

The helm repository changes from passbook to authentik. To update your repository, execute these commands:

```shell
helm repo remove passbook
helm repo add authentik https://docker.beryju.org/chartrepo/authentik
```

If you've set any custom image names in your values file, make sure to change them to authentik before upgrading.

Additionally, you need to change the database name that authentik uses, as the database name doesn't change. Add this snippet to your `values.yaml` file:

```yaml
postgresql:
    postgresqlDatabase: passbook
```

Afterwards you can upgrade as usual from the new repository:

```shell
helm upgrade authentik authentik/authentik --devel -f values.yaml
```

## Post-upgrade notes

- Some default values change, for example the SAML Provider's default issuer.

  This only makes a difference for newly created providers.

- Expression Policies variables change

  Anything prefixed with `pb_` changes to `ak_`, this change is done **automatically**

---

## Release 0.14

## Headline features

- Flows are now graphically shown as diagrams, to visualise which stages and policies are bound.

  This diagram makes it significantly easier to understand how a flow works, as well as helping you design a flow that does exactly what you need.

- Events now have a more general purpose, rather than just logging audit actions.

  The following new events are now logged:

  - Policy Execution (Has to be enabled on a per-policy basis)
  - Policy Exceptions
  - Property Mapping Exceptions
  - Configuration Errors (currently these events are created by incorrectly configured providers, but will be used further in the future.)
  - Update availability

- The OAuth2 Provider has been updated to closer match the OpenID Connect Specifications

  Response type no longer has to be configured manually. The issuer field can be configured now (the default behavior is the same as pre-0.14)

  Authorization Codes are now generated as a JWT Token, which is not specified as spec, but seems to be a quasi-standard.

- SAML Providers can now be created from SAML Metadata

- The authentik proxy is now using the currently latest version of oauth2\_proxy (6.1.1)

- The license has been changed to GNU/GPL 3.0

## Fixes

- admin: fix policy test button in dark theme
- core: fix anonymous user being included in User API
- core: fix token update/delete not working
- core: fix User's token creation not working
- core: make application's provider not required
- core: show multi-select notice for SelectMultiple Widgets
- outposts: allow blank kubeconfig
- outposts: validate kubeconfig before saving
- proxy: update to latest stable oauth2\_proxy version
- root: update license
- web: fix sidebar being overlaid over modal backdrop
- web: fix table styling on mobile
- web: use displyname in sidebar for user

## Upgrading

This release does not introduce any new requirements.

### docker-compose

Download the docker-compose file for 0.14 from [here](https://goauthentik.io/version/0.14/docker-compose.yml). Afterwards, simply run `docker-compose up -d` and then the standard upgrade command of `docker-compose run --rm server migrate`.

### Kubernetes

Run `helm repo update` and then upgrade your release with `helm upgrade authentik authentik/authentik --devel -f values.yaml`.

---

## Release 0.9

Due to some database changes that had to be rather sooner than later, there is no possibility to directly upgrade. You must extract the data before hand and import it again. It is recommended to spin up a second instance of authentik to do this.

To export data from your old instance, run this command:

- docker-compose

```shell
docker-compose exec server ./manage.py dumpdata -o /tmp/authentik_dump.json authentik_core.User authentik_core.Group authentik_crypto.CertificateKeyPair authentik_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
docker cp authentik_server_1:/tmp/authentik_dump.json authentik_dump.json
```

- kubernetes

```shell
kubectl exec -it authentik-web-... -- ./manage.py dumpdata -o /tmp/authentik_dump.json authentik_core.User authentik_core.Group authentik_crypto.CertificateKeyPair authentik_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
kubectl cp authentik-web-...:/tmp/authentik_dump.json authentik_dump.json
```

After that, create a new authentik instance in a different namespace (kubernetes) or in a different folder (docker-compose). Once this instance is running, you can use the following commands to restore the data. On docker-compose, you still have to run the `migrate` command, to create all database structures.

- docker-compose

```shell
docker cp authentik_dump.json new_authentik_server_1:/tmp/authentik_dump.json
docker-compose exec server ./manage.py loaddata /tmp/authentik_dump.json
```

- kubernetes

```shell
kubectl cp authentik_dump.json authentik-web-...:/tmp/authentik_dump.json
kubectl exec -it authentik-web-... -- ./manage.py loaddata /tmp/authentik_dump.json
```

Now, you should be able to login to the new authentik instance, and migrate the rest of the data over.

---

## 2023-06 Cure53 Code audit

# 2023-06 Cure53 Code audit

In May/June of 2023, we had a pentest conducted by [Cure53](https://cure53.de). The following security updates, 2023.4.2 and 2023.5.3 were released as a response to the found issues.

From the [complete report](https://cure53.de/pentest-report_authentik.pdf), these are the points we're addressing with this update:

### ATH-01-001: Path traversal on blueprints allows arbitrary file-read (Medium)

This had accidentally been patched by a previous commit already; and was also only possible for users with superuser permissions.

### ATH-01-003: CSS injection via faulty string replacement in Mermaid (Low)

This is an unrelated issue that was found with a third-party dependency ([Mermaid](https://mermaid.js.org/)), fixed with [https://github.com/mermaid-js/mermaid/releases/tag/v10.2.2](https://github.com/mermaid-js/mermaid/releases/tag/v10.2.2)

Additionally we've also taken steps to further mitigate possible issues that could be caused in this way.

### ATH-01-008: User-passwords disclosed to third-party service (High)

In certain circumstances, using the Enter key to submit some forms instead of clicking submit would cause the frontend to change the URL instead of calling the API, which could lead to sensitive data being disclosed.

### ATH-01-009: Lack of CSRF protection in impersonate feature (Low)

Previous the URL to start an impersonation was a simple GET URL request, which was susceptible to CSRF. This has been changed to an API Post request.

### ATH-01-010: Web authentication bypass via key confusion (High)

When using WebAuthn to authenticate, the owner of the WebAuthn device wasn't checked. However to exploit this, an attacker would need to be able to already intercept HTTP traffic and read the data.

### ATH-01-014: Authentication challenges abused by foreign flow (Medium)

Previously it was possible to use an MFA authenticator class that wasn't allowed in a flow, if another flow existed that allowed this class. The patch changes data to be isolated per flow to prevent this issue.

### ATH-01-004: Information disclosure on system endpoint (Info)

The `/api/v3/admin/system/` (only accessible to superusers) endpoint returns a large amount of system info (mostly used for debugging), like the HTTP headers sent to the server. It also included all environment variables set for authentik. The environment variables have been removed.

### ATH-01-005: Timing-unsafe comparison in API authentication (Info)

In the API authentication that is used by the embedded outpost (API authentication via Secret key), a timing-unsafe comparison was used.

### ATH-01-012: Unintended diagram created due to unescaped quotes (Info)

Related to ATH-01-003, it was possible to insert unintended diagrams into generated diagrams.

## Additional info

In addition to the points above, several of the findings are classified as intended features (such as the expression policies). However, we have published additional [hardening documentation](../security-hardening.mdx) to provide guidance for further measures that can be taken to limit any possible risks associated with these features.

### ATH-01-002: Stored XSS in help text of prompt module (Medium)

Prompt help texts can use HTML to add markup, which also includes the option to include JavaScript. This is only possible to configure for superusers. To mitigate the risk of a rogue superuser creating a stage with a malicious script, requests to the `/api/v3/stages/captcha*` and `/api/v3/managed/blueprints*` endpoints can be blocked. With these restrictions in place, Captcha stages can only be edited using Blueprints on the file system. It is also recommended to use the RBAC system to restrict which users can edit these objects.

### ATH-01-006: Arbitrary code execution via expressions (Critical)

This is the intended function of expression policies/property mappings, which also requires superuser permissions to edit. To mitigate the risk of a rogue superuser creating a malicious expression, requests to the `/api/v3/policies/expression*`, `/api/v3/propertymappings*`, and ` /api/v3/managed/blueprints*` endpoints can be blocked. With these restrictions in place, expression can only be edited using Blueprints on the file system. It is also recommended to use the RBAC system to restrict which users can edit these objects.

### ATH-01-007: SSRF via blueprints feature for fetching manifests (Medium)

Superusers can fetch blueprints via OCI registries, which could be potentially used for server-side request forgery. To mitigate the risk of a rogue superuser sending malicious requests, requests to the `/api/v3/managed/blueprints*` endpoint can be blocked. With these restrictions in
place, blueprints can only be edited using YAML files on the file system. It is also recommended to use the RBAC system to restrict which users can edit these objects.

### ATH-01-013: XSS via CAPTCHA JavaScript URL (Medium)

Similar to ATH-01-002, any arbitrary JavaScript can be loaded using the Captcha stage. This is also limited to superusers. In order to prevent potential exploitation, it is recommended to limit the setting to allow-listed JavaScript URLs only.

### ATH-01-011: Weak default configs in logout/change password flows (Info)

The default logout flow does not do any additional validation and logs the user out with a single GET request. The default password-change flow does not verify the users current password, nor does it show the current users info.

---

## 2024-11 Cobalt pentest

# 2024-11 Cobalt pentest

We are committed to engaging in regular pentesting and security audits of authentik. Defining and adhering to a cadence of external testing ensures a stronger probability that our code base, our features, and our architecture is as secure and non-exploitable as possible.

In August-September of 2024, we had a pentest conducted by [Cobalt](https://www.cobalt.io). This document covers the findings of the audit, how we addressed the noted issues, and the subsequent [re-testing](https://goauthentik.io/resources/fullReport_authentik-cobalt-test-instance-august-2024-pt26135.pdf) by Cobalt to confirm that all issues were resolved.

Cobalt described their process for testing:

> This pentest was a manual assessment of the security of the application’s functionality, business logic, and vulnerabilities, such as those cataloged in the Open Web Application Security Project OWASP) Top 10. The assessment also included a review of security controls and requirements listed in the OWASP Application Security Verification Standard (ASVS).

## Summary of findings

Overall, we are pleased with the report's findings and grateful for the opportunity to improve in every area we can.

> Cobalt reported "The pentesters found that the Authentik Security team implemented robust and up-to-date security practices throughout the application."

In total, there were 5 low-level and one info-level vulnerabilities reported. By early November 2024, all 6 vulnerabilities were addressed and released in the [2024.10.4 patch release](https://docs.goauthentik.io/docs/releases/2024.10#fixed-in-2024103).

## Responses to specific findings

From the audit, this is the complete list of findings, with information about how we addressed each.

### HTML Injection

**Issue**: A vulnerability existed through user-supplied names in our Flow diagrams, where the application did not properly sanitize or escape HTML input when parsing user-entered names. As a result, an attacker could inject arbitrary HTML or JavaScript code into the application, potentially leading to manipulation of the web page or execution of malicious scripts in the context of the user's session. (This action could only be performed by an authenticated admin user, and thus had little practical value as an attack vector.)

**Fix**: We added strict [DOMpurify](https://github.com/cure53/DOMPurify) configurations for any user-defined names in our diagrams. For details, refer to [Pull Request #11783](https://github.com/goauthentik/authentik/pull/11783).

### SVG images for icons possible XSS vulnerability

**Issue**: The pentesters discovered that the application was susceptible to insecure file upload and stored Cross-Site Scripting (XSS) vulnerabilities by uploading crafted SVG files that were used as application icons. (This action could only be performed by an authenticated admin user, and thus had little practical value as an attack vector.)

**Fix**: The fix was to add a CSP header to files that are stored in the `/media` directory of the installation. For details, refer to [Pull Request #12092](https://github.com/goauthentik/authentik/pull/12092).

### Vulnerability through footer links on website

**Issue**: It was found that the application was vulnerable to stored XSS through footer links. The footer section of the application accepted and displayed user-provided links without proper sanitization. This could allow an attacker to inject malicious scripts into these links, which would then stored and executed when other users access the footer links, leading to potential script execution in the context of the victim's session. (This action could only be performed by an authenticated admin user, and thus had little practical value as an attack vector.)

**Fix**: Again, as with the diagram issue above, we added strict [DOMpurify](https://github.com/cure53/DOMPurify) configurations. For more details, refer to [Pull Request #11773](https://github.com/goauthentik/authentik/pull/11773).

### Password policy weakness

**Issue**: It was determined that the password policy in place on the testing environment was weak, allowing users to create passwords that lacked complexity and were easily guessable. This made the application more susceptible to brute-force and dictionary attacks.

**Fix**: This was not a vulnerability in authentik, but rather a poor configuration of our provided test environment. Rather than simply improve our test instance’s configuration once, to make this issue easier to avoid for all our users and customers, we added a strong default password policy that applies to all new instances. (As always, admins can still configure their own custom policies.) For more details, refer to [Pull Request #11793](https://github.com/goauthentik/authentik/pull/11793).

### Lack of a CSP header

The absence of Content Security Policy (CSP) headers means that the application may lack a mechanism to restrict sources of content and scripts, which can potentially expose it to XSS attacks and other forms of content injection.

**Fix**: We added CSP headers to control the sources of content and scripts that the application can load for our provided test instance. Again, this is not a direct vulnerability in authentik itself. Given the variety of architectures in which authentik is deployed, adding our own CSP headers would be more likely to break functionality than to provide improved security.

### API endpoints strengthened

**Issue**: Finally, the only informational level finding was the potential for the unauthenticated download of private key and certificate values via a direct URL. (Guessing the URL required the knowledge of the UUID of an object.) We had already fixed this issue in 2024.8.0, but the instance tested against was the immediately preceding version.

**Fix**: For more details, refer to [CVE-2024-42490](https://docs.goauthentik.io/docs/security/cves/CVE-2024-42490).

## Retest results

The subsequent retest conducted by Cobalt deemed all issues resolved. See page 17 of the [report](https://goauthentik.io/resources/fullReport_authentik-cobalt-test-instance-august-2024-pt26135.pdf) for the mitigation status ("fixed") for each of the issues discovered in September.

We are pleased to share this pentest and the final results of the retest. We encourage an open and ongoing communication with our users and community. For more information abut our security stance, read our [Security Policy](https://docs.goauthentik.io/docs/security/policy), [Hardening authentik](https://docs.goauthentik.io/docs/security/security-hardening), and our other [security-related documentation](https://docs.goauthentik.io/docs/security). If you have any questions or feedback you can reach us on [GitHub](https://github.com/goauthentik/authentik), [Discord](https://discord.com/channels/809154715984199690/809154716507963434), or via email to [hello@goauthentik.io](mailto\:hello@goauthentik.io).

---

## 2025-09 IncludeSec pentest

# 2025-09 IncludeSec pentest

In September of 2025, we had a pentest conducted by [Include Security](https://includesecurity.com). This resulted in a number of code improvements to our application, however did not result in any assigned CVEs.

> IncludeSec performed a security assessment of Authentik Security's Web Apps, APIs, Deployment Config, Servers, & ETL. The assessment team performed a 8 day effort spanning from September 4 through September 15, 2025, using a Standard Gray Box assessment methodology.

View the full report of our original [test](https://goauthentik.io/resources/includesec-Q3-2025-Multi-Report.pdf) and the [retest results](https://goauthentik.io/resources/includesec-Q3-2025-Multi-Remediation-Report.pdf), completed in January/February 2026.

## Summary of findings

Below is a table summarizing the findings from the report, along with IncludeSec's risk labeling and our contextual categorization of these risks. As IncludeSec states, "It is common and encouraged that all clients recategorize findings based on their internal business risk tolerances."

| Finding | IncludeSec Risk | Status           | authentik Risk Categorization |
| ------- | --------------- | ---------------- | ----------------------------- |
| H1      | High            | Risk Accepted    | Expected behavior             |
| H2      | High            | Closed           | Low                           |
| H3      | High            | Risk Accepted    | Expected behavior             |
| M1      | Medium          | Fixed in 2025.12 | Low                           |
| M2      | Medium          | Closed           | Low                           |
| L1      | Low             | Closed           | Low                           |
| L2      | Low             | Closed           | Low                           |
| L3      | Low             | Closed           | None (not exploitable)        |
| L4      | Low             | Closed           | Low                           |

During the time of this test, we also separately addressed a number of community-reported CVEs as reported in our security pages.

## Responses to specific findings

This is the complete list of findings from the audit, with information about how we addressed each.

### H1: Blueprint Import Allows Arbitrary Modification of Application Objects (Internal: None)

*Issue:* This is intended functionality. This behavior reflects the privileged design of blueprint imports. It is 'exploitable' when importing blueprints from untrusted sources without reviewing the blueprint beforehand. Flow imports are technically blueprint imports, which by design can be used to create any object within authentik.

*Improvement:* We added a [warning banner](https://github.com/goauthentik/authentik/pull/19288) with 2025.12 to flow imports.

### H2: TOTP Brute-Force Vulnerability (Internal: Low) - Closed

*Issue:* TOTP could in theory be brute-forced for login given knowledge of a target user's password, enough time, and no WAF/altering on high amounts of requests.

*Improvement:* We added stricter rate limiting to the infrastructure used for testing.

In addition to using authentik's built-in methods to reduce the ability for attackers to brute-force credentials, we also recommend that customers use a WAF.

### H3: Arbitrary Python Code execution (Internal: None)

*Issue:* The authentik application allowed execution of arbitrary Python code with the same privileges as the application's system user. This behavior extended to prompt stages.

*Response:* By design, prompt inputs can be configured to have placeholder values based on Python expressions, inheriting the behavior from expression policies. Our [hardening docs](https://docs.goauthentik.io/security/security-hardening/) already cover this topic.

### M1: Anti-Brute Force Mechanisms Bypassed via Race conditions

*Issue:* The anti-brute force mechanism could be bypassed by triggering a race condition using the `default-authentication-flow`, given enough time and no WAF/other filtering in place.

*Improvement:* In 2025.12, we [replaced](https://github.com/goauthentik/authentik/pull/18643) session-based login attempt retries to rely instead on the reputation scores.

Once again, in addition to using authentik's built-in methods to reduce the ability for attackers to brute-force credentials, we recommend that customers use a WAF.

### M2: Password Hashes Disclosed via Application Launch URL (Internal: Low) - Closed

*Issue:* authentik disclosed salted user password hashes to a privileged user when accessing a specially crafted launch URL for a custom Application.

*Fix:* We [improved](https://github.com/goauthentik/authentik/pull/18076) the Application launch URL format.

### L1: FROM Tags in Dockerfiles Enable Supply-Chain Takeover (Internal: Low) - Closed

*Issue:* Our container build process used Dockerfiles containing unpinned tags, allowing a possible supply chain attack from an attacker with control of the referenced repository who could repoint the tag to a different image.

*Fix:* We [updated](https://github.com/goauthentik/authentik/pull/17795) to use image digests for Dockerfile `FROM` calls.

### L2: User Accounts Enumerable

*Issue:* In the small test environment, the application's response time varied based on whether the supplied account was associated with a valid user, allowing potential account enumeration.

In real-world production environments with typical network latency and reverse proxies, the timing variance would likely be obscured.

*Improvement:* We [replaced](https://github.com/goauthentik/authentik/pull/18883) a randomized call to `sleep` with `make_password`, which better emulates checking the password of a user.

### L3: \[Server] Shell Command Execution Did Not Use Absolute Path (Internal: Low) - Closed

*Issue:* authentik called OpenSSL based on its binary name without specifying an absolute path, which could lead to path hijacking.

*Fix:* We [updated](https://github.com/goauthentik/authentik/pull/17856) the OpenSSL call to use the absolute binary path.

### L4: \[Server] \[Proxy] Potential Slowloris DoS (Internal: Low) - Closed

*Issue:* The test infrastructure's HTTP server had been instantiated without setting ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout, or limiting header sizes, leaving it susceptible to Slowloris-style denial of service attacks.

*Fix:* We [added](https://github.com/goauthentik/authentik/pull/17858) default HTTP server timeouts. We recommend that admins use a load-balancer/reverse proxy in front of authentik in production, which would have different timeout settings.

### I1: \[Server] \[RADIUS] RADIUS Message-Authenticator Validation

*Issue:* RADIUS Message-Authenticator validation logic appeared to be inverted, causing valid packets to be rejected and weakening the integrity check.

RADIUS Message-Authenticator validation is the process of verifying the integrity and authenticity of a RADIUS packet using the Message-Authenticator attribute.

Although the issue is currently theoretical, correctly authenticated RADIUS messages may be rejected, causing authentication failures and a potential denial-of-service.

*Improvement:* This was initially [fixed](https://github.com/goauthentik/authentik/pull/17855) but later reverted; we're testing our RADIUS implementation with different clients to resolve the underlying bug that required the fix to be reverted.

## Conclusion

We encourage an open and ongoing communication with our users and community. For more information about our security stance, read our [Security Policy](https://docs.goauthentik.io/security/policy), [Hardening authentik](https://docs.goauthentik.io/security/security-hardening/), and our other security-related documentation. If you have any questions or feedback you can reach us on [GitHub](https://github.com/goauthentik/authentik/), [Discord](https://discord.com/invite/jg33eMhnj6), or via [email](mailto\:hello@goauthentik.io). Please follow our [security policy](https://docs.goauthentik.io/security/policy/#reporting-a-vulnerability) for reporting any security concerns or vulnerabilities.

---

## CVE-2022-23555

# CVE-2022-23555

*Reported by [@fuomag9](https://github.com/fuomag9)*

## Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow

### Summary

Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow than in the one provided.

### Patches

authentik 2022.11.4, 2022.10.4 and 2022.12.0 fix this issue, for other versions the workaround can be used.

### Impact

Only configurations using both invitations and have multiple enrollment flows with invitation stages that grant different permissions are affected. The default configuration is not vulnerable, and neither are configurations with a single enrollment flow.

### Details

The vulnerability allows an attacker that knows different invitation flows names (e.g. `enrollment-invitation-test` and `enrollment-invitation-admin`) via either different invite links or via brute forcing to signup via a single invitation url for any valid invite link received (it can even be a url for a third flow as long as it's a valid invite) as the token used in the `Invitations` section of the Admin interface does NOT change when a different `enrollment flow` is selected via the interface and it is NOT bound to the selected flow, so it will be valid for any flow when used.

### Workarounds

As a workaround, fixed data can be added to invitations which can be checked in the flow to deny requests. Alternatively, an identifier with high entropy (like a UUID) can be used as flow slug, mitigating the attack vector by exponentially decreasing the possibility of discovering other flows.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2022-46145

# CVE-2022-46145

*Reported by [@sdimovv](https://github.com/sdimovv)*

## Unauthorized user creation and potential account takeover

### Impact

With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts

### Patches

authentik 2022.11.2 and 2022.10.2 fix this issue, for other versions the workaround can be used.

### Workarounds

A policy can be created and bound to the `default-user-settings-flow` flow with the following contents

```python
return request.user.is_authenticated
```

---

## CVE-2022-46172

# CVE-2022-46172

*Reported by [@DreamingRaven](https://github.com/DreamingRaven)*

## Existing authenticated users can create arbitrary accounts

### Summary

Any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also have carry over consequences to other applications being how these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations.

### Patches

authentik 2022.11.4, 2022.10.4 and 2022.12.0 fix this issue.

### Impact

This vulnerability could make it much easier for name and email collisions to occur, making it harder for users to log in. This also makes it more difficult for admins to properly administer users because more confusing users will exist. This paired with password reset flows if enabled would mean a circumvention of on-boarding policies. Say for instance a company wanted to invite a limited number of beta testers, those beta testers would be able to create an arbitrary number of accounts themselves.

### Details

This vulnerability has already been submitted over email, this security advisory serves as formalization towards broader information dissemination. This vulnerability pertains to the user context used in the default-user-settings-flow. /api/v3/flows/instances/default-user-settings-flow/execute/

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2023-26481

# CVE-2023-26481

*Reported by [@fuomag9](https://github.com/fuomag9)*

## Insufficient user check in FlowTokens by Email stage

### Summary

Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user.

### Patches

authentik 2022.12.3, 2023.1.3, 2023.2.3 fix this issue.

### Impact

This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account.

### Workaround

It is recommended to upgrade to the patched version of authentik. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2023-36456

# CVE-2023-36456

*Reported by [@thijsa](https://github.com/thijsa)*

## Lack of Proxy IP headers validation

### Summary

authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code.

### Impact

Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this. Possible spoofing of IP addresses in logs, downstream applications proxied by (built in) outpost, IP bypassing in custom flows if used.

### Details

This poses a possible security risk when you have flows or policies that check the user's IP address, e.g. when you want to ignore the user's 2 factor authentication when the user is connected to the company network.

Another security risk is that the IP addresses in the logfiles and user sessions is not reliable anymore, anybody can spoof this address and you cannot verify that the user has logged in from the IP address that is in their account's log.

And the third risk is that this header is passed on to the proxied application behind an outpost. The application may do any kind of verification, logging, blocking or rate limiting based on the IP address, and this IP address can be overridden by anybody that want to.

---

## CVE-2023-39522

# CVE-2023-39522

*Reported by [@markrassamni](https://github.com/markrassamni)*

## Username enumeration attack

### Summary

Using a recovery flow with an identification stage an attacker is able to determine if a username exists.

### Patches

authentik 2023.5.6 and 2023.6.2 fix this issue.

### Impact

Only setups configured with a recovery flow are impacted by this.

### Details

An attacker can easily enumerate and check users' existence using the recovery flow, as a clear message is shown when a user doesn't exist. Depending on configuration this can either be done by username, email, or both.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2023-46249

# CVE-2023-46249

*Reported by [@devSparkle](https://github.com/devSparkle)*

## Potential Installation takeover when default admin user is deleted

### Summary

In the affected versions, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication.

### Patches

authentik 2023.8.4 and 2023.10.2 fix this issue, for other versions the workaround can be used.

### Impact

authentik uses a blueprint to create the default admin user, which can also optionally set the default admin users' password from an environment variable. When the user is deleted, the `initial-setup` flow used to configure authentik after the first installation becomes available again.

### Workarounds

Ensure the default admin user (Username `akadmin`) exists and has a password set. It is recommended to use a very strong password for this user, and store it in a secure location like a password manager. It is also possible to deactivate the user to prevent any logins as akadmin.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2023-48228

# CVE-2023-48228

*Reported by [@Sapd](https://github.com/Sapd)*

## OAuth2: Insufficient PKCE check

### Summary

When initializing an OAuth2 flow with a `code_challenge` and `code_method` (thus requesting PKCE), the SSO provider (authentik) **must** check if there is a matching **and** existing `code_verifier` during the token step.

authentik checks if the contents of code*verifier is matching \*\*\_ONLY*\*\* when it is provided. When it is left out completely, authentik simply accepts the token request without it; even when the flow was started with a `code_challenge`.

### Patches

authentik 2023.8.5 and 2023.10.4 fix this issue.

### Details

The `code_verifier` is only checked when the user provides it. Note that in line 209 there is a check if the code\_parameter is left out. But there is no check if the PKCE parameter simply was omitted WHEN the request was started with a `code_challenge_method`.

This oversight likely did not stem from a coding error but from a misinterpretation of the RFC, where the backward compatibility section may be somewhat confusing.
[https://datatracker.ietf.org/doc/html/rfc7636#section-4.5](https://datatracker.ietf.org/doc/html/rfc7636#section-4.5)
RFC7636 explicitly says in Section 4.5:

> The "code\_challenge\_method" is bound to the Authorization Code when
> the Authorization Code is issued. That is the method that the token
> endpoint MUST use to verify the "code\_verifier".

Section 5, Compatibility

> Server implementations of this specification MAY accept OAuth2.0
> clients that do not implement this extension. If the "code\_verifier"
> is not received from the client in the Authorization Request, servers
> supporting backwards compatibility revert to the OAuth 2.0 \[[RFC6749](https://datatracker.ietf.org/doc/html/rfc6749)]
> protocol without this extension.

Section 5, Compatibility, allows server implementations of this specification to accept OAuth 2.0 clients that do not implement this extension. However, if a `code_verifier` is not received from the client in the Authorization Request, servers that support backward compatibility should revert to the standard OAuth 2.0 protocol sans this extension (including all steps).

It should be noted that this does not mean that the `code_verifier` check can be disregarded at any point if the initial request included `code_challenge` or `code_challenge_method`. Because authentik supports PKCE, it **MUST** verify the `code_verifier` as described in Section 4.5 **AND** fail if it was not provided.

Of course, verification can be skipped if the original authorization request did not invoke PKCE (no `code_challenge_method` and no `code_challenge`).

Failure to check the `code_verifier` renders the PKCE flow ineffective. This vulnerability particularly endangers public or hybrid clients, as their `code` is deemed non-confidential.

While not explicitly stated in the standard, it is generally recommended that OAuth2 flows accepting public clients should enforce PKCE - at least when redirecting to a non-HTTPS URL (like http or an app link).

### Impact

The vulnerability poses a high risk to both public and hybrid clients.
When for example a mobile app implements oauth2, a malicious app can simply also register the same in-app-link (e.g. `mycoolapp://oauth2`) for the redirect callback URL, possibly receiving `code` during callback. With PKCE working, a malicious app would still receive a `code` but the `code` would not work without the correct unhashed code-challenge.
This is especially problematic, because authentik claims to support PKCE, and a developer can expect that the proper checks are in place. Note that app-links cannot be protected by HTTPS or similar mechanisms.

Note also that this vulnerability poses a threat to confidential clients. Many confidential clients act as a proxy for OAuth2 API requests, typically from mobile apps or single-page applications. These proxies relay `code_challenge`, `code_challenge_method` (in auth request, which most libraries force and provide on default settings) and `code_verifier` in the token request unchanged and supplement the CLIENT\_SECRET which only the relay knows. The relay can but does not have to check for an existing `code_verifier` as the standard does not define that PKCE can be ignored on confidential clients during the token request when the client requested PKCE during the authorization request.

An attacker could potentially gain full access to the application. If the code grants access to an admin account, the confidentiality, integrity, and availability of that application are compromised.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-21637

# CVE-2024-21637

*Reported by [@lauritzh](https://github.com/lauritzh)*

## XSS in authentik via JavaScript URI as redirect URI and form\_post response mode

### Summary

Given an OAuth2 provider configured with allowed redirect URIs set to `*` or `.*`, an attacker can send an OAuth Authorization request using `response_mode=form_post` and setting `redirect_uri` to a malicious URI, to capture authentik's session token.

### Patches

authentik 2023.8.6 and 2023.10.6 fix this issue.

### Impact

The impact depends on the attack scenario. The following sections describe the two scenarios that were identified for authentik.

#### Redirect URI misconfiguration

Although authentik advises that this can cause security issues, authentik generally allows wildcards as redirect URIs. Therefore, using only a wildcard and effectively allowing arbitrary URLs is a possible misconfiguration that can be present in real-world instances.

In such cases, unauthenticated and unprivileged attackers can perform the above described actions.

### User with (only) App Administration Permissions

A more likely scenario is an administrative user (e.g. a normal developer) having only permissions to manage applications.

This relatively user could use the described attacks to perform a privilege escalation.

### Workaround

It is recommended to upgrade to the patched version of authentik. If not possible, ensure that OAuth2 providers do not use a wildcard (`*` or `.*`) value as allowed redirect URI setting. (This is *not* exploitable if part of the redirect URI has a wildcard, for example `https://foo-.*\.bar\.com`)

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-23647

# CVE-2024-23647

*Reported by [@pieterphilippaerts](https://github.com/pieterphilippaerts)*

## PKCE downgrade attack in authentik

## Summary

PKCE is a very important countermeasure in OAuth2, both for public and confidential clients. It protects against CSRF attacks and code injection attacks. Because of this bug, an attacker can circumvent the protection PKCE offers.

## Patches

authentik 2023.8.7 and 2023.10.7 fix this issue.

## Details

There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the `code_challenge` parameter to the authorization request and adds the `code_verifier` parameter to the token request. We recently fixed a downgrade attack (in v2023.8.5 and 2023.10.4) where if the attacker removed the `code_verifier` parameter in the token request, authentik would allow the request to pass, thus circumventing PKCE’s protection. However, in the latest version of the software, another downgrade scenario is still possible: if the attacker removes the `code_challenge` parameter from the authorization request, authentik will also not do the PKCE check.

Note that this type of downgrade enables an attacker to perform a code injection attack, even if the OAuth client is using PKCE (which is supposed to protect against code injection attacks). To start the attack, the attacker must initiate the authorization process without that `code_challenge` parameter in the authorization request. But this is easy to do (just use a phishing site or email to trick the user into clicking on a link that the attacker controls – the authorization link without that `code_challenge` parameter).

The OAuth BCP ([https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics)) explicitly mentions this particular attack in section 2.1.1: “Authorization servers MUST mitigate PKCE Downgrade Attacks by ensuring that a token request containing a code\_verifier parameter is accepted only if a code\_challenge parameter was present in the authorization request, see Section 4.8.2 for details.”

## For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-37905

# CVE-2024-37905

*Reported by [@m2a2](https://github.com/m2a2)*

## Improper Authorization for Token modification

### Summary

Due to insufficient permission checks it was possible for any authenticated user to elevate their permissions to a superuser by creating an API token and changing the user the token belonged to.

### Patches

authentik 2024.6.0, 2024.4.3 and 2024.2.4 fix this issue, for other versions the workaround can be used.

### Details

By setting a token's user ID to the ID of a higher privileged user, the token will inherit the higher privileged access to the API. This can be used to change the password of the affected user or to modify the authentik configuration in a potentially malicious way.

### Workarounds

As a workaround it is possible to block any requests to `/api/v3/core/tokens*` at the reverse-proxy/load-balancer level. Doing so prevents this issue from being exploited.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-38371

# CVE-2024-38371

*Reported by Stefan Zwanenburg*

## Insufficient access control for OAuth2 Device Code flow

### Impact

Due to a bug, access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application, and access the application.

### Patches

authentik 2024.6.0, 2024.4.3 and 2024.2.4 fix this issue, for other versions the workaround can be used.

### Workarounds

As authentik flows are still used as part of the OAuth2 Device code flow, it is possible to add access control to the configured flows.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-42490

# CVE-2024-42490

*Reported by [@m2a2](https://github.com/m2a2)*

## Insufficient Authorization for several API endpoints

### Summary

Several API endpoints can be accessed by users without correct authentication/authorization.

The main API endpoints affected by this:

- `/api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/`
- `/api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/`
- `/api/v3/.../used_by/`

Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable.

### Patches

authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue.

### Workarounds

Access to the API endpoints can be blocked at a Reverse-proxy/Load balancer level to prevent this issue from being exploited.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-47070

# CVE-2024-47070

*Reported by [@efpi-bot](https://github.com/efpi-bot) from [LogicalTrust](https://logicaltrust.net/en/)*

## Password authentication bypass via X-Forwarded-For HTTP header

### Summary

The vulnerability allows bypassing policies by adding X-Forwarded-For header with unparsable IP address, e.g. "a". This results in a possibility to authenticate/authorize to any account with known login or email address.

Since the default authentication flow uses a policy to enable the password stage only when there is no password stage selected on the Identification stage, this vulnerability can be used to skip this policy and continue without the password stage.

### Am I affected

This can be exploited for the following configurations:

- An attacker can access authentik without a reverse proxy (and `AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS` is not configured properly)
- The reverse proxy configuration does not correctly overwrite X-Forwarded-For
- Policies (User and group bindings do *not* apply) are bound to authentication/authorization flows

### Patches

authentik 2024.6.5 and 2024.8.3 fix this issue.

### Workarounds

Ensure the X-Forwarded-For header is always set by the reverse proxy, and is always set to a correct IP.

In addition you can manually change the *Failure result* option on policy bindings to *Pass*, which will prevent any stages from being skipped if a malicious request is received.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-47077

# CVE-2024-47077

*Reported by [@quentinmit](https://github.com/quentinmit)*

## Insufficient cross-provider token validation during introspection

### Summary

Access tokens issued to one application can be stolen by that application and used to impersonate the user against any other proxy provider. Also, a user can steal an access token they were legitimately issued for one application and use it to access another application that they aren't allowed to access.

### Details

The proxy provider uses `/application/o/introspect/` to validate bearer tokens provided in the `Authorization` header:

The implementation of this endpoint separately validates the `client_id` and `client_secret` (which are that of the proxy provider) and the `token` without validating that they correspond to the same provider.

### Patches

authentik 2024.6.5 and 2024.8.3 fix this issue.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-52287

# CVE-2024-52287

*Reported by [@matt1097](https://github.com/matt1097)*

## Insufficient validation of OAuth scopes for client\_credentials and device\_code grants

### Summary

When using the `client_credentials` or `device_code` OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik.

### Details

With the `device_code` grant, it was possible to have a user authorize a set of permitted scopes, and then acquire a token with a different set of scopes, including scopes not configured. This token could potentially be used to send requests to another system which trusts tokens signed by authentik and execute malicious actions on behalf of the user.

With the `client_credentials` grant, because there is no user authorization process, authentik would not validate the scopes requested for the token, allowing tokens to be issued with scopes not configured in authentik. These could similarly be used to execute malicious actions in other systems.

There is no workaround for this issue; however this issue could only be exploited if an attacker possesses a valid set of OAuth2 `client_id` and `client_secret` credentials, and has the knowledge of another system that trusts tokens issued by authentik and what scopes it checks for.

### Patches

authentik 2024.8.5 and 2024.10.3 fix this issue.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-52289

# CVE-2024-52289

*Reported by [@PontusHanssen](https://github.com/PontusHanssen)*

## Insecure default configuration for OAuth2 redirect URIs

### Summary

Redirect URIs in the OAuth2 provider in authentik are checked by regex comparison.
When no Redirect URIs are configured in a provider, authentik will automatically use the first `redirect_uri` value received as an allowed redirect URI, without escaping characters that have a special meaning in regex. Similarly, the documentation did not take this into consideration either.

Given a provider with the Redirect URIs set to `https://foo.example.com`, an attacker can register a domain `fooaexample.com`, and it will correctly pass validation.

### Patches

authentik 2024.8.5 and 2024.10.3 fix this issue.

The patched versions remedy this issue by changing the format that the Redirect URIs are saved in, allowing for the explicit configuration if the URL should be checked strictly or as a regex. This means that these patches include a backwards-incompatible database change and API change.

Manual action *is required* if any provider is intended to use regex for Redirect URIs because the migration will set the comparison type to strict for every Redirect URI.

### Workarounds

When configuring OAuth2 providers, make sure to escape any wildcard characters that are not intended to function as a wildcard, for example replace `.` with `\.`.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2024-52307

# CVE-2024-52307

*Reported by [@mgerstner](https://github.com/mgerstner)*

## Timing attack due to a lack of constant time comparison for metrics view

### Summary

Due to the usage of a non-constant time comparison for the `/-/metrics/` endpoint it was possible to brute-force the `SECRET_KEY`, which is used to authenticate the endpoint. The `/-/metrics/` endpoint returns Prometheus metrics and is not intended to be accessed directly, as the Go proxy running in the authentik server container fetches data from this endpoint and serves it on a separate port (9300 by default), which can be scraped by Prometheus without being exposed publicly.

### Patches

authentik 2024.8.5 and 2024.10.3 fix this issue, for other versions the workaround below can be used.

### Impact

With enough attempts the `SECRET_KEY` of the authentik installation can be brute-forced, which can be used to sign new or modify existing cookies.

### Workarounds

Since the `/-/metrics/` endpoint is not intended to be accessed publicly, requests to the endpoint can be blocked by the reverse proxy/load balancer used in conjunction with authentik.

For example for nginx:

```
location /-/metrics/ {
    deny all;
    return 404;
}
```

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2025-29928

# CVE-2025-29928

## Deletion of sessions did not revoke sessions when using database session storage

### ADDENDUM May 30, 2025

As of version 2025.4, the option to store sessions in cache has been removed; sessions are now exclusively stored in the database. See our [2025.4 release notes](../../releases/2025/v2025.4.mdx#sessions-are-now-stored-in-the-database) for more information.

### Summary

When authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have access to authentik.

This also affects automatic session deletion when a user is set to inactive or a user is deleted.

The session backend was configured via the `AUTHENTIK_SESSION_STORAGE` setting, which was removed in version 2025.4.

### Patches

authentik 2025.2.3 and 2024.12.4 fix this issue.

### Workarounds

Switching to the cache-based session storage until the authentik instance can be upgraded is recommended. This will however also delete all existing sessions and users will have to re-authenticate.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2025-52553

# CVE-2025-52553

*Reported by [SPIEGEL-Verlag](https://gruppe.spiegel.de)*

## Insufficient Session verification for Remote Access Control endpoint access

### Summary

After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, however this check is currently missing.

### Patches

authentik 2025.4.3 and 2025.6.3 fix this issue.

### Impact

When for example using RAC during a screenshare, a malicious user could access the same session by copying the URL from the shown browser.

### Workarounds

As a workaround it is recommended to decrease the duration a token is valid for (in the RAC Provider settings, set **Connection expiry** to `minutes=5` for example). We also recommend enabling the option **Delete authorization on disconnect**.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2025-53942

# CVE-2025-53942

*Reported by [@pascalwei](https://github.com/pascalwei)*

## Insufficient check for account active status when authenticating with OAuth/SAML Sources

### Summary

Deactivated users that had either enrolled via OAuth/SAML or had their account connected to an OAuth/SAML account can still partially access authentik even if their account is deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application.

### Patches

authentik 2025.4.4 and 2025.6.4 fix this issue.

### Workarounds

Adding an expression policy to the user login stage on the respective authentication flow with the expression of

```py
return request.context["pending_user"].is_active
```

This expression will only activate the user login stage when the user is active.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2025-64521

# CVE-2025-64521

## Deactivated service account can authenticate to OAuth

### Summary

When authenticating with `client_id` and `client_secret` to an OAuth provider, authentik creates a service account for the provider. In previous authentik versions, authentication for this account was possible even when the account was deactivated. Other permissions are correctly applied and federation with other providers still take assigned policies correctly into account.

### Patches

authentik 2025.8.5 and 2025.10.2 fix this issue, for other versions the workaround below can be used.

### Workarounds

You can add a policy to your application that explicitly checks if the service account is still valid, and deny access if not.

```python
return request.user.is_active
```

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2025-64708

# CVE-2025-64708

*Reported by [@melizeche](https://github.com/melizeche)*

## Invitation expiry is delayed by at least 5 minutes

### Summary

In previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5 minutes because the cleanup of expired objects is scheduled to run every 5 minutes. However, with a large amount of tasks in the backlog, this might take longer.

### Patches

authentik 2025.8.5 and 2025.10.2 fix this issue; for other versions the workaround below can be used.

### Workarounds

You can create a policy that explicitly checks whether the invitation is still valid, and then bind it to the invitation stage on your invitation flow, and deny access if the invitation is not valid.

```python
return not context['flow_plan'].context['invitation'].is_expired
```

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-25227

# CVE-2026-25227

*Reported by [@rahulgovind](https://github.com/rahulgovind)*

## Authenticated Remote Code Execution via Policy/Property Mapping test endpoint

### Summary

When using delegated permissions, a User that has the permission **Can view \* Property Mapping** or **Can view Expression Policy** is able to execute arbitrary code within the authentik server container through the `test` endpoint, which is intended to preview how a property mapping/policy works.

### Patches

authentik 2025.8.6, 2025.10.4 and 2025.12.4 fix this issue; for other versions the workaround below can be used.

### Impact

Users with the view permissions specified above are able to execute arbitrary code that has access to the entire authentik database as well as any environment variables, allowing the user to escalate their permissions and fully take over an instance.

### Workarounds

If an upgrade is not possible, it is strongly recommended to un-assign the **Can view \* Property Mapping** and **Can view Expression Policy** permissions from any user that should not have administrative privileges, and treat them equal to the edit equivalent permissions.

It is also possible to block requests to the test endpoint, which have the following URLs:

( is a placeholder for any UUID.)

```
POST /api/v3/propertymappings/all/:uuid/test/
POST /api/v3/policies/all/:uuid/test/
```

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-25748

# CVE-2026-25748

*Reported by [@imlonghao](https://github.com/imlonghao)*

## Forward authentication bypass with malformed session cookie on Traefik and Caddy

### Summary

With a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik **Proxy Provider** when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific `X-Authentik-*` headers were set which depending on application can grant access to an attacker.

### Patches

authentik 2025.10.4 and 2025.12.4 fix this issue.

### Impact

Depending on the behavior of applications (based on if they require an `X-Authentik` header being present) behind the Proxy Provider, attackers are potentially able to gain full access to the application.

### Workarounds

There are no workarounds. If an upgrade is not possible, it is recommended to deactivate the reverse proxy entries for any applications using forward authentication until authentik can be upgraded.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-25922

# CVE-2026-25922

*Reported by [@odgrso](https://github.com/odgrso)*

## Signature Verification bypass in SAML Source Assertion

### Summary

When using a SAML Source that has the option **Verify Assertion Signature** under **Verification Certificate** enabled and not **Verify Response Signature**, or does not have the **Encryption Certificate** setting under **Advanced protocol settings** configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead.

### Patches

authentik 2025.8.6, 2025.10.4 and 2025.12.4 fix this issue, for other versions the workaround below can be used.

### Impact

Depending on configuration of the source it is possible to authenticate as any existing user.

### Workarounds

Configure the SAML Source to enable **Verify Response Signature** or the **Encryption Certificate** if possible.

If this isn't possible, add this property mapping expression on the SAML source to detect duplicate assertions:

```python
assertions = root.findall("{urn:oasis:names:tc:SAML:2.0:assertion}Assertion")
if len(assertions) > 1:
  raise ValueError("Multiple assertions found")
return {}
```

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-40165

# CVE-2026-40165

*Reported by [@kodareef5](https://github.com/kodareef5), [@Android-Login-Analysis](https://github.com/Android-Login-Analysis), and [@AyushParkara](https://github.com/AyushParkara)*

## SAML Source Fails to Validate Assertion Conditions

### Summary

Due to how authentik used to extract the NameID value from a SAML assertion, it was possible for an attacker to trick authentik into only seeing a part of the NameID value, potentially allowing an attacker to get access to other accounts.

### Patches

authentik 2025.12.5 and 2026.2.3 fix this issue, for other versions the workaround below can be used.

### Impact

This issue can be exploited given an authentik instance with a SAML Source, where the attacker has an account on the SAML Source and the ability to modify their NameID value (commonly username or E-mail), and XML Signing is enabled. The attacker can modify the SAML assertion given to authentik by injecting a comment within the NameID value, which effectively truncates the NameID value to the snippet before the comment, and give the attack access to any user account.

### Workarounds

Create a SAML Source property mapping with the following expression and add it to all SAML Sources:

```python
if name_id.text != "".join(name_id.itertext()):
  raise ValueError("Mismatched NameID")
return {}
```

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-40166

# CVE-2026-40166

*Reported by [@Colbascov](https://github.com/Colbascov)*

## Non-admin users can read confidential OAuth provider client secrets via the access token endpoint

### Summary

Authenticated non-admin users with at least one OAuth2 access token can retrieve the `client_secret` of confidential OAuth2 providers they have previously authenticated against, via `GET /api/v3/oauth2/access_tokens/`. The API response includes a nested `provider` object containing `client_id` and `client_secret` for providers configured with `client_type: confidential`, which should not be accessible to low-privilege users.

### Patches

authentik 2025.12.5 and 2026.2.3 fix this issue; for other versions the workaround can be used.

### Impact

Any authenticated non-admin user who has previously completed an OAuth2 flow against a confidential provider — and therefore has an access token object returned by `/api/v3/oauth2/access_tokens/` — can read that provider's `client_secret`. Exposure is limited to providers the user has access to and has logged into at least once; users cannot read secrets for providers they have never authenticated against. This could allow unauthorized reuse of confidential client credentials depending on the provider configuration.

### Workarounds

Restrict API access to `/api/v3/oauth2/access_tokens/` for non-admin users, or review and limit which users are permitted to complete OAuth2 flows against confidential providers until a patched version can be applied.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-41569

# CVE-2026-41569

*Reported by [@jmecom](https://github.com/jmecom) and [@AyushParkara](https://github.com/AyushParkara)*

## WS-Federation wreply Origin Bypass (CVE-2026-41569)

### Summary

The WS-Federation provider validates the user-supplied `wreply` parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a `wreply` value on a different origin that passes the check (e.g. `https://portal.example.com.evil.tld/`), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure.

### Patches

authentik 2025.12.5 and 2026.2.3 fix this issue.

### Impact

The WS-Federation sign-in processor accepted any `wreply` whose string value started with the configured Reply URL, not correctly comparing the domain.

Once accepted, the attacker-controlled `wreply` is used as the autosubmit destination, and the victim's browser immediately POSTs the signed WS-Federation response (`wresult`) to that URL. The response is a valid signed authentication artifact; in many relying-party configurations it is replayable to the legitimate ACS endpoint, enabling victim impersonation in the target application.

The fix replaces the string prefix check with proper URL parsing, comparing scheme, host, and path independently:

Only WS-Federation providers (an enterprise feature) with a prefix-ambiguous Reply URL are affected. If the Reply URL is already path-specific (e.g. `https://portal.example.com/wsfed/acs`), the host-extension bypass does not apply.

### Workarounds

Configure the WS-Federation provider's Reply URL with a specific path (e.g. `https://portal.example.com/wsfed/acs`) rather than a bare hostname. This prevents the host-extension bypass without patching, though upgrading is strongly preferred.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2026-42849

# CVE-2026-42849

*Reported by Jan Kahmen, [turingpoint GmbH](https://turingpoint.de/en/)*

## Reflected XSS in SFE

### Summary

Due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage.

### Patches

authentik 2025.12.5 and 2026.2.3 fix this issue.

### Impact

The SFE (Simple Flow Executor) was susceptible to an XSS exploit. This could allow an attacker to redirect web requests containing tokens, hijack the session or take other malicious actions.

This is possible when an OAuth2 provider is configured, either through the redirect\_uri when a very broad regex is used, or through the state value.

The SFE previously used jQuery without explicit sanitization, which, compared to the rest of our interfaces, did not sufficiently protect from malicious input values.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io).

---

## CVE-2026-47201

# CVE-2026-47201

## XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

### Summary

authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user.

### Patches

authentik 2026.5.1, 2026.2.4 and 2025.12.6 fix this issue.

### Impact

Affected: authentik deployments using a SAML Source for upstream SAML federation with signed assertions, or signed responses without signed assertions. Not affected: deployments that do not use SAML Source for upstream SAML federation.

The SAML Source trusts that the verified XML signature belongs to the assertion or response that authentik later consumes. A crafted SAML response can make signature verification succeed against the attacker's original signed assertion while authentik reads identity data from a different forged assertion.

An attacker first completes a legitimate login to the upstream IdP and captures the signed SAML response sent through their browser. They then submit a modified response to the ACS endpoint where the valid signature still verifies, but the consumed assertion contains a victim identifier or attacker-chosen attributes.

The attacker can authenticate as a victim who has previously used the SAML Source, or as a local user matched by forged email or username when those matching modes are enabled.

### Workarounds

Disable affected SAML Sources, or block access to their ACS endpoints.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2026-49443 / GHSA-xp7f-xjjx-gwm8

<!-- spellchecker:ignore GHSA-xp7f-xjjx-gwm8 -->

# CVE-2026-49443 / GHSA-xp7f-xjjx-gwm8

## SourceStage bypass via empty POST

### Summary

The Source stage can be bypassed by sending an empty POST.

### Patches

authentik 2026.5.1, 2026.2.4, and 2025.12.6 fix this issue.

### Impact

If a Source stage is bound to a flow and the source exposes a ui_login_button and an attacker can reach the Source stage, they can bypass that stage, effectively skipping authentication at that source.

### Workarounds

None. We recommend not using Source stages until upgrading to a suitable version.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto:security@goauthentik.io)

---

## CVE-2026-49443 / GHSA-5wcc-hf24-rf5h

# CVE-2026-49443 / GHSA-5wcc-hf24-rf5h

## `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

### Summary

An attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account.

### Patches

authentik 2026.5.1, 2026.2.4, and 2025.12.6 fix this issue.

### Impact

`UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API. This lets attackers with low privilege (`*_usersourceconnection`, `*_group*sourceconnection`) misrepresent users/groups as if they were coming from a specific source, with a specific identifier, then authenticate as the victim through that source and identifier.

### Workarounds

Ensure that `*_usersourceconnection`, `*_group*sourceconnection` permissions are only given to trusted admins.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2026-54730 / GHSA-3v9h-3hrm-29cx

# CVE-2026-54730 / GHSA-3v9h-3hrm-29cx

*Reported by [@dhairya7760](https://github.com/dhairya7760)*

## Google Chrome device trust stages can be bypassed

### Summary

The enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. An attacker who can reach such a stage can skip the verification iframe and pass the device-trust gate, completing authentication from a device that was never verified.

### Patches

authentik 2026.5.5 and 2026.2.6 fix this issue.

### Impact

**Affected: enterprise deployments that place a Google Chrome device-trust stage in a flow: either an `Endpoint` stage backed by a Google Chrome connector set to `mode = REQUIRED` (present in 2026.5 only), or the deprecated Google Chrome Device Trust Connector (GDTC) stage (present in all supported versions). Not affected: deployments that use neither stage, and `Endpoint` stages left at the default `mode = OPTIONAL`, which is not intended to block the flow.**

The device attestation happens out-of-band, in a verification iframe that calls Google's Verified Access API and records the verified device on success. The vulnerable stages treat the flow as having passed as soon as the stage is submitted, without confirming that this attestation actually completed.

An attacker who can otherwise reach the stage, for example after completing primary username and password authentication, can therefore satisfy it without any device being attested by Google, and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed; where other factors are present, those remain in force.

### Workarounds

None. We recommend not relying on the Google Chrome `Endpoint` stage or the GDTC stage as a security control until you upgrade.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2026-55106 / GHSA-h8ff-c3h7-2gf8

# CVE-2026-55106 / GHSA-h8ff-c3h7-2gf8

*Reported by [@geo-chen](https://github.com/geo-chen)*

## LDAP Source debug endpoint accessible without authorization

### Summary

A diagnostic action on LDAP Sources did not enforce the read-authorization check applied across the rest of the API, allowing any client, including unauthenticated ones, to retrieve directory information from a configured LDAP Source.

### Patches

authentik 2026.5.5 and 2026.2.6 fix this issue.

### Impact

**Affected: deployments with one or more LDAP Sources configured. Not affected: deployments without a configured LDAP Source.**

A diagnostic action on the LDAP Source API omitted the object-level permission filter that the API relies on to authorize read access, so the check that should restrict it to callers holding view permission on the source was never applied.

As a result, any party able to reach the API, including unauthenticated clients, could invoke the action against a configured source. This causes the server to connect to the upstream directory using the source's configured bind credentials and return a bounded set of directory entries. The exposed data is limited to the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not the values of those attributes.

### Workarounds

Restrict external access to the LDAP Source debug API endpoint at the reverse proxy or ingress until upgrading to a fixed version.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## CVE-2026-57580 / GHSA-35v6-hv2g-6992

# CVE-2026-57580 / GHSA-35v6-hv2g-6992

*Reported by [@XlabAITeam](https://github.com/XlabAITeam), [@vcth4nh](https://github.com/vcth4nh), [@ericchiang](https://github.com/ericchiang), [@LHeiakim](https://github.com/LHeiakim)*

## Account Takeover via SAML NameID Comment Truncation

### Summary

On a SAML Source that matches users by username or email, an attacker who inserts an XML comment into a validly signed assertion can bind their external identity to an existing account and authenticate as that user.

### Patches

authentik 2026.5.5 and 2026.2.6 fix this issue.

### Impact

**Only inbound SAML Sources configured with the non-default `USERNAME_LINK` or `EMAIL_LINK` user-matching mode and signed assertions are affected. Sources using the default unique-identifier matching mode are not affected, and the SAML Provider role (issuing assertions to downstream applications) is not affected.**

Exploitation requires an attacker who has an account on the source IdP and can set their own NameID. Injecting a comment into the NameID truncates the value used to match accounts to the text before the comment, while the signed assertion stays valid, so a NameID crafted to truncate to a victim's username or email matches that existing account.

This grants full takeover of any account the attacker can target, without the victim's password or the IdP's private key. The link persists, so later logins succeed without the comment.

### Workarounds

Add a SAML Source property mapping that rejects any assertion whose NameID or attribute values contain an XML comment. This blocks the attack without changing how identities are linked.

Alternatively, switch affected SAML Sources to the default unique-identifier user-matching mode, which uses the full NameID and is not exploitable. This changes how external identities are matched to local accounts.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-4r87-w2cx-fr3f

# GHSA-4r87-w2cx-fr3f

*Reported by [@kamil-sawicki](https://github.com/kamil-sawicki), [@savio-doyensec](https://github.com/savio-doyensec), and [@szybnev](https://github.com/szybnev)*

## Broken access control in Shared Signals Framework stream management

### Summary

The Shared Signals Framework checked permissions only when a stream was created. The operations that read, change, disable, or delete an existing stream did not, so a low privileged user of an application integrated with a Shared Signals Framework provider could act on that application's event streams without holding the permission required to manage them.

### Patches

authentik 2026.5.5 and 2026.2.6 fix this issue.

### Impact

**This affects only Enterprise deployments that use the Shared Signals Framework, where a provider is linked to an application as its backchannel provider and that application also issues access tokens to its users. Deployments that do not use the Shared Signals Framework are not affected.**

Creating a stream required an explicit permission on the provider, but the operations acting on an existing stream performed no equivalent check. Any user who can sign in to that application could reach these operations and act on the application's streams without holding the stream management permission.

The exposed operations differ by version. On 2026.2, only stream deletion is reachable. On 2026.5, the read, update, verify, and status operations are reachable as well. In all cases this breaks the integrity and availability of the receiver's security event feed. It did not allow redirecting delivery to an attacker chosen destination or retrieving stored delivery credentials.

### Workarounds

None. Until you can upgrade, we recommend not relying on the Shared Signals Framework for delivery of security events, as a stream's configuration cannot be protected from tampering by users of the linked application on affected versions.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-5wcc-hf24-rf5h

# GHSA-5wcc-hf24-rf5h

*Reported by [@bugbunny-research](https://github.com/bugbunny-research)*

## Unauthenticated Access via Client-Controlled X-Original-URI Header in Nginx Forward-Auth Mode

### Summary

In nginx forward-auth mode, the authentik outpost reads the forwarded request URL from a header that nginx does not set, but that a client can freely inject. By crafting this header to point at an internal outpost path, an unauthenticated attacker can cause the outpost to return HTTP 200 — causing nginx to forward the original request to the protected backend without authentication.

### Patches

authentik 2025.12.5 and 2026.2.3 fix this issue.

### Impact

This vulnerability only affects deployments using authentik's nginx forward-auth integration. Traefik, Caddy, and proxy mode deployments are not affected.

In nginx forward-auth mode, the outpost builds the URL it evaluates from a header that nginx never sets but clients can freely inject. Because nginx's `auth_request` module forwards all client headers to the authentication subrequest, an attacker-supplied value reaches the outpost unmodified.

The outpost unconditionally allows requests whose forwarded URL path begins with `/outpost.goauthentik.io/` (to permit internal endpoints such as the OAuth callback). An attacker can set the injected header to any path under that prefix, causing the outpost to return 200 and nginx to proxy the original request to the backend as if authenticated.

The attack requires only a single HTTP header — no account, session, or prior knowledge of the target application. Any resource behind the nginx gateway is accessible: reads, writes, and deletes depending on what the backend exposes. The CVSS 3.1 score is 10.0 (Critical).

### Workarounds

Operators can mitigate this immediately at the nginx layer by explicitly clearing the `X-Original-URI` header in the nginx location block that proxies traffic to the outpost. This prevents the attacker-supplied value from reaching the outpost regardless of the application-level logic. Refer to the nginx documentation for `proxy_set_header` to clear individual headers.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-cqj8-fxxf-9pg7

# GHSA-cqj8-fxxf-9pg7

*Reported by [@0xWerz](https://github.com/0xWerz), [@JebeenLee](https://github.com/JebeenLee), [@renmizo](https://github.com/renmizo), [@bhaswanthc](https://github.com/bhaswanthc), [@vcth4nh](https://github.com/vcth4nh), [@bozellqp](https://github.com/bozellqp), [@kanywst](https://github.com/kanywst), [@LoganCybersec](https://github.com/LoganCybersec), [@gigioneggiando](https://github.com/gigioneggiando), [@DavidCarliez](https://github.com/DavidCarliez)*

## Authentication bypass in SAML Sources via assertion confusion and replay

### Summary

A SAML Source accepted an assertion that its identity provider had issued for a different service provider, and it accepted the same assertion more than once. An actor who holds such an assertion could sign in as the user it names.

### Patches

authentik 2026.2.7, 2026.5.7 and 2026.8.2 fix this issue.

### Impact

**Only deployments with a SAML Source are affected. SAML Providers and every other Source type are not affected.**

The Source verified the signature and the validity period of an assertion. It did not verify that the identity provider had issued the assertion for the Source, or in answer to a login request from the Source. It kept no record of the assertions it had already accepted.

### Workarounds

None. We recommend not relying on a SAML Source until you upgrade.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-cxwx-9x59-28qm

# GHSA-cxwx-9x59-28qm

## Denial of Service via Malformed SAML Messages

### Summary

An unauthenticated attacker can send a specially formed SAML message that stops the worker process handling it, failing the requests that worker was serving at the time.

### Patches

authentik 2026.8.2, 2026.5.7 and 2026.2.7 fix this issue.

### Impact

**Only deployments that use SAML are affected, in both the identity provider and the source roles. No other protocol implementation is affected.**

The worker is restarted automatically. Sessions are held in the database, so they survive. While the messages continue, a share of legitimate traffic keeps failing.

### Workarounds

Requests to `/application/saml/*` and `/source/saml/*` can be blocked at the reverse proxy or load balancer level, which prevents this issue from being exploited. This disables SAML, so it is a stopgap until you can upgrade.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-h6c5-mpvq-j4jc

# GHSA-h6c5-mpvq-j4jc

*Reported by [@tonghuaroot](https://github.com/tonghuaroot), [@Uhudsavasindankacanokcu2](https://github.com/Uhudsavasindankacanokcu2), [@oduoke567](https://github.com/oduoke567), [@szybnev](https://github.com/szybnev), [@Hann1bl3L3ct3r](https://github.com/Hann1bl3L3ct3r), [@voraci0us](https://github.com/voraci0us), [@everping](https://github.com/everping), [@4dollar4](https://github.com/4dollar4), [@arthurscchan](https://github.com/arthurscchan), [@DavidKorczynski](https://github.com/DavidKorczynski), [@AdamKorcz](https://github.com/AdamKorcz), [@r0hanSH](https://github.com/r0hanSH), [@thefoulowl](https://github.com/thefoulowl), [@bayramshirinov](https://github.com/bayramshirinov), [@MayankPandey01](https://github.com/MayankPandey01), [@DavidCarliez](https://github.com/DavidCarliez), [@XlabAITeam](https://github.com/XlabAITeam), [@keenanwgn](https://github.com/keenanwgn), [@pkuGenuine](https://github.com/pkuGenuine), [@liangjs](https://github.com/liangjs), [@A7um](https://github.com/A7um), [@KasperBuilds](https://github.com/KasperBuilds), [@cipher-creator](https://github.com/cipher-creator), [@antigone4224](https://github.com/antigone4224), [@JebeenLee](https://github.com/JebeenLee), [@senti-man](https://github.com/senti-man), [@Rorasaurus](https://github.com/Rorasaurus), [@Alpastx](https://github.com/Alpastx), [@code-and-covfefe](https://github.com/code-and-covfefe), [@riyandhiman14](https://github.com/riyandhiman14), [@0xDvc-RE](https://github.com/0xDvc-RE), [@rodrigoarrelaro](https://github.com/rodrigoarrelaro), [@owen050724](https://github.com/owen050724), [@cy3erm](https://github.com/cy3erm), [@Sn1r](https://github.com/Sn1r), [@chndlrx](https://github.com/chndlrx), [@moizxsec](https://github.com/moizxsec), [@anthonyk2923](https://github.com/anthonyk2923), [@isazajuancarlos](https://github.com/isazajuancarlos)*

## Privilege escalation via delegated group and user management

### Summary

An account with delegated permission to manage a single group, or a single user, could grant superuser status to any account, and could assign an existing role to a group, without holding the permissions that gate those privileges.

### Patches

authentik 2026.2.7, 2026.5.7 and 2026.8.2 fix this issue.

### Impact

**Only deployments that delegate group, group membership or user management to accounts which are not full administrators are affected.**

Groups form a hierarchy, and superuser status is inherited from any group above, so a group can confer it without holding it itself. The checks on group membership and on the hierarchy either did not look for superuser status, or looked only at the group's own setting. Nothing checked the permission to assign a role to a group.

### Workarounds

Restrict the permissions to create and modify groups, to modify users, and to add users to groups, so that all of them are held only by accounts that are already full administrators.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-jpx7-5hcf-w9xp

# GHSA-jpx7-5hcf-w9xp

*Reported by [@szybnev](https://github.com/szybnev), [@Su1ph3r](https://github.com/Su1ph3r), [@bl4cksku11](https://github.com/bl4cksku11), [@XlabAITeam](https://github.com/XlabAITeam), [@arthurscchan](https://github.com/arthurscchan), [@DavidKorczynski](https://github.com/DavidKorczynski), [@AdamKorcz](https://github.com/AdamKorcz)*

## Remote Access Control endpoints and their stored credentials are exposed to any authenticated user, and connections can cross application boundaries

### Summary

The Remote Access Control (RAC) endpoint list returned every configured endpoint to any authenticated user, regardless of which applications they were allowed to access, and the response included connection settings that can hold stored credentials. Separately, a user who could launch one RAC application could open a connection to an endpoint belonging to a different application they were never granted.

### Patches

authentik 2026.5.5 and 2026.2.6 fix this issue.

### Impact

**Affected: deployments using the enterprise Remote Access Control provider. Endpoint enumeration affects every such deployment; credential exposure affects any deployment that stores connection credentials for its endpoints. Deployments that do not use Remote Access Control are not affected.**

The endpoint listing did not apply the access controls that govern the endpoints themselves, and the connection flow did not confirm that the endpoint being opened belonged to the application it was launched through.

Any authenticated user could read every endpoint together with its host and any credentials stored on it, and could reach endpoints outside the applications granted to them.

This exposes the stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach.

### Workarounds

None. We recommend not relying on Remote Access Control endpoint access rules until you upgrade, and rotating any connection credentials stored for RAC endpoints once you have.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-m9h4-7j9c-55x9

# GHSA-m9h4-7j9c-55x9

*Reported by [@0xWerz](https://github.com/0xWerz), [@szybnev](https://github.com/szybnev), [@Santoshkumarpuppala](https://github.com/Santoshkumarpuppala), [@gigioneggiando](https://github.com/gigioneggiando)*

## Certain stored credentials readable with view permission alone

### Summary

Several kinds of configuration store credentials. Reading such a configuration through the API returned those credentials, so view permission alone was enough to collect them.

### Patches

authentik 2026.2.7, 2026.5.7 and 2026.8.2 fix this issue.

### Impact

**Affected: deployments that grant view permission on a configuration to accounts that are not meant to read the credentials it stores. Not affected: deployments where every account with view permission on such a configuration may already read those credentials.**

This affects the configuration of one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications that authenticate with a client or shared secret, and applications that use a proxy provider.

### Workarounds

Revoke view permissions from every user, role and group that does not need them.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## GHSA-qgqp-xh8r-v73r

# GHSA-qgqp-xh8r-v73r

*Reported by [@CallumBasham](https://github.com/CallumBasham), [@MattWidz](https://github.com/MattWidz)*

## MFA bypass via recipient override in the email authenticator

### Summary

An actor who knows a user's password could have the one-time code for the email based multi-factor authenticator delivered to an address they control, and then finish signing in as that user.

### Patches

authentik 2026.2.7, 2026.5.7 and 2026.8.2 fix this issue.

### Impact

**Only deployments that enroll the email authenticator during an authentication or enrollment flow are affected. Other authenticator types are not affected.**

During setup of the authenticator, the address that received the code was taken from the setup request instead of the address the flow had already established.

The target must not have enrolled the factor yet. Completing the factor gives the actor a session as that user, and access to any single sign-on application behind the account.

### Workarounds

None. We recommend not relying on the email authenticator for multi-factor authentication until upgrading.

### For more information

If you have any questions or comments about this advisory:

- Email us at [security@goauthentik.io](mailto\:security@goauthentik.io)

---

## Event actions

Whenever any of the following actions occur, an event is created. Actions are used to define [Notification Rules](notifications.mdx).

### `login`

A user logs in (including the source, if available).

Example

```json
{
    "pk": "f00f54e7-2b38-421f-bc78-e61f950048d6",
    "user": {
        "pk": 1,
        "email": "root@localhost",
        "username": "akadmin"
    },
    "action": "login",
    "app": "authentik.events.signals",
    "context": {
        "auth_method": "password",
        "http_request": {
            "args": {
                "query": "next=%2F"
            },
            "path": "/api/v3/flows/executor/default-authentication-flow/",
            "method": "GET"
        },
        "auth_method_args": {}
    },
    "client_ip": "::1",
    "created": "2023-02-15T15:33:42.771091Z",
    "expires": "2024-02-15T15:33:42.770425Z",
    "brand": {
        "pk": "fcba828076b94dedb2d5a6b4c5556fa1",
        "app": "authentik_brands",
        "name": "Default brand",
        "model_name": "brand"
    }
}
```

### `login_failed`

A failed login attempt.

Example

```json
{
    "pk": "2779b173-eb2a-4c2b-a1a4-8283eda308d7",
    "user": {
        "pk": 2,
        "email": "",
        "username": "AnonymousUser"
    },
    "action": "login_failed",
    "app": "authentik.events.signals",
    "context": {
        "stage": {
            "pk": "7e88f4a991c442c1a1335d80f0827d7f",
            "app": "authentik_stages_password",
            "name": "default-authentication-password",
            "model_name": "passwordstage"
        },
        "password": "********************",
        "username": "akadmin",
        "http_request": {
            "args": {
                "query": "next=%2F"
            },
            "path": "/api/v3/flows/executor/default-authentication-flow/",
            "method": "POST"
        }
    },
    "client_ip": "::1",
    "created": "2023-02-15T15:32:55.319608Z",
    "expires": "2024-02-15T15:32:55.314581Z",
    "brand": {
        "pk": "fcba828076b94dedb2d5a6b4c5556fa1",
        "app": "authentik_brands",
        "name": "Default brand",
        "model_name": "brand"
    }
}
```

### `logout`

A user logs out.

Example

```json
{
    "pk": "474ffb6b-77e3-401c-b681-7d618962440f",
    "user": {
        "pk": 1,
        "email": "root@localhost",
        "username": "akadmin"
    },
    "action": "logout",
    "app": "authentik.events.signals",
    "context": {
        "http_request": {
            "args": {
                "query": ""
            },
            "path": "/api/v3/flows/executor/default-invalidation-flow/",
            "method": "GET"
        }
    },
    "client_ip": "::1",
    "created": "2023-02-15T15:39:55.976243Z",
    "expires": "2024-02-15T15:39:55.975535Z",
    "brand": {
        "pk": "fcba828076b94dedb2d5a6b4c5556fa1",
        "app": "authentik_brands",
        "name": "Default brand",
        "model_name": "brand"
    }
}
```

### `user_write`

A user is written to during a flow execution.

Example

```json
{
    "pk": "d012e8af-cb94-4fa2-9e92-961e4eebc060",
    "user": {
        "pk": 1,
        "email": "root@localhost",
        "username": "akadmin"
    },
    "action": "user_write",
    "app": "authentik.events.signals",
    "context": {
        "name": "authentik Default Admin",
        "email": "root@localhost",
        "created": false,
        "username": "akadmin",
        "attributes": {
            "settings": {
                "locale": ""
            }
        },
        "http_request": {
            "args": {
                "query": ""
            },
            "path": "/api/v3/flows/executor/default-user-settings-flow/",
            "method": "GET"
        }
    },
    "client_ip": "::1",
    "created": "2023-02-15T15:41:18.411017Z",
    "expires": "2024-02-15T15:41:18.410276Z",
    "brand": {
        "pk": "fcba828076b94dedb2d5a6b4c5556fa1",
        "app": "authentik_brands",
        "name": "Default brand",
        "model_name": "brand"
    }
}
```

### `suspicious_request`

A suspicious request has been received (for example, a revoked token was used).

### `password_set`

A user sets their password.

### `secret_view`

A user views a token's/certificate's data.

### `secret_rotate`

A token was rotated automatically by authentik.

### `invitation_used`

An invitation is used.

### `authorize_application`

A user authorizes an application.

Example

```json
{
    "pk": "f52f9eb9-dc2a-4f1e-afea-ad5af90bf680",
    "user": {
        "pk": 1,
        "email": "root@localhost",
        "username": "akadmin"
    },
    "action": "authorize_application",
    "app": "authentik.providers.oauth2.views.authorize",
    "context": {
        "asn": {
            "asn": 6805,
            "as_org": "Telefonica Germany",
            "network": "5.4.0.0/14"
        },
        "geo": {
            "lat": 42.0,
            "city": "placeholder",
            "long": 42.0,
            "country": "placeholder",
            "continent": "placeholder"
        },
        "flow": "53287faa8a644b6cb124cb602a84282f",
        "scopes": "ak_proxy profile openid email",
        "http_request": {
            "args": {
                "query": "[...]"
            },
            "path": "/api/v3/flows/executor/default-provider-authorization-implicit-consent/",
            "method": "GET"
        },
        "authorized_application": {
            "pk": "bed6a2495fdc4b2e8c3f93cb2ed7e021",
            "app": "authentik_core",
            "name": "Alertmanager",
            "model_name": "application"
        }
    },
    "client_ip": "::1",
    "created": "2023-02-15T10:02:48.615499Z",
    "expires": "2023-04-26T10:02:48.612809Z",
    "brand": {
        "pk": "10800be643d44842ab9d97cb5f898ce9",
        "app": "authentik_brands",
        "name": "Default brand",
        "model_name": "brand"
    }
}
```

### `source_linked`

A user links a source to their account.

### `impersonation_started` / `impersonation_ended`

A user starts/ends impersonation, including the user that was impersonated.

### `policy_execution`

A policy is executed (when a policy has "Execution Logging" enabled).

### `policy_exception` / `property_mapping_exception`

A policy or property mapping causes an exception.

### `system_task_exception`

An exception occurred in a system task.

### `system_exception`

A general exception in authentik occurred.

### `configuration_error`

A configuration error occurs, for example during the authorization of an application.

### `model_created` / `model_updated` / `model_deleted`

Logged when any model is created/updated/deleted, including the user that sent the request.

You can use these events in notification rule expression policies to automate actions, such as [creating LDAP users from authentik events](./notification_rule_expression_policies.mdx#create-ldap-users-from-authentik-events).

Starting with authentik 2024.2, when a valid enterprise license is installed, these entries will contain additional audit data, including which fields were changed with this event, their previous values and their new values.

### `email_sent`

An email has been sent. Included is the email that was sent.

### `update_available`

An update is available.

### `export_ready`

A data export has been generated.

---

## Events

Events are authentik's built-in logging system. Every event is logged, whether it is initiated by a user or by authentik.

Certain information is stripped from events to ensure that no passwords or other credentials are saved in the log.

## About notifications

Events can be used to define [notification rules](notifications.mdx), with specified [transport options](transports.mdx) of either local (shown in the authentik UI), email, or webhook.

## About logging

Event logging in authentik provides several layers of transparency about user and system actions, from a quick view on the Overview dashboard, to a full, searchable list of all events, with a volume graph to highlight any spikes, in the Admin interface under **Events > Logs**.

Refer to our [Logging documentation](./logging-events.mdx) for more information.

## Event retention and forwarding

The event retention setting is configured in the **System > Settings** area of the Admin interface, with the default being set to 365 days.

If you want to forward these events to another application, forward the log output of all authentik containers. Every event creation is logged with the log level "info". For this configuration, it is also recommended to set the internal retention time period to a short time frame (for example, `days=1`).

If you want to forward authentik events to another system, see [Log forwarding](./log-forwarding.mdx).

## Event map :ak-enterprise {#event-map}

The events overview renders login and audit event locations on a built-in map. By default authentik uses a bundled "hexworld" basemap: land drawn as a hexagonal grid at three zoom bands, with country, region, and locality labels layered on top. The archive ships as part of the web bundle, so the map draws with no tile server, no external service, and no online request, and it works in air-gapped deployments.

Event locations come from GeoIP and are city-accurate at best. The hex bands are sized to match: about 1000 km at world view, 400 km mid-range, and 130 km at closest zoom. Events raise their hex cell into a column — the fuller a cell, the taller the column — on a tilted globe. When a cell contains more than one kind of event, the column splits into pie wedges colored by kind: logins (green), failed logins (red), logouts (blue), application authorizations (purple), and everything else (gray). Clicking a column filters the event list below to that cell's events. Custom basemaps configured under **System** > **Brands** show the same event columns over the configured tiles.

Label data is derived from [OpenStreetMap](https://openstreetmap.org/copyright) (© OpenStreetMap contributors, ODbL). Land shapes are from Natural Earth (public domain).

### Using a conventional basemap instead

To replace the hexworld default with a conventional vector basemap, set a tile URL template on the brand under **System** > **Brands** — the **Map tiles** field takes either a `pmtiles://` archive URL or an XYZ endpoint like `/tiles/{z}/{x}/{y}.mvt`. Any non-empty value overrides the bundled default; leave it blank to keep hexworld.

---

## Log forwarding

authentik records system, user, and admin activity as events. You can keep those events in authentik for investigation and audit workflows, or forward them to another system when you need longer retention, centralized search, alerting, or correlation with infrastructure and application logs.

## Forward all event logs

Every authentik event creation is written to the container logs at the `info` log level. To collect all events, forward the log output from all authentik containers to your logging platform. This is the recommended option when you want a complete copy of authentik events outside authentik.

When another system becomes the long-term event store, consider reducing authentik's internal event retention period in **System** > **Settings**. For example, set the retention period to `days=1` if authentik only needs to keep a short local buffer.

## Forward selected events

To send selected events to another system, create an event matcher policy, a notification transport, and a notification rule. This forwards only events that match the notification rule, which is useful for security alerts, high-value audit events, or integrations that should receive a narrower event stream.

Notification transports can send events locally, by email, or to a webhook. Webhook transports can be adapted to systems that accept HTTP event ingestion.

## Log forwarding integrations

For an example of integrating with a log forwarder, see [Forward events to Splunk Enterprise](/integrations/log-forwarding/splunk-enterprise/). That guide uses Splunk HTTP Event Collector (HEC), a generic webhook notification transport, and a notification rule to forward matching authentik events.

---

## Logging events

Logs are a vital tool for system diagnostics, event auditing, user management, reporting, and more. They capture detailed information about each event including the client's IP address, the user involved, the date and time, and the specific action taken.

Event logging in authentik is highly configurable. You can set the [retention period](./index.mdx#event-retention-and-forwarding) for storing and displaying events, specify which events should trigger a [notification](./notifications.mdx), and access low-level details about when and where each event occurred.

## Troubleshooting with event logs

For guidance on troubleshooting with logs, including setting log levels (info, warning, etc.), enabling `trace` mode, viewing historical logs, and streaming logs in real-time, see [Capturing authentik logs](../../troubleshooting/logs/logs.mdx).

## Enhanced audit logging :ak-enterprise {#enhanced-audit-logging}

In the enterprise version, two enhancements make reading the logs even easier:

- the Event details page in the user interface presents abstracted and easily accessible information about each event in an easy-to-access table.

- for any event that involves the creation or modification of an object, the corresponding code differences are displayed, allowing for comparison of the previous and new configuration settings or values. For example, if an authentik administrator updates a user's email address, both the old and new email addresses are displayed in the event's detailed view. (In the open source version, event details only show that a change was made and which application and model was involved.)

![](./events-diffs.png)

You can view audit details in the following areas of the authentik Admin interface:

- **Admin interface** > **Dashboards** > **Overview**: In the **Recent events** section click an event name to view its details.

- **Admin interface** > **Events** > **Logs**: In the event list, click the arrow toggle next to the event you want to view.

## View events in maps and charts :ak-enterprise {#viewing-events-in-maps-and-charts}

With the enterprise version, you can view recent events on both a world map view with pinpoints indicating where each event occurred and also a color-coded chart that highlights event types and volume.

![](./event-map-chart.png)

## Export events :ak-enterprise {#export-events}

You can export your authentik instance's events to a CSV file. To generate a data export, follow these steps:

1. Log in to authentik as an administrator and navigate to **Events** > **Logs**.
2. Set a [search query](#advanced-queries) as well as the ordering, as needed. The data export will honor these settings.
3. Click **Export** above the event list.
4. Confirm the export parameters in the confirmation dialog.
5. Note that the export is processed in the background. Once the export is ready, you will receive a notification in the notification drawer.
6. In the notification, click **Download**.

To review, download, or delete past data exports, navigate to **Events** > **Data Exports** in the Admin interface.

## Advanced queries for event logs {#advanced-queries}

You can use AKQL to filter event logs in **Events** > **Logs**. For the event fields, operators, examples, and keyboard shortcuts, see the [AKQL reference](../akql.mdx).

---

## Notification Rule Expression Policies

[Notification rules](./notifications.mdx) with [bound expression policies](./notifications.mdx#3-create-a-notification-rule-and-bind-it-to-the-policy) can match event context, update related objects, and send custom messages. The following examples show common event-driven automation patterns.

## Send a welcome email to newly created users

This expression policy sends a welcome email to a user when their account is created through an enrollment flow, the Admin interface, the API, or a source sync (except LDAP). Instead of creating an administrator notification, it uses [`ak_send_email`](../../customize/policies/types/expression/reference.mdx) to email the new user directly.

### Prerequisites

authentik must be able to send email before you can use `ak_send_email`. Either configure the [global email settings](../../install-config/email.mdx), or set up an [Email stage](../../add-secure-apps/flows-stages/stages/email/index.mdx) and pass it to `ak_send_email` with the `stage` argument to use that stage's connection settings.

### Create the expression policy

1. Log in as an administrator, open the authentik Admin interface, and navigate to **Customization > Policies**.
2. Click **Create**, select **Expression Policy**, and click **Next**.
3. Give the policy a name, such as `send-welcome-email`.
4. Paste the expression below into the **Expression** field.
5. Click **Finish**.

```python
from authentik.core.models import User

event = request.context.get("event")
if not event:
    ak_logger.info("no event")
    return False

if event.action != "model_created":
    ak_logger.info("event action does not match")
    return False

model = event.context.get("model", {})
model_app = model.get("app")
model_name = model.get("model_name")

if model_app != "authentik_core" or model_name != "user":
    ak_logger.info("model does not match")
    return False

user_pk = model.get("pk")
user = User.objects.filter(pk=user_pk).first()

if not user:
    ak_logger.info("user not found")
    return False
if not user.email:
    ak_logger.info("user has no email address")
    return False

login_url = "https://authentik.company"
ak_send_email(
    user.email,
    "Welcome to authentik",
    body=(
        f"Hello {user.name},\n\n"
        f"Your authentik account has been created. You can log in at {login_url}."
    ),
)

# Return False so the notification rule does not create a notification object.
return False
```

### Bind the policy to a notification rule

The policy only runs when it is bound to a notification rule that triggers on the relevant events.

1. Navigate to **Events** > **Notification Rules**.
2. Click **New Notification Rule**.
3. Give the rule a name, such as `welcome-email`.
4. Leave **Send notification to event user** disabled, leave **Destination group** empty, and do not select a notification transport.
5. Click **Create Notification Rule**.
6. In the list of notification rules, click the arrow next to the new rule to expand the rule details.
7. Click **Create or bind...**. Under **Bind Existing...**, select **Bind an existing policy**.
8. In the **Create Binding** modal, select the `send-welcome-email` policy, and then click **Create**.

This pattern does not require a destination group or transport on the rule. As noted in [Notification Rules](./notifications.mdx#3-create-a-notification-rule-and-bind-it-to-the-policy), bound policies are executed even when no destination is selected. Because this policy returns `False`, authentik does not create a notification object. The email is sent entirely by the `ak_send_email` call inside the policy.

Matching on `model_created` ensures that the email is only sent when the account is first created. Other changes to the user, such as a password reset, are recorded as `model_updated` and do not trigger this policy.

To send a richer, branded message instead of plain text, replace the `body` argument with a `template` argument pointing to a [custom email template](../../add-secure-apps/flows-stages/stages/email/index.mdx#custom-templates), and pass any values the template needs through the `context` argument. See the [`ak_send_email` reference](../../customize/policies/types/expression/reference.mdx) for all available parameters.

To let the new user set their own password, point `login_url` at your recovery flow, for example `https://authentik.company/if/flow/default-recovery-flow/`. Replace `default-recovery-flow` with the slug of the flow you want to use. The user can then enter their email address and receive a password setup link. The flow must exist for the URL to work.

For the built-in ways to send a set-password link, see [User credentials recovery](../../users-sources/user/user_basic_operations.mdx#user-credentials-recovery).

## Create LDAP users from authentik events

Use this example when you create users in authentik and also need entries for them in an external LDAP directory, such as one used by other applications. LDAP source synchronization only imports users into authentik, so creating entries in the external directory requires custom automation.

This expression policy creates an `inetOrgPerson` entry on an external LDAP server for each user `model_created` event. It leaves existing LDAP entries unchanged and does not synchronize later changes or link the accounts.

Replace `my-ldap-source` with an enabled LDAP source's slug and `ou=users,dc=example,dc=com` with an existing target DN. The source's bind account needs permission to add entries there. Adapt the object classes and attributes, including the surname `sn`, to your directory.

```python
from ldap3.core.exceptions import LDAPEntryAlreadyExistsResult
from ldap3.utils.dn import escape_rdn

from authentik.core.models import User
from authentik.sources.ldap.models import LDAPSource

# Only handle user creation events, not updates or events for other models.
event = request.context.get("event")
if not event or event.action != "model_created":
    return False

model = event.context.get("model", {})
if model.get("app") != "authentik_core" or model.get("model_name") != "user":
    return False

# The user may have been deleted before this event is processed.
user = User.objects.filter(pk=model.get("pk")).first()
if not user:
    return False

# Replace the slug to use your source's connection settings and bind credentials.
source = LDAPSource.objects.get(slug="my-ldap-source", enabled=True)
conn = source.connection()
try:
    conn.add(
        # Replace the parent DN with your target container. Escape the username
        # so special characters cannot change the structure of the entry's DN.
        f"uid={escape_rdn(user.username)},ou=users,dc=example,dc=com",
        # Adapt these classes and attributes to your directory's schema.
        object_class=["top", "person", "organizationalPerson", "inetOrgPerson"],
        attributes={
            "uid": user.username,
            "cn": user.name or user.username,
            # inetOrgPerson requires sn. Use your surname attribute if available.
            "sn": user.name or user.username,
        },
    )
except LDAPEntryAlreadyExistsResult:
    # Reprocessing an event must not overwrite an existing LDAP entry.
    ak_logger.info("LDAP entry already exists; leaving it unchanged")
finally:
    conn.unbind()

# Suppress the notification object after performing the LDAP write.
return False
```

[Bind the expression policy to a notification rule](./notifications.mdx#3-create-a-notification-rule-and-bind-it-to-the-policy). No notification destination or transport is needed; returning `False` suppresses the notification after the LDAP write. LDAP source sync does not emit `model_created` events for imported users.

## Trigger alert when user logs in from unknown device

This expression policy matches login events from an unknown device. Use it with a notification rule to alert administrators, or enable **Send notification to event user** on the rule to alert the user who logged in.

```python
event = request.context.get("event")
if not event:
    ak_logger.info("no event")
    return False

if event.action != "login":
    ak_logger.info("event action does not match")
    return False

known_device = event.context.get("auth_method_args", {}).get("known_device")

if known_device is False:
    ak_logger.info("user logged in from unknown device")
    return True

return False
```

## Change user attributes upon account deactivation

This expression policy runs when a user account with the `sshPublicKey` attribute is deactivated. It moves the value to `inactiveSSHPublicKey`, clears `sshPublicKey`, and saves the updated user attributes.

```python
from authentik.core.models import User

event = request.context.get("event")
if not event:
    ak_logger.info("no event")
    return False

if event.action != "model_updated":
    ak_logger.info("event action does not match")
    return False

model = event.context.get("model", {})
model_app = model.get("app")
model_name = model.get("model_name")

if model_app != "authentik_core" or model_name != "user":
    ak_logger.info("model does not match")
    return False

user_pk = model.get("pk")
user = User.objects.filter(pk=user_pk).first()
if not user:
    ak_logger.info("user not found")
    return False

if user.is_active:
    ak_logger.info("user is active, not changing")
    return False

if not user.attributes.get("sshPublicKey"):
    ak_logger.info("no public keys to remove")
    return False

user.attributes["inactiveSSHPublicKey"] = user.attributes["sshPublicKey"]
user.attributes["sshPublicKey"] = []
user.save(update_fields=["attributes"])

return False
```

## Alert when application is created without binding

This expression policy matches newly created applications that do not have a user, group, or policy binding. Use it with a notification rule to alert an administrator, because an application without bindings can be accessed by all users by default.

```python
from authentik.core.models import Application
from authentik.policies.models import PolicyBinding

event = request.context.get("event")
if not event:
    ak_logger.info("no event")
    return False

if event.action != "model_created":
    ak_logger.info("event action does not match")
    return False

model = event.context.get("model", {})
model_app = model.get("app")
model_name = model.get("model_name")

if model_app != "authentik_core" or model_name != "application":
    ak_logger.info("model does not match")
    return False

application_pk = model.get("pk")
application = Application.objects.filter(pk=application_pk).first()
if not application:
    ak_logger.info("application not found")
    return False

if PolicyBinding.objects.filter(target=application).exists():
    ak_logger.info("application has bindings")
    return False

ak_logger.info("application has no bindings")
return True
```

## Append user addition history to group attributes

This expression policy runs when users are added to a group. It appends a timestamped entry to the group's `UserAddedHistory` attribute for each added user. This information is already available in the group's changelog, but the code can be used as a template for alerts or other event-driven updates.

This policy interacts with the `diff` event output. This field is only available with an enterprise license.

```python
from django.utils import timezone

from authentik.core.models import Group, User

event = request.context.get("event")
if not event:
    ak_logger.info("no event")
    return False

if event.action != "model_updated":
    ak_logger.info("event action does not match")
    return False

model = event.context.get("model", {})
model_app = model.get("app")
model_name = model.get("model_name")

if model_app != "authentik_core" or model_name != "group":
    ak_logger.info("model does not match")
    return False

group_pk = model.get("pk")
group = Group.objects.filter(pk=group_pk).first()
if not group:
    ak_logger.info("group not found")
    return False

added_user_pks = event.context.get("diff", {}).get("users", {}).get("add", [])
if not added_user_pks:
    ak_logger.info("user not added to group")
    return False

if not group.attributes.get("UserAddedHistory"):
    group.attributes["UserAddedHistory"] = []

current_date_time = timezone.now().isoformat(timespec="seconds")
users = User.objects.filter(pk__in=added_user_pks)

for user in users:
    group.attributes["UserAddedHistory"].append(
        f"{current_date_time} - Added user: {user.username}"
    )

group.save(update_fields=["attributes"])

return False
```

---

## Notification Rules

To prevent notification loops, events created by policies that are attached to any notification rule do not trigger notifications.

An authentik administrator can create notification rules for selected events. The authentik policy engine filters events through a policy that is bound to a notification rule.

## Workflow overview

To receive notifications about events, follow this workflow:

1. Create a notification transport (or use a default notification transport).
2. Create a policy.
3. Create a notification rule and bind the policy to the rule.

## 1. Create a notification transport

A notification transport determines how authentik delivers notifications to users. Supported delivery methods are local notifications in the authentik UI, email, and webhook. To create a notification transport, see [Create a notification transport](./transports.mdx#create-a-notification-transport).

## 2. Create a policy

Create a policy that defines which events trigger a notification. For simple conditions, use an Event Matcher policy. For custom logic, use an Expression policy.

### Event Matcher policy

For simple event matching, create and configure an [Event Matcher policy](../../customize/policies/types/event-matcher.mdx) to define which events trigger a notification. Use the policy's [AKQL query](../akql.mdx#use-akql-in-an-event-matcher-policy) when you need to match event context fields such as `context.geo.country` or `context.authorized_application.name`.

An event must match all configured fields in the policy. Otherwise, the notification rule does not trigger.

### Expression policy for events

To match events with an Expression policy, use code such as the following example:

```python
if "event" not in request.context:
    return False

return ip_address(request.context["event"].client_ip) in ip_network('192.0.2.0/24')
```

For more code examples, see [notification rule expression policies](./notification_rule_expression_policies.mdx).

## 3. Create a notification rule and bind it to the policy

After you create the policies to match the relevant events, create a notification rule.

1. Log in as an administrator, open the authentik Admin interface, and navigate to **Events** > **Notification Rules**.

2. Click **New Notification Rule** to add a new notification rule or click the **Edit** icon next to an existing rule to modify it.

3. Define the rule configuration, and then click **Create Notification Rule** or **Update** to save the settings.

- Policies are executed regardless of whether a destination is selected. Notifications are only created when a destination group is selected or **Send notification to event user** is enabled.
- Select which [notification transport](./transports.mdx) authentik uses to send the notification. Two notification transports are created by default:
  - `default-email-transport`: Delivers notifications via email using the [global email configuration](../../install-config/install/docker-compose.mdx#email-configuration-optional-but-recommended).
  - `default-local-transport`: Delivers notifications within the authentik UI.

4. In the list of notification rules, click the arrow in the row of the notification rule to expand the details of the rule.

5. Click **Create or bind...**. Under **Bind Existing...**, select **Bind an existing policy**. In the **Create Binding** modal, select the policy that you created for this notification rule, and then click **Create**.

---

## Notification Transports

To receive notifications about events, first [create a notification transport](#create-a-notification-transport), and then define a notification rule with a bound policy. For more information, see the [workflow overview](./notifications.mdx#workflow-overview).

## Notification transport modes

Notifications can be sent to users through multiple delivery methods, or *transports*:

- Local (in the authentik user interface)
- Email
- Webhook (generic)
- Webhook (Slack/Discord)

### Local

This notification transport creates a notification in the authentik UI.

### Email

Select this transport to send event notifications to an email address. By default, authentik uses the [global email configuration](../../install-config/install/docker-compose.mdx#email-configuration-optional-but-recommended).

To edit the email address used by the transport, update the global email configuration from your installation method.

### Webhook (generic)

This transport sends a POST request to the configured URL. The default body includes the notification body, severity, notification recipient, and triggering event user.

```json
{
    "body": "body of the notification message",
    "severity": "severity level as configured in the trigger",
    "user_email": "notification user's email",
    "user_username": "notification user's username",
    "event_user_email": "event user's email",
    "event_user_username": "event user's username"
}
```

The `Content-Type` header is set to `application/json`.

##### Webhook Certificate Authority

If the server in the webhook URL does not have a certificate issued by a public certificate authority, select a Certificate-Keypair to validate the server certificate. If no keypair is selected, authentik uses the root certificates from [mkcert.org](https://mkcert.org/).

#### Webhook mappings

You can use webhook mappings to configure the request payload, headers, or both. Webhook mappings are property mappings that can be applied to the **Webhook Body Mapping** or **Webhook Header Mapping** fields of the webhook notification transport.

##### Webhook body examples

The following webhook body mapping sets a `foo` key to the body of the notification:

```python
return {
    "foo": request.context['notification'].body,
}
```

You can also include fields from the notification recipient and the triggering event:

```python
return {
    "email": request.user.email,
    "client_ip": notification.event.client_ip,
}
```

For failed login notifications, the attempted username is stored in the event context. If the GeoIP and ASN context processors are configured, their data is also available in the event context:

```python
event = notification.event

return {
    "action": event.action,
    "username": event.context.get("username"),
    "client_ip": event.client_ip,
    "geo": event.context.get("geo"),
    "asn": event.context.get("asn"),
}
```

##### Webhook header example

The following webhook header mapping sets an authorization key:

```python
return {
  "Authorization": "Bearer <token>"
}
```

### Webhook (Slack or Discord)

This transport sends a request using the Slack-specific format. It is also compatible with Discord webhooks when you append `/slack` to the Discord webhook URL.

## Create a notification transport

1. Log in as an administrator, open the authentik Admin interface, and navigate to **Events** > **Notification Transports**.

2. Click **New Notification Transport** to add a new transport or click the **Edit** icon next to an existing notification transport to modify it.

3. Define the **Name** and **Mode** for the notification transport, enter required configuration settings, and then click **Create Notification Transport**.

---

## Backup and restore your authentik instance

This guide outlines the critical components to back up and restore in authentik.

## PostgreSQL database

The PostgreSQL database is the most important part of an authentik backup. Without it, authentik cannot be restored to a usable state.

### Backup

- The PostgreSQL database stores all persistent authentik data, including users, policies, flows, and configuration.
- Loss of this database means full application data loss.
- Use PostgreSQL-native tooling such as [`pg_dump`](https://www.postgresql.org/docs/current/app-pgdump.html), [`pg_dumpall`](https://www.postgresql.org/docs/current/app-pg-dumpall.html), or [continuous archiving](https://www.postgresql.org/docs/current/continuous-archiving.html).
- Exclude the PostgreSQL system databases `template0` and `template1`.
- Keep backups somewhere other than the database host when possible.

### Restore

- Restore the PostgreSQL database before bringing authentik back into service.
- Use PostgreSQL-native restore tooling such as [`pg_restore`](https://www.postgresql.org/docs/current/app-pgrestore.html) or `psql`, depending on how the backup was created.
- Verify that the restored database is complete before reconnecting authentik.

For deployment-specific PostgreSQL upgrade guides, see:

- [Upgrade PostgreSQL on Docker Compose](../../troubleshooting/postgres/upgrade_docker.mdx)
- [Upgrading PostgreSQL on Kubernetes](../../troubleshooting/postgres/upgrade_kubernetes.mdx)

For PostgreSQL connection settings, TLS, replicas, and pooler compatibility, see the [PostgreSQL configuration reference](../../install-config/configuration/configuration.mdx#postgresql-settings).

## Static directories

These directories are mounted as volumes in containerized installations and must be restored if they were part of the backup to maintain authentik’s expected functionality.

| Directory               | Purpose                                                                      | Backup and Restore Notes                                                                                                                                                             |
| ----------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **`/data`**             | Stores application icons, flow backgrounds, uploaded files, and CSV reports. | Only required if not using S3 external storage. External storage should be backed up using the [AWS S3 Sync](https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html) utility. |
| **`/certs`**            | Stores TLS certificates in the filesystem.                                   | Backup if you rely on these certificates present in the filesystem. Not needed if authentik has already imported them, as certificates are stored in the database.                   |
| **`/custom-templates`** | Stores custom changes to the authentik UI.                                   | Required if you modified authentik's default appearance.                                                                                                                             |
| **`/blueprints`**       | Stores blueprints.                                                           | Optional but recommended if using custom blueprints.                                                                                                                                 |

---

## GeoIP

# GeoIP

authentik supports GeoIP to add additional information to login/authorization/enrollment requests. Additionally, a [GeoIP Policy](../../customize/policies/types/geoip.mdx) can be used to make policy decisions based on the lookup result.

### Configuration

Starting with authentik 2022.12, GeoIP is bundled and does not require any additional setup.

By default, the GeoIP database is loaded from `/geoip/GeoLite2-City.mmdb`. If more frequent database updates are desired, a volume can be mounted to `/geoip` to update this file externally. authentik will automatically re-load the file when it changes.

### Deactivate GeoIP

If you want to disable GeoIP, you can set the path to a non-existent path and authentik will skip the GeoIP.

Add the following block to your `.env` file:

```shell
AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__GEOIP=/tmp/non-existent-file
AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__ASN=/tmp/non-existent-file
```

Afterwards, run the upgrade commands from the latest release notes.

Add the following block to your `values.yml` file:

```yaml
authentik:
    events:
        context_processors:
            geoip: "/tmp/non-existent-file"
            asn: "/tmp/non-existent-file"
```

Afterwards, run the upgrade commands from the latest release notes.

### External updates

[Create a free MaxMind account](https://www.maxmind.com/en/geolite2/signup).

Add the following block to a `compose.override.yml` file in the same folder as the authentik docker-compose file:

```yaml
services:
    server:
        volumes:
            - geoip:/geoip
    worker:
        volumes:
            - geoip:/geoip
    geoipupdate:
        image: "maxmindinc/geoipupdate:latest"
        volumes:
            - "geoip:/usr/share/GeoIP"
        environment:
            GEOIPUPDATE_EDITION_IDS: "GeoLite2-City GeoLite2-ASN"
            GEOIPUPDATE_FREQUENCY: "8"
            GEOIPUPDATE_ACCOUNT_ID: "*your account ID*"
            GEOIPUPDATE_LICENSE_KEY: "*your license key*"
volumes:
    geoip:
        driver: local
```

Afterwards, run the upgrade commands from the latest release notes.

Add the following block to your `values.yml` file:

```yaml
geoip:
    enabled: true
    accountId: "*your account ID*"
    licenseKey: "*your license key*"
    editionIds: "GeoLite2-City GeoLite2-ASN"
    image: maxmindinc/geoipupdate:v4.8
    updateInterval: 8
```

Afterwards, run the upgrade commands from the latest release notes.

---

## Monitoring

authentik can be easily monitored in multiple ways.

## Server monitoring

Configure your monitoring software to send requests to `/-/health/live/`, which will return a `HTTP 200` response as long as authentik is running. You can also send HTTP requests to `/-/health/ready/`, which will return `HTTP 200` if a PostgreSQL connection can be established correctly.

## Worker monitoring

The worker container can be monitored by running `ak healthcheck` in the worker container. This checks that the worker process is running and responding.

You can also send HTTP requests to `/-/health/ready/`, which will return `HTTP 200` if the worker processes are responding and a PostgreSQL connection can be established correctly. The worker serves this on the port set by [`AUTHENTIK_LISTEN__HTTP`](../../install-config/configuration/configuration.mdx#authentik_listen__http).

## Outpost monitoring

All outposts (proxy, LDAP, RADIUS, and RAC) listen on a separate port (9300) and can be monitored by sending HTTP requests to `/outpost.goauthentik.io/ping`.

***

Both Docker Compose and Kubernetes deployments use these methods by default to determine when authentik is ready after starting, and to only route traffic to healthy instances; unhealthy instances are restarted.

## Metrics

Both the core authentik server, worker and any outposts expose Prometheus metrics on a separate port (9300), which can be scraped to gather further insight into authentik's state. The metrics require no authentication, as they are hosted on a separate, non-exposed port by default.

You can download an [example Grafana dashboard](/monitoring/grafana-dashboard.json).

![](./dashboard.png)

---

## Worker

The authentik worker runs [background tasks](../background-tasks.mdx). The worker also watches for [blueprints](../../customize/blueprints/index.mdx#as-a-local-file) and [certificates](../certificates.mdx#external-certificates) that are added to the file system. It runs in a separate container from the server to handle these tasks.

## How it works

authentik tasks are stored and managed using its PostgreSQL database (installed with authentik). When authentik needs to run a background task, the following happens inside a PostgreSQL transaction:

- a row is inserted in a dedicated PostgreSQL table, containing all the relevant information needed to run the task.
- at the end of the transaction, a PostgreSQL trigger executes a `NOTIFY` command to send a notification to workers that a new task is available.

The worker runs a loop to find tasks that need to run:

- it tries to `LISTEN` on the tasks channel to pick up new tasks that were just queued. It only does so for a certain period of time (configurable with [`AUTHENTIK_WORKER__CONSUMER_LISTEN_TIMEOUT`](../../install-config/configuration/configuration.mdx#authentik_worker__consumer_listen_timeout)).
- if no task was received, it tries to find tasks that were not registered via a `NOTIFY` command. This happens when no worker is running when a task is created, or if the worker was busy running a different task. This is done by looking into the tasks table for tasks that aren't marked as finished (either successfully or unsuccessfully). On worker start, this is done before `LISTEN`, to process older tasks first.
- if a task is found or received, the worker grabs an advisory lock stating that it is responsible for the task. If several workers try to pick up the same task at the same time, only one of them will grab the task, and the others will continue without a task.
- if a task was found or received and the lock was properly acquired, the task is executed.
- if no task was found or the lock couldn't be acquired:
  - locks are cleaned up and deleted for tasks that are finished.
  - old tasks are purged at a regular interval, configurable with [`AUTHENTIK_WORKER__TASK_PURGE_INTERVAL`](../../install-config/configuration/configuration.mdx#authentik_worker__task_purge_interval). How long tasks are kept for is configurable with [`AUTHENTIK_WORKER__TASK_EXPIRATION`](../../install-config/configuration/configuration.mdx#authentik_worker__task_expiration).
  - the scheduler is run at a regular interval, configurable with [`AUTHENTIK_WORKER__SCHEDULER_INTERVAL`](../../install-config/configuration/configuration.mdx#authentik_worker__scheduler_interval).

### Task retries

When a task throws an exception, the worker will automatically try to re-run the task up to the value configured by [`AUTHENTIK_WORKER__TASK_MAX_RETRIES`](../../install-config/configuration/configuration.mdx#authentik_worker__task_max_retries). Those retries are done with an exponential backoff strategy; only after all retries are exhausted is the task marked as failed. Otherwise, the task stays in the "Running" status while the worker retries it. However, logs shown in the Admin interface are updated after each try.

### Time limits

All tasks have a time limit. If running a task takes longer than that limit, the task is canceled and marked as failed. The default time limit is configurable with [`AUTHENTIK_WORKER__TASK_DEFAULT_TIME_LIMIT`](../../install-config/configuration/configuration.mdx#authentik_worker__task_default_time_limit). Some tasks override that time limit for specific purposes, like synchronization.

## Manage the worker

### Scaling

How many workers are needed will depend on what tasks are expected to run. The number of tasks that can concurrently run is calculated as follows:

- worker replicas (1 for Docker Compose, defaults to 1 for the Helm chart but can be configured) *multiplied* by [`AUTHENTIK_WORKER__PROCESSES`](../../install-config/configuration/configuration.mdx#authentik_worker__processes) *multiplied* by [`AUTHENTIK_WORKER__THREADS`](../../install-config/configuration/configuration.mdx#authentik_worker__threads)

For example, let's say an LDAP source is configured with 1000 users and 200 groups. The LDAP source syncs the users first, then the groups, and finally memberships. All those steps are done by splitting the objects to synchronize into pages, of size [`AUTHENTIK_LDAP__PAGE_SIZE`](../../install-config/configuration/configuration.mdx#authentik_ldap__page_size). Let's say that setting is 50. That means there are `1000 / 50 = 20` pages of users, `200 / 50 = 4` pages of groups. We won't worry about the number of membership pages, because those are usually smaller than the previous ones.

This means that in this scenario, the maximum number of concurrent tasks will be 20, plus 1 as there is a "meta" task watching over the synchronization and managing the steps so they are executed in order. Thus, for the synchronization to run as fast as possible, there needs to be 21 available workers when it starts. However, other tasks might also be running at the same time, or might get created while the synchronization is running. Thus, we recommend having more workers than necessary to keep a buffer for those tasks.

On Kubernetes, you can [autoscale worker replicas with KEDA](./autoscaling/keda.mdx#worker-queue-length) based on the number of queued tasks.

### Monitor worker and tasks status

The workers expose metrics about their operation on [`AUTHENTIK_LISTEN__METRICS`](../../install-config/configuration/configuration.mdx#authentik_listen__metrics). These metrics include queue length, tasks in progress, processing attempts, errors, retries, rejected tasks, and task durations. Processing and error counters count attempts, including retries, rather than unique tasks.

The worker also has an available healthcheck endpoint. See [Monitoring](./monitoring.mdx#worker-monitoring) for details.

---

## Capturing authentik logs

When troubleshooting issues in authentik, reviewing the logs can be invaluable. These logs provide continuous output, helping to diagnose problems effectively.

For information on capturing standalone outpost logs, refer to [capturing standalone outpost logs](./outpost_logs.mdx).

## Adjust log levels

The server and worker containers support multiple log levels: `debug`, `info`, `warning`, and `error`. By default, the log level is set to `info`.

To modify the log level, follow the steps for your platform

1. Add the following environment variable to your docker deployment:

   ```shell
   AUTHENTIK_LOG_LEVEL=debug
   ```

2. Recreate your containers to apply the changes.

1) Add the following configuration to your `values.yml` file:

   ```yaml
   authentik:
       log_level: debug
   ```

2) Recreate your containers to apply the changes.

## Enable `trace` mode

The trace log level provides deeper insights, but be aware that using trace logs can expose sensitive information, including session cookies. Handle these logs with extreme caution and avoid using trace unless absolutely necessary.

To enable `trace` logging, follow the platform-specific steps below:

1. Add the following environment variable to your docker deployment:

   ```shell
   AUTHENTIK_LOG_LEVEL=trace
   ```

2. Recreate your containers to apply the changes.

After troubleshooting, reduce the log level from `trace` to avoid exposing sensitive information.

1. Modify your `values.yml` file:

   ```yaml
   authentik:
       log_level: trace
   ```

2. Recreate your containers to apply the changes.

After troubleshooting, reduce the log level from `trace` to avoid exposing sensitive information.

## View past logs

To review historical logs, you can use the `--since` option with both `docker logs` and `kubectl logs`. This option allows you to specify either a duration (e.g., `1m30s`, `3h`) or a specific timestamp (e.g., `2006-01-02T07:00`, `2006-01-02`) to view logs generated after that point in time.

For more details, see the [`docker logs` documentation](https://docs.docker.com/reference/cli/docker/container/logs/) and [`kubectl logs` documentation](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_logs/).

To retrieve logs from a specific timeframe, use:

```shell
docker logs <container_name_or_id> --since 5m
```

To fetch logs from a Kubernetes pod:

```shell
kubectl logs --since 5m <pod_name>
```

## Stream logs in real time

To continuously monitor logs, use the `--follow` (`-f`) option. This will stream log output to your terminal until manually stopped (`Ctrl + C` or closing the terminal).

To follow logs in real time:

```shell
docker logs <container_name_or_id> -f
```

To stream logs from a Kubernetes pod:

```shell
kubectl logs -f <pod_name>
```

---

## Capturing outpost logs

This guide only applies to standalone [outposts](../../add-secure-apps/outposts/index.mdx), the [embedded outpost](../../add-secure-apps/outposts/embedded/embedded.mdx) outputs to the same place as the server, refer to [Capturing authentik logs](./logs.mdx) for more information.

Standalone outposts continually output logs that can be helpful when troubleshooting issues. Just like when capturing authentik logs, the log level can be adjusted.

## Adjust log levels

Outpost containers support multiple log levels: `debug`, `info`, `warning`, and `error`. By default, the log level is set to `info`.

To modify the log level, follow the instructions below depending on your outpost deployment method:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Outposts** and click the **Edit** icon of the outpost that you're troubleshooting.
3. Under **Advanced settings** > **Configuration**, set `log_level` to `debug`, `info`, or `warning`.
4. Click **Update**.

The outpost will be redeployed with the new log level.

Outpost can be manually deployed via [Docker Compose](../../add-secure-apps/outposts/manual-deploy-docker-compose.mdx) or [Kubernetes](../../add-secure-apps/outposts/manual-deploy-kubernetes.mdx).

In each case, you need to add the following environment variable to the outpost container:

```yaml title="Docker Compose"
AUTHENTIK_LOG_LEVEL=debug
```

```yaml title="Kubernetes"
env:
- name: AUTHENTIK_LOG_LEVEL
    value: "debug"
```

Then, redeploy the outpost container for the change to take effect.

## Enable `trace` mode

The trace log level provides deeper insights, but be aware that using trace logs can expose sensitive information, including session cookies. Handle these logs with extreme caution and avoid using trace unless absolutely necessary.

To enable `trace` logging, follow the instructions below depending on your outpost deployment method:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Outposts** and click the **Edit** icon of the outpost that you're troubleshooting.
3. Under **Advanced settings** > **Configuration**, set `log_level` to `trace`.
4. Click **Update**.

The outpost will be redeployed with the `trace` log level.

After troubleshooting, reduce the log level from `trace` to avoid exposing sensitive information.

Outpost can be manually deployed via [Docker Compose](../../add-secure-apps/outposts/manual-deploy-docker-compose.mdx) or [Kubernetes](../../add-secure-apps/outposts/manual-deploy-kubernetes.mdx).

In each case, you need to add the following environment variable to the outpost container:

```yaml title="Docker Compose"
AUTHENTIK_LOG_LEVEL=trace
```

```yaml title="Kubernetes"
env:
    - name: AUTHENTIK_LOG_LEVEL
    value: "trace"
```

Then redeploy the outpost container for the change to take effect.

After troubleshooting, reduce the log level from `trace` to avoid exposing sensitive information.

## View past logs

To review historical logs, you can use the `--since` option with both `docker logs` and `kubectl logs`. This option allows you to specify either a duration (e.g., `1m30s`, `3h`) or a specific timestamp (e.g., `2006-01-02T07:00`, `2006-01-02`) to view logs generated after that point in time.

For more details, see the [`docker logs` documentation](https://docs.docker.com/reference/cli/docker/container/logs/) and [`kubectl logs` documentation](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_logs/).

To retrieve logs from a specific timeframe, use:

```shell
docker logs <container_name_or_id> --since 5m
```

To fetch logs from a Kubernetes pod:

```shell
kubectl logs --since 5m <pod_name>
```

## Stream logs in real time

To continuously monitor logs, use the `--follow` (`-f`) option. This will stream log output to your terminal until manually stopped (`Ctrl + C` or closing the terminal).

To follow logs in real time:

```shell
docker logs <container_name_or_id> -f
```

To stream logs from a Kubernetes pod:

```shell
kubectl logs -f <pod_name>
```

---

## Troubleshoot slow PostgreSQL queries

If authentik requests become slow, especially after a PostgreSQL upgrade or a large change to the database, PostgreSQL might be planning queries with outdated table statistics. Queries that join many tables can be especially sensitive to poor row estimates. PostgreSQL's just-in-time (JIT) compilation can add substantial latency when it spends more time compiling a query than executing it.

## Refresh table statistics

After restoring a database to a new PostgreSQL cluster, or after a large number of inserts, updates, or deletes, connect to the authentik database and refresh its planner statistics:

```sql
ANALYZE;
```

`ANALYZE` scans tables to collect statistics that PostgreSQL uses to choose query plans. For tables with many dead rows, run `VACUUM (ANALYZE);` instead. Run `VACUUM` outside a transaction block. Run routine maintenance on the PostgreSQL server as well, and keep [autovacuum enabled](https://www.postgresql.org/docs/current/runtime-config-autovacuum.html).

## Check whether JIT compilation adds latency

Run `EXPLAIN (ANALYZE, BUFFERS)` on a slow, read-only query and look for a `JIT` section. `EXPLAIN ANALYZE` executes the query, so do not use it with a query that changes data. The timing in the `JIT` section shows how long PostgreSQL spent generating, optimizing, and emitting compiled code. If JIT time accounts for most of the query time, refresh table statistics first. Better estimates can prevent PostgreSQL from choosing an expensive plan that triggers JIT unnecessarily.

If JIT compilation still dominates after refreshing statistics, you can disable JIT in the PostgreSQL server configuration or managed database settings. Apply a database-level setting to the authentik database when your provider supports it. Otherwise, apply it at the server level. Restart authentik's server and worker processes so they open new database connections and use the setting. Disabling JIT can slow some complex queries, so confirm the effect with your workload. See the PostgreSQL documentation for [JIT configuration](https://www.postgresql.org/docs/current/jit-configuration.html).

For PostgreSQL version upgrades, see the relevant guide for [Docker Compose](./upgrade_docker.mdx) or [Kubernetes](./upgrade_kubernetes.mdx).

---

## Upgrade PostgreSQL on Docker Compose

This guide describes a manual PostgreSQL major-version upgrade for the default authentik Docker Compose deployment.

It assumes the PostgreSQL service is named `postgresql` and the authentik database is named `authentik`. If your Compose file uses different names, adjust the commands accordingly.

## Before you start

- Make sure you have enough free disk space for:
  - a SQL dump of the database
  - a copy of the existing PostgreSQL data directory or volume
  - the newly initialized PostgreSQL data directory
- Expect downtime while the database is exported, recreated, and restored.
- Review the [Backup and restore](../../sys-mgmt/ops/backup-restore.mdx) guidance before proceeding.

## 1. Create a logical backup

Create a database dump:

```shell
docker compose exec postgresql pg_dump -U authentik -d authentik -cC > authentik-postgres-backup.sql
```

Before continuing, confirm that `authentik-postgres-backup.sql` exists and contains the expected database objects.

## 2. Stop your authentik stack

Stop all services with this command:

```shell
docker compose down
```

## 3. Back up the PostgreSQL data directory

Back up the existing PostgreSQL data before replacing it.

If you use Docker volumes:

```shell
docker volume create authentik_database_backup
docker run --rm -v authentik_database:/from -v authentik_database_backup:/to alpine sh -c 'cd /from && cp -a . /to'
```

You can find the exact name of the PostgreSQL volume with `docker volume ls` if it differs from `authentik_database`.

Alternatively, if your PostgreSQL data is stored on the host filesystem:

```shell
cp -a /path/to/postgres-data /path/to/postgres-data-backup
```

## 4. Remove the old data directory

Do not continue unless both the database dump and the filesystem or volume backup completed successfully.

If you use Docker volumes:

```shell
docker volume rm -f authentik_database
```

Alternatively, if your PostgreSQL data is stored on the host filesystem:

```shell
rm -rf /path/to/postgres-data
```

## 5. Update the PostgreSQL image

Edit your `compose.yml` and update the PostgreSQL image tag to the new major version.

For example, change:

```yaml
image: docker.io/library/postgres:12-alpine
```

to:

```yaml
image: docker.io/library/postgres:16-alpine
```

Temporarily add `network_mode: none` to the PostgreSQL service to prevent connections being established to the database during the upgrade.

## 6. Recreate PostgreSQL and restore the database

Pull images and start only PostgreSQL:

```shell
docker compose pull
docker compose up --force-recreate -d postgresql
```

Restore the logical backup:

```shell
cat authentik-postgres-backup.sql | docker compose exec -T postgresql psql -U authentik
```

After the restore succeeds, remove the temporary `network_mode: none` setting from `compose.yml`.

## 7. Start authentik again

Start the full stack:

```shell
docker compose up --force-recreate -d
```

## 8. Verify the upgrade

After the stack is healthy again:

- confirm that authentik loads normally
- check the server, worker, and postgresql logs for startup or migration errors
- log in to authentik through the UI to verify the application is functioning normally
- refresh PostgreSQL's planner statistics if authentik requests are slow after the upgrade. See [Troubleshoot slow PostgreSQL queries](./slow-queries.mdx).

---

## Upgrading PostgreSQL on Kubernetes

This guide walks through a manual PostgreSQL major-version upgrade for an authentik Kubernetes deployment. The process requires downtime while the database is exported, recreated, and restored.

For this guide, we assume the PostgreSQL pod is named `authentik-postgresql-0`, which is the default name in the authentik Helm chart.

## Before you start

- `kubectl` access with permissions to `scale` deployments and `exec` into pods
- the `values.yaml` file used for your authentik deployment
- enough storage for a SQL dump and a copy of the old database files
- a maintenance window long enough to export and restore the database

Review [Backup and restore](../../sys-mgmt/ops/backup-restore.mdx) before proceeding.

## Upgrade process

The upgrade flow is:

1. Stop authentik services
2. Back up the database
3. Prepare the data directory
4. Upgrade PostgreSQL
5. Restore database content
6. Restart authentik services

## 1. Stop authentik services

Scale down authentik so nothing accesses PostgreSQL during the upgrade:

```shell
kubectl scale deploy --replicas 0 authentik-server
kubectl scale deploy --replicas 0 authentik-worker
```

## 2. Back up the database

Connect to the PostgreSQL pod:

```shell
kubectl exec -it authentik-postgresql-0 -- bash
```

After you are connected, execute these commands to create a database backup:

```shell
# Navigate to the PostgreSQL data directory
cd /bitnami/postgresql/

# Set the PostgreSQL password from environment variable
export PGPASSWORD=$(cat $POSTGRES_PASSWORD_FILE)

# Create a full database dump
pg_dump -U $POSTGRES_USER $POSTGRES_DATABASE > /bitnami/postgresql/dump.sql
```

Copy the dump file to a safe location outside of the pod before continuing:

```shell
# From a separate terminal
kubectl cp authentik-postgresql-0:/bitnami/postgresql/dump.sql ./authentik-db-backup.sql
```

Keeping an external copy protects you if the pod or persistent volume is recreated unexpectedly.

## 3. Prepare the data directory

While still connected to the pod, prepare the data directory:

```shell
# Ensure you're in the PostgreSQL data directory
cd /bitnami/postgresql/

# Verify the SQL dump exists and has content
ls -lh dump.sql

# Preserve the existing data by renaming the directory
mv data data-old
```

Do not delete `data-old` yet. It provides a rollback path if the restore fails.

## 4. Upgrade PostgreSQL

Update `values.yaml` with the new PostgreSQL image tag:

```yaml
postgresql:
    image:
        tag: <NEW_VERSION>
```

Apply the change with Helm using your normal deployment command.

When the pod restarts with the new image, PostgreSQL initializes a new empty `data` directory because the previous one was renamed to `data-old`.

## 5. Restore database content

Connect to the PostgreSQL pod again:

```shell
kubectl exec -it authentik-postgresql-0 -- bash
```

Restore your database from the backup:

```shell
# Navigate to the PostgreSQL directory
cd /bitnami/postgresql/

# Verify your dump file is still there
ls -lh dump.sql

# Set the PostgreSQL password
export PGPASSWORD=$(cat $POSTGRES_PASSWORD_FILE)

# Import the database dump
psql -U $POSTGRES_USER $POSTGRES_DATABASE < dump.sql
```

## 6. Restart authentik services

After the restore completes successfully, scale authentik back up or re-run your Helm deployment so the server and worker return to their normal replica counts.

## 7. Verify the upgrade

After everything starts again:

- confirm the PostgreSQL pod is healthy
- check the PostgreSQL, server, and worker logs for startup or migration errors
- log in to authentik through the UI to verify the application is functioning normally
- refresh PostgreSQL's planner statistics if authentik requests are slow after the upgrade. See [Troubleshoot slow PostgreSQL queries](./slow-queries.mdx).

## Troubleshooting

If you encounter issues during the upgrade process:

- Check PostgreSQL logs:
  ```shell
  kubectl logs authentik-postgresql-0
  ```
- Verify the values in your `values.yaml` file match the recommended settings
- Ensure you have sufficient storage available for both the database dump and the database itself

### Dump file not found

If `dump.sql` is missing after the restart:

- You may need to restore from the external backup if you copied it out of the pod
- The volume might have been recreated if you're using ephemeral storage

### Restore the original database

If you need to roll back to the old PostgreSQL data directory:

```shell
kubectl exec -it authentik-postgresql-0 -- bash
cd /bitnami/postgresql/
mv data data-new-failed
mv data-old data
```

Then restart PostgreSQL with the original version in your `values.yaml`.

---

## Access control

To comply with important regulations such as PCI-DSS, HIPAA, SOC 2, and GDPR, it's necessary to have the ability to control which users have access to specific areas of the system, what [permissions](./permissions.mdx) they have globally and on certain objects, and a way to monitor [events](../../sys-mgmt/events/index.mdx) related to user activity.

In authentik, we provide role-based access control (RBAC), an industry standard for managing access control. By carefully designing roles with appropriate permissions, and then assigning those roles to groups, RBAC provides a fine-tuned approach to controlling user access.

RBAC is a way of ensuring the well-known [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) whereby "every module (such as a process, a user, or a program, depending on the subject) must be able to access only the information and resources that are necessary for its legitimate purpose."

To learn more about access control with authentik, refer to these topics:

---

## Initial permissions

Initial permissions automatically assigns [object-level permissions](./permissions.mdx#object-permissions) between a newly created object and its creator.

The purpose of initial permissions is to assign a specific role a set of pre-selected permissions that are required for users of that role to accomplish their tasks.

An authentik administrator creates an initial permissions object (a set of selected permissions) and then associates it with a role - when an object is created by a user of that role, the specified permissions are granted for that role on that object.

## Common use cases

Imagine you have a new team tasked with creating [flows](../../add-secure-apps/flows-stages/flow/index.mdx) and [stages](../../add-secure-apps/flows-stages/stages/index.mdx). These team members need the ability to view and manage all the flow and stage objects created by other team members. However, they should not have permissions to perform any other actions within the Admin interface.

In the example use case above, the specific objects that the users create and manage could be any object. For example, you might have a team responsible for creating new users and managing those user objects, but any other user object.

## High-level workflow

The fundamental steps to implement initial permissions are as follows:

1. Create a role. Initial permissions will be assigned whenever a user with this role creates a new object.
2. Create a group, and assign the new role to it, and add any members that you want to use the initial permissions set. You can also create new users later, and add them to the group.
3. Create an initial permissions object, and add all needed permissions to it.
4. Optionally, create additional users and add them to the group to which the role is assigned.

Because the new initial permissions object is coupled with the role (and that role is assigned to a group), the initial permissions object is applied automatically to any new objects (users or flows or any object) that the member user creates.

Typically, initial permissions are assigned to non-super-user, non-administrator roles. In this scenario, the administrator needs to verify that the user has the `Can access Admin interface` permission (which allows the user to access the Admin interface). For details, see Step 5 below.

Be aware that any rights beyond viewing the Admin interface will need to be assigned as well; for example, if you want a non-administrator user to be able to create flows in the Admin interface, you need to grant those global permissions to add flows.

## Create and implement initial permissions

To create a new set of initial permissions and apply them to a role, follow these steps:

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. [Create a new role](../roles/manage_roles.mdx): navigate to **Directory** > **Roles** and click **Create**.

3. [Create a new group](../groups/manage_groups.mdx): navigate to **Directory** > **Groups** and click **Create**. After creating the group:
   - [assign the new role to the group](../groups/manage_groups.mdx#assign-a-role-to-a-group)
   - [add any members](../user/user_basic_operations.mdx#add-a-user-to-a-group) that require the initial permissions. You can add already existing users, or [create new users](../user/user_basic_operations.mdx#create-a-user).

4. Create an initial permissions object: navigate to **Directory** > **Initial Permissions** and click **Create**. Configure the following settings:
   - **Name**: Provide a descriptive name for the new initial permissions object.

   - **Role**: Select the role to which you want to apply initial permissions. When a member of a group with this assigned role creates an object, initial permissions will be applied for that role to that object.

   - **Permissions**: select all permissions to add to the initial permissions object.

5. To ensure that the role to which you assign the initial permissions *also* has access to the Admin interface, check to see if the users also need [the global permission `Can access admin interface`](./manage_permissions.mdx#assign-can-access-admin-interface-permissions). Furthermore, verify that the user(s) has the global permissions to add specific objects.

6. Optionally, create new users and add them to the group. Each new user added to the group will automatically have the set of permissions included within the initial permissions object.

---

## Manage permissions

For instructions on viewing and managing permissions, see the following topics. To learn more about the concepts and fundamentals of authentik permissions, refer to [About Permissions](./permissions.mdx).

To learn about using Initial Permissions, a pre-defined set of permissions, refer to our [documentation](./initial_permissions.mdx).

## View permissions

You can view all permissions that are assigned to a user, group, role, flow, stage, or other objects.

### View permissions assigned for a specific role

To view permissions assigned for a specific role:

1. In the Admin interface, navigate to **Directory** > **Roles**.
2. Select a specific role by clicking on the name (this opens the details page).
3. Click the **Permissions** tab at the top of the page.
4. Select the **Assigned global permissions** sub-tab to see global permissions and the **Assigned object permissions** sub-tab to see the object permissions.

### View permissions on objects with a detail page

Here we'll use flows as an example for objects with a detail page.

1. In the Admin interface, navigate to **Flows and Stages** > **Flows**.
2. Click the name of the flow (this opens the details page).
3. View the assigned permissions by clicking the **Permissions** tab at the top of the page.
4. (Optionally) Hover over any checkmark to see whether that permission is granted by a global permission or an object permission.

### View permissions for objects without a detail page

Here we'll use stages as an example for objects without a detail page.

1. In the Admin interface, navigate to **Flows and Stages** > **Stages**.
2. On the row for the specific stage whose permissions you want to view, click the **lock icon**.
3. View the assigned permissions in the **Update Permissions** window.
4. (Optionally) Hover over any checkmark to see whether that permission is granted by a global permission or an object permission.

## Manage permissions

You can assign or remove permissions to a user, role, group, flow, stage, or other objects.

### Assign or remove permissions for a specific role

To assign or remove *object* permissions for a specific role:

1. In the Admin interface, navigate to **Directory** > **Roles**.
2. Select a specific role by clicking on the role's name.
3. Click the **Permissions** tab, and then click **Permissions on this object**.
4. To assign permissions that another *role* has on this specific role:
   1. Click **Assign Object Permission**.
   2. In the **Role** drop-down, select the role object.
   3. Use the toggles to set which permissions on that selected role object you want to grant to the specific role.
   4. Click **Assign** to save your settings and close the box.
5. To remove permissions that another *role* has on this specific role:
   1. Select the role you'd like to remove object permissions from.
   2. Click **Delete Object Permission**.

To assign or remove *global* permissions for a role:

1. In the Admin interface, navigate to **Directory** > **Roles**.
2. Select a specific role by clicking on the role's name.
3. Click the **Permissions** tab at the top of the page.
4. Click **Assigned global permissions** to the left.
5. To assign a permission:
   1. In the **Assign permissions** area, click **Assign permission**.
   2. In the **Assign permission to role** dialog, click the plus sign (**+**), and then select each permission that you want to assign.
   3. Click **Add**, and then click **Assign**.
6. To remove permissions that another *role* has on this specific role:
   1. Select the permission(s) you'd like to remove.
   2. Click **Delete Object Permission**.

### Assign `Can access admin interface` permissions

You can use a role to grant regular users, who are not superusers nor Admins, the right to view the Admin interface. This can be useful in scenarios where you have a team who needs to be able to create certain objects (flows, other users, etc) but who should not have *full* access to the Admin interface.

To assign the `Can access admin interface` permission to a role:

1. In the Admin interface, navigate to **Directory** > **Roles**.
2. Select a specific role by clicking on the role's name.
3. Click the **Permissions** tab at the top of the page.
4. Click **Assigned global permissions** to the left.
5. In the **Assigned global permissions** area, click **Assign permission**.
6. In the **Assign permission to role** box, click the plus sign (**+**), enter `admin` in the Search field and click the search icon.
7. Select the returned permission, click **Add**, and then click **Assign** to save your changes and close the box.

Be aware that any rights beyond viewing the Admin interface will need to be assigned as well; for example, if you want a non-administrator user to be able to create flows in the Admin interface, you need to grant those global permissions to add flows.

---

## About permissions

Permissions are the central, lowest-level components in all access control systems. They are assigned (or removed) to define exactly WHO can do WHAT to WHICH part of the overall software system.

Note that global and object permissions only apply to objects within authentik, and not to who can access certain applications (which are access-controlled using [policies](../../customize/policies/index.mdx)).

For instructions to add, remove, and manage permissions, refer to [Manage Permissions](./manage_permissions.mdx).

## Fundamentals of authentik permissions

A [role](../roles/index.mdx) is a collection of permissions. A user or a group can be assigned to any number of roles. A user has a certain permission if they have a role that also has that permission, or if they are part of a group (either directly or indirectly) that has a role which has that permission.

- Example 1 (no group): Judith has the role "RADIUS", which has every permission for RADIUS providers and property mappings. With this role, Judith has permission to add/view/change/delete RADIUS providers or RADIUS property mappings.
- Example 2 (direct group): Marie is part of the group "Auditors". That group has the role "Event Log manager", which in turn has the permissions "Can view Event", "Can change Event", and "Can delete Event". Thus, Marie has permissions to view, change, or delete Events.
- Example 3 (indirect group): Elaine is part of the group "Accounting", which has a parent group "Back office", which has a parent group "Employees". The group "Employees" has the role "Read-only", which has view permissions on all object types. So Elaine has the permission to view any object in authentik through indirect membership of the "Employees" group.

From 2025.12, authentik's access control is fully role-based. Before 2025.12, Admins could assign permissions to individual [users](../user/index.mdx). To mimic this behavior of "User permissions", an Admin can assign a user to a role that has the required permissions.

There are two main types of permissions in authentik:

- [**Global permissions**](#global-permissions)
- [**Object Permissions**](#object-permissions)

Additionally, authentik employs *initial permissions* to streamline the process of granting object-level permissions when an object (user or role) is created. When an Admin implements initial permissions, this feature automatically adds permissions for newly created objects to the role (and thus users with that role) that created them. For more details, refer to [Initial permissions](./initial_permissions.mdx).

### Global permissions

Global permissions define coarse-grained access control. For example, a role with a global permission of "Can change Flow" can change any [flow](../../add-secure-apps/flows-stages/flow/index.mdx). Some permissions only make sense as global permissions, e.g. the permission to add a specific object type or whether a user [`Can access admin interface`](./manage_permissions.mdx#assign-can-access-admin-interface-permissions).

### Object permissions

An object permission grants permission (via a role) on a single, specific object (e.g. a [user](../user/index.mdx), a [group](../groups/index.mdx), a [role](../roles/index.mdx), a [flow](../../add-secure-apps/flows-stages/flow/index.mdx), etc.) instead of all objects of a specific type.

For example, a role with the object permission to change only the Default Authentication flow will not be able to change any other flow.

## View permissions

Many objects in authentik's Admin interface have a **Permissions** tab, where you can check which roles have rights on that particular object. Those permissions describe what those roles can do *to* the object detailed on the page.

For example, the screenshot below shows the **Permissions** tab for the user named Peter, listing what actions the listed roles can perform on the user object "Peter".

![](./user-page.png)

You can see in the **Permissions on this object** table that the Admin role and one other role (Read-only) have permissions on Peter (that is, on the user object named Peter). The Admin role has all object permissions on this object, while the Read-only role has only the view permission.

Hover over a checkmark to see whether that permission is granted by a global permission or an object permission.

---

## Group properties and attributes

## Object properties

The group object has the following properties:

- `name`: The group's display name.
- `group_uuid`: The group's unique id.
- `is_superuser`: A boolean field that determines if the group's users are superusers.
- `parents`: The parent groups of this group.
- `roles`: The roles directly assigned to this group.
- `all_roles()`: Returns all roles for this group, including roles inherited from parent groups.
- `attributes`: Dynamic attributes, see [Attributes](#attributes).

## Examples

These are examples of how group objects can be used within authentik policies and property mappings.

### List all group members

Use the following examples to list all users that are members of a group:

```python title="Get all members of a group object"
group.users.all()
```

```python title="Specify a group object based on name and return all of its members"
from authentik.core.models import Group
Group.objects.get(name="name of group").users.all()
```

### List all roles for a group

Use the following examples to list roles assigned to a group:

```python title="Get directly assigned roles for a group object"
group.roles.all()
```

```python title="Get all roles including inherited from parent groups"
group.all_roles()
```

## Attributes

By default, authentik group objects are created with no attributes, however custom attributes can be set.

See [the user reference](../user/user_ref.mdx#attributes) for well-known attributes.

---

## Groups

For information about creating and editing groups refer to [Manage groups](./manage_groups.mdx).

## Hierarchy

Groups can be children of other groups. Members of children groups are effective members of the parent group.

When you bind a group to an application or flow, any members of any child group of the selected group will have access.

## Attributes

Attributes of groups are recursively merged, for all groups the user is a member of. For more information, see [Group properties and attributes](./group_ref.mdx).

---

## Manage groups

A group is a collection of users. Refer to the following sections to learn how to create and manage groups, assign users and roles to groups, and how [permissions](../access-control/manage_permissions.mdx) work on a group level.

## Create a group

To create a new group, follow these steps:

1. In the Admin interface, navigate to **Directory > Groups**.
2. Click **Create** at the top of the Groups page.
3. In the Create box, define the following:
    - **Name** of the group
    - Whether or not users in that group will all be **super-users** (means anyone in that group has all permissions on everything)
    - Any **Parent** groups
    - Select **Roles** to apply to this group
    - Any custom attributes
4. Click **Create**.

To create a super-user, you need to add the user to a group that has super-user permissions. All members of that group are super-users.

Super-user permission is inherited by all descendant groups. Make sure you review every member of every descendant group to prevent accidentally granting super-user permission.

Starting with authentik 2026.2.7, 2026.5.7 and 2026.8.2, selecting a **Parent** group that grants super-user permission requires the `Enable superuser status` permission, and selecting **Roles** requires the `Can change Role` permission.

## Advanced queries for groups {#advanced-queries}

You can use AKQL to filter the group list in **Directory** > **Groups**. For the group fields, operators, examples, and keyboard shortcuts, see the [AKQL reference](../../sys-mgmt/akql.mdx).

## Modify a group

To edit the group's name, parent groups, whether the group grants superuser permissions, associated roles, and any custom attributes, click the Edit icon beside the role's name. Make the changes and then click **Update**.

Starting with authentik version 2025.2, the permission to change super-user status has been separated from the permission required to change the group. Now, the `Enable superuser status` and `Disable superuser status` permissions are explicitly required to enable and disable the super-user status.

Starting with authentik 2026.2.7, 2026.5.7 and 2026.8.2, the `Enable superuser status` permission is also required to add a **Parent** group that grants super-user permission, either directly or through one of its own parent groups. Changing a group's **Roles** requires the `Can change Role` permission. That requirement applies to the group's own **Roles** field; roles assigned to a parent group continue to be inherited by the groups below it.

To [add or remove users](../user/user_basic_operations.mdx#add-a-user-to-a-group) from the group, or to manage permissions assigned to the group, click on the name of the group to go to the group's detail page and then click on the **Permissions** tab.

## Delete a group

To delete a group, follow these steps:

1. In the Admin interface, navigate to **Directory > Groups**.
2. Select the checkbox beside the name of the group that you want to delete.
3. Click **Delete**.

## Assign a role to a group

You can assign a role to a group, and then all users in the group inherit the permissions assigned to that role. For instructions and more information, see [Assign a role to a group](../roles/manage_roles.mdx#assign-a-role-to-a-group).

Roles are inherited through group hierarchy. If a parent group has a role assigned, all child groups (and their users) automatically inherit that role's permissions. You can view both directly assigned and inherited roles on a group's detail page under the **Roles** tab.

Because roles are inherited, the permission to change a group also determines which roles that group's members hold, through the group's **Parent** groups. Only delegate it to accounts that are trusted to grant the roles assigned anywhere above that group in the hierarchy.

## Bind a group to an application

These bindings control which groups can access an application and whether the application is visible on a group member's **Application Dashboard** page. If an application has no bindings, all users can access the application.

For instructions, see [Bind a user or group to an application](../../add-secure-apps/applications/manage_apps.mdx#bind-a-user-or-group-to-an-application).

## Delegate group member management

To give a specific role or user the ability to manage group members, the following permissions need to be granted on the matching group object:

- Can view group
- Can add user to group
- Can remove user from group
- Can access admin interface (for managing a group's user within the authentik Admin interface)

In addition, the permission "Can view User" needs to be assigned, either globally or on specific users that should be manageable.

These permissions can be assigned to a [Role](../roles/index.mdx).

Starting with authentik 2026.2.7, 2026.5.7 and 2026.8.2, the `Enable superuser status` permission is also required to add a member to a group that grants super-user permission, either directly or through one of its parent groups. Removing a member is not affected.

---

## Roles

Roles are a way to simplify the assignment of permissions. Roles are also the backbone of role-based access control (RBAC), an industry standard for managing [access control](../access-control/index.mdx). In authentik, RBAC is how you manage access to system components and specific objects such as flows, stages, users, etc.

Think of roles as a collection of permissions. A role, along with its "bucket" of assigned permissions, can then be assigned to a user, or it can be assigned to a group (which means that every user who is a part of that group will inherit all of the permissions in that role's "bucket").

Roles are also inherited through group hierarchy. When a role is assigned to a parent group, all child groups automatically inherit that role. This means users in any descendant group will have the permissions from roles assigned to any of their ancestor groups.

For example, let's take a look at the following scenario:

> You need to add 5 new users, all new hires, to authentik, your identity management system. These users will be the first team members on the brand new Security team, so they will need some high-level permissions, with object permissions to create and remove other users, revoke permissions, and send recovery emails. They will also need [global permissions](../access-control/permissions.mdx#fundamentals-of-authentik-permissions) to control access to flows and stages.

The easiest workflow for setting up these new users involves [creating a role](./manage_roles.mdx#create-a-role) specifically for their type of work, and then [assigning that role to a group](./manage_roles.mdx#assign-a-role-to-a-group) to which all of the users belong.

## View roles for users and groups

You can view the roles assigned to a user or group through their detail pages in the Admin interface.

### User roles

To view roles for a user:

1. Navigate to **Directory > Users** and click on a user's name.
2. Click the **Roles** tab.
3. The tab has two sub-tabs:
   - **Assigned Roles**: Shows roles directly assigned to this user.
   - **All Roles**: Shows all roles the user has, including roles inherited from groups they belong to. Inherited roles are marked with an "Inherited" label.

### Group roles

To view roles for a group:

1. Navigate to **Directory > Groups** and click on a group's name.
2. Click the **Roles** tab.
3. The tab has two sub-tabs:
   - **Assigned Roles**: Shows roles directly assigned to this group.
   - **All Roles**: Shows all roles the group has, including roles inherited from parent groups. Inherited roles are marked with an "Inherited" label.

To learn more about working with roles in authentik, refer to the following topics:

---

## Manage roles

Roles are a collection of permissions, which can then be assigned, en masse, to a user or a group. Using roles is a way to quickly grant permissions; by adding a user to a group with the appropriate assigned roles, any user in that group then inherits all of those permissions that are assigned to the role.

Roles are intended to be assigned to groups, not to individual users. However, in some cases it's practical to assign a role straight to a user, so authentik implements that functionality.

## Create a role

To create a new role, follow these steps:

1. In the Admin interface, navigate to **Directory > Roles**.
2. Click **New Role**, enter the name of the role, and then click **Create Role** to save.
3. Next, [assign permissions for the role](../access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role).

## Modify a role

To modify a role, follow these steps:

- To edit the name of the role, click the Edit icon beside the role's name.

- To modify the permissions that are assigned for the role, click the role's name to go to the role's detail page. There you can add or remove permissions. For more information, refer to ["Assign or remove permissions for a specific role"](../access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role).

## Delete a role

To delete a role, follow these steps:

1. In the Admin interface, navigate to **Directory > Roles**.
2. Select the checkbox beside the name of the role that you want to delete.
3. Click **Delete**.

## Assign a role to a group

1. To assign the role to a group, navigate to **Directory > Groups**.
2. Click the name of the group to which you want to add a role.
3. On the group's detail page, on the Overview tab, click **Edit** in the **Group Info** area.
4. On the **Update Group** box, in the **Roles** field, select the roles you want to assign to the group from the list of **Available Roles** in the left box (you can select multiple roles at once by holding the Shift key while selecting the roles), and then click the appropriate arrow icon to move them into the **Selected Roles** box.
5. Click **Update** to add the role(s) and close the box.

Starting with authentik 2026.2.7, 2026.5.7 and 2026.8.2, assigning a role to a group requires the global `Can change Role` permission, in addition to the permission to change the group. The permission assigned on a specific role is not sufficient. This applies to a group's own **Roles** field; a group also inherits the roles of its parent groups, which is governed by the permission to change the group.

## Assign a role to a user

See [add user to a role](../user/user_basic_operations.mdx#add-a-user-to-a-role).

---

## Sources

Sources allow you to connect authentik to an external user directory. Sources can also be used with social login providers such as Facebook, X, or GitHub.

## Find your source

Sources are in the following general categories:

- **Protocols** ([Kerberos](./protocols/kerberos/index.mdx), [LDAP](./protocols/ldap/index.mdx), [OAuth](./protocols/oauth/index.mdx), [SAML](./protocols/saml/index.mdx), and [SCIM](./protocols/scim/index.mdx))
- [**Property mappings**](./property-mappings/index.mdx) or how to import data from a source
- **Directory synchronization** (Active Directory, FreeIPA)
- **Social logins** (Apple, Discord, Twitch, Twitter, and many others)

For instructions to add a specific source, refer to the documentation links in the left navigation pane.

Several source types also expose an **Icon** field that uses the shared file picker. See [File picker values](../../customize/file-picker.mdx).

## Add sources to default login page

To show sources on the default login screen, add them to the flow. The process below assumes that you have not created or renamed the default stages and flows.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**.
3. Click the **default-authentication-flow**.
4. Click the **Stage Bindings** tab.
5. Click **Edit Stage** on the **default-authentication-identification** stage.
6. Under **Source settings**, add sources to **Selected Sources** to have them displayed on the authentik login page.

## Bind a policy to a source

You can bind a policy to a source to control whether or not the users from the source can access an application.

For instructions, refer to [Bind a policy to a source](../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-source).

---

## About users

In authentik you can create and manage users with fine-tuned access control, session and event details, group membership, role assignment, super-user rights, impersonation, and password management and recovery.

To learn more about Enterprise licenses with internal and external users, refer to [Manage Enterprise licensing](../../enterprise/manage-enterprise.mdx#about-users-and-licenses).

To learn more about working with users in authentik, refer to the following topics:

---

## Invitations

Invitations are another way to create a user, by inviting someone to join your authentik instance as a new user. With invitations, you can either email an enrollment invitation URL to one or more specific recipients with pre-defined credentials, or you can email a URL to users, who can then log in and define their own credentials.

You can configure invitations either by:

- using the [invitation wizard](#use-the-invitation-wizard) (recommended; creates the enrollment flow and the invitation in one guided process).
- using [pre-built blueprints](#use-pre-built-blueprints-to-configure-invitations) (good for showcasing multiple flow variations).
- [manually creating flows and stages](#manual-setup-without-blueprints) (for custom configurations).

You can also create a [policy](../../../customize/policies/) to check whether the invitation was ever used.

## Use the invitation wizard

The invitation wizard, available from the **Directory** > **Invitations** page in the Admin interface, walks you through creating an invitation and (optionally) the enrollment flow it binds to in a single guided process.

### Step 1. Open the wizard

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Invitations**.
3. Click the caret (>) next to the **New Invitation** button and choose how the wizard should handle the invitation:

   - **with Existing Enrollment Flow\...**: bind the new invitation to an existing enrollment flow. Only enrollment flows that have an invitation stage bound to them are listed. This is also what the **New Invitation** button does by default.
   - **with New Enrollment Flow and Invitation Stage...**: create a new minimal enrollment flow, including an invitation stage, then bind the invitation to it. Use this option when you do not yet have an enrollment flow set up, or when you want a separate enrollment flow for an invitation.

   If you choose **with Existing Enrollment Flow\...** and only one eligible flow exists, the wizard skips the flow selection step and takes you directly to the invitation details.

### Step 2. Configure the enrollment flow

- If you picked an existing flow, select it from the **Enrollment flow** drop-down and click **Next**.
- If you are creating a new flow, fill in:
  - **Flow Name**: display name of the new enrollment flow.
  - **Flow Slug**: the slug for the flow which is included in the URL.
  - **Invitation Stage Name**: name of the invitation stage that will be bound to the new flow.
  - **User type**: the user type for users enrolled via this flow.
  - **Continue flow without invitation**: when enabled, the flow proceeds to the next stage even when no invitation token is supplied. When disabled, the flow is canceled if a valid invitation is not provided.

### Step 3. Configure the invitation details

- **Name**: provide a slug-style name for your invitation object (lowercase letters, numbers, and hyphens only).
- **Expires**: select a date and time for when the invitation should expire. Defaults to 48 hours from now.
- **Flow**: read-only; reflects the flow chosen in the previous step.
- **Custom attributes**: (*optional*) YAML or JSON that authentik adds to the flow's `prompt_data`. The data can set built-in user properties, such as `name` and `email`, and custom user attributes under `attributes`. A key only needs to match a field in the flow's [prompt stage](../../add-secure-apps/flows-stages/stages/prompt/index.mdx) if you want the value to appear in that field. See the [example custom attributes](#step-3-create-the-invitation-object) below.
- **Single use**: when enabled, the invitation is deleted after the first successful enrollment.

Click **Next** to create the invitation. If you chose **with New Enrollment Flow and Invitation Stage...**, the supporting blueprint is imported at this point as well.

### Step 4. Share the invitation

After the invitation is created, the wizard's final step shows the **Link to use the invitation**. From there you can:

- Click **Copy Link** to copy the invitation URL to your clipboard.
- Click **Send via Email** to open the email step inside the wizard. Enter:

  - **To**: one email per line, or comma/semicolon separated. Each recipient receives a separate email.
  - **CC** / **BCC**: (*optional*) recipients for carbon and blind carbon copies.
  - **Template**: the email template to use (the default `Invitation` template is recommended).

  Click **Send** to queue the emails. They are sent asynchronously by the background worker. Check **System Tasks** for delivery status.

To send invitation emails, you must have configured email in authentik. Refer to the [Email configuration](../../install-config/email.mdx) documentation for details.

## Use pre-built blueprints to configure invitations

The fastest way to configure invitations in authentik is to use our pre-defined blueprints that have the necessary flows, stages, and prompts already included.

### Step 1. Download a blueprint

We have two pre-defined blueprints, the`Example - Invitation-based Enrollment` blueprint and the `Example - Enrollment (2 Stage)`blueprint.

- #### Option 1: Download the `Example - Invitation-based Enrollment` blueprint (Recommended)

  This blueprint provides several examples of how to configure different invitation features and serves as a helpful starting point:

  - Separate flows for external and internal users
  - An example of [automatic group assignment](#automatic-group-assignment) (creates an example group called `engineering-team`)
  - [User path organization](#user-paths)
  - Five example invitations demonstrating different use cases

  Download the `Example - Invitation-based Enrollment` blueprint by running this command:

  ```shell
  wget https://goauthentik.io/blueprints/example/flows-invitation-enrollment.yaml
  ```

  Alternatively, use this link to view and save the file.

- #### Option 2: Download the `Example - Enrollment (2 Stage)` blueprint

  For a simpler invitation flow that doesn't include separate flows for internal/external user types, [automatic group assignment](#automatic-group-assignment), and [set user paths](#user-paths), download the `Example - Enrollment (2 Stage)` blueprint by running this command:

  ```shell
  wget https://goauthentik.io/blueprints/example/flows-enrollment-2-stage.yaml
  ```

  Alternatively, use this link to view and save the file.

### Step 2. Import the blueprint file

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click **Import**.
3. Click **Choose file**, select the blueprint file that you downloaded, and then click **Import**.

### Step 3. Create the invitation object

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Invitations** and click **New Invitation**.

   The Create Invitation box appears.

![Create an invitation modal](./create_invite.png)

Configure the following settings:

- **Name**: provide a name for your invitation object.
- **Expires**: select a date for when you want the invitation to expire.
- **Flow**: In the drop-down menu, select the enrollment flow to use (`invitation-enrollment-flow-external`, `invitation-enrollment-flow-internal`, `invitation-enrollment-flow-internal-engineering`, or ` default-enrollment-flow` depending on which blueprint you used).
- **Custom attributes**: (*optional*) Enter JSON or YAML to add data to the flow's `prompt_data`, for example to pre-fill prompt fields or set custom user attributes.

Example custom attributes:

**Pre-fill email only (JSON)**:

```json
{
    "email": "user@example.com"
}
```

**Pre-fill multiple fields (YAML)**:

```yaml
name: Dominic Roy
email: dominic.roy@company.com
```

**Set built-in properties and custom user attributes (JSON)**:

```json
{
    "name": "Dominic Roy",
    "email": "dominic.roy@company.com",
    "attributes": {
        "department": "Engineering",
        "employee_type": "contractor",
        "family_name": "Roy",
        "given_name": "Dominic",
        "start_date": "2025-01-15"
    }
}
```

Dotted keys that match prompt fields work as well:

```json
{
    "attributes.family_name": "Roy",
    "attributes.given_name": "Dominic"
}
```

authentik adds the invitation's custom attributes to the flow's `prompt_data`. A later [User Write stage](../../add-secure-apps/flows-stages/stages/user_write/index.mdx) stores keys such as `email` and `name` on the user, along with an `attributes` dictionary or dotted keys such as `attributes.department`. A key only needs to match a prompt field if you want the value to appear in that field.

For an end-to-end example, see [Collect custom user attributes during enrollment](../../add-secure-apps/flows-stages/flow/collect-user-attributes.mdx).

- **Single use**: Specify whether the invitation should expire after a single use.
  - Enable for invitations sent to specific individuals.
  - Disable for invitations shared with multiple people (e.g., department onboarding links).

3. Click **Save**.

### Step 4. Share the invitation

On the **Invitations** page, click the chevron beside your new invitation to expand the details. The **Link to use the invitation** displays with the URL.

You can share the invitation in two ways:

#### Option 1: Copy the link manually

Copy the URL and send it in an email to the people you want to invite to enroll.

The invitation link format is:

```
https://authentik.company/if/flow/<flow-slug>/?itoken=<invitation-uuid>
```

#### Option 2: Send an invitation email directly from authentik

Follow the steps below to send invitation emails directly from authentik:

1. On the **Invitations** page, click the chevron beside your invitation to expand the details.
2. Click **Send via Email** and configure the following settings:
   - **To**: Enter the email addresses of the recipients. You can enter multiple addresses, one per line, or separated by commas or semicolons. Each recipient will receive a separate email with the invitation link.
   - **CC**: (*optional*) Enter the email addresses to carbon copy.
   - **BCC**: (*optional*) Enter the email addresses to blind carbon copy.
   - **Template**: Select the email template to use. The default `Invitation` template is recommended.
3. Click **Send**.

The emails are queued and sent asynchronously by the background worker. Each recipient receives an email containing the invitation link.

To use this feature, you must have email configured in authentik, refer to the [Email configuration](../../install-config/email.mdx) documentation for details.

## Manual setup (without blueprints)

If you prefer to create your invitation flow manually instead of using a blueprint, follow these steps:

### Step 1: Create an Invitation stage

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Flows and Stages** > **Stages** and click **New Stage**.

3. Select **Invitation Stage** from the stage type list.

4. Configure the stage:
   - **Name**: Provide a descriptive name (e.g., `enrollment-invitation-stage`)
   - **Continue flow without invitation**:
     - Set to `false` if you want to require a valid invitation token (recommended for invitation-only flows).
     - Set to `true` if you want to allow both invited and non-invited users to use the same enrollment flow.

5. Click **Create Stage**.

The **Continue flow without invitation** setting determines whether users can proceed through the flow without a valid invitation token. When set to `false`, only users with valid invitation links can complete enrollment.

### Step 2: Create or modify an Enrollment flow

1. Navigate to **Flows and Stages** > **Flows**.
2. Either create a new flow or edit an existing enrollment flow:
   - **Name**: Provide a descriptive name.
   - **Title**: Enter the title shown to users during enrollment.
   - **Slug**: Enter a unique identifier (e.g., `invitation-enrollment`).
   - **Designation**: Must be set to **Enrollment**.
   - **Authentication**: Set to **Require unauthenticated** (users shouldn't be logged in to enroll).

### Step 3: Bind the Invitation stage to the flow

1. In your enrollment flow, go to the **Stage Bindings** tab.

2. Click **Bind Stage** and select your invitation stage.

3. Configure the binding:
   - **Order**: Set to a low number (e.g., `5` or `10`) so it evaluates early in the flow.
   - **Evaluate on plan**: Enable this option so the invitation is validated when the flow starts.
   - **Re-evaluate policies**: Enable this to ensure policies are checked.

4. Add other necessary stages to your flow (in order):
   - **Prompt Stage** for collecting credentials (username, password)
   - **Prompt Stage** for collecting user details (name, email)
   - **User Write Stage** to create the user account
   - **User Login Stage** to log the user in after enrollment

### Step 4: Create invitations

Now you can create invitations that reference your custom flow. Follow the steps in [Create the invitation object](#step-3-create-the-invitation-object) above.

## Advanced features

### Automatic group assignment

To automatically add users to a group when they enroll via invitation, you need to configure the enrollment flow's User Write Stage:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Stages**.
3. Create or edit a **User Write Stage** used by your enrollment flow.
4. Set **Create users group** to your desired group.
5. All users enrolling through that flow will automatically be added to the selected group.

Groups cannot be set directly in invitation custom attributes because they require database relationships. They must be configured at the flow/stage level.

### User paths

[User paths](user_ref.mdx#path) organize users in a directory structure (e.g., `users/external`, `users/internal/engineering`). To configure user paths:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Stages**.
3. Create or edit a **User Write Stage** used by your enrollment flow.
4. Set **User path template** to your desired path.
5. All users enrolling through that flow will be created under that path.

### Expression policies with invitations

You can use [expression policies](../../../customize/policies/types/expression/) to make decisions based on invitation data:

```python
# Check if user was invited
return context.get('invitation_in_effect', False)

# Access invitation data
invitation = context.get('invitation')
if invitation:
    return invitation.fixed_data.get('department') == 'Engineering'

# Access pre-filled prompt data
prompt_data = context.get('prompt_data', {})
return prompt_data.get('email', '').endswith('@example.com')
```

## Troubleshooting

### "Permission denied" error for external users

**Problem**: External user sees "Interface can only be accessed by internal users" after enrollment.

**Solution**: Configure a Default Application in your brand settings (System → Brands) so external users have somewhere to go after login.

### Invitation not working

Possible causes:

- Invitation has expired (check the expiration date)
- Single-use invitation has already been used
- Flow slug doesn't match the invitation's configured flow
- Invitation stage is not bound to the flow

### Pre-filled data not appearing

Possible causes:

- Field keys in custom attributes don't match your prompt field keys.
- Prompt fields are marked as `placeholder_expression: true`.
- The invitation stage is not evaluated before prompt stages in the flow.

### Invitation data not stored on the user

Possible causes:

- The enrollment flow does not include a [User Write stage](../../add-secure-apps/flows-stages/stages/user_write/index.mdx), or the stage runs before the Invitation or Prompt stages.
- The custom attributes use a key such as `department` instead of an `attributes` dictionary or a dotted key such as `attributes.department`.

### Application receives a default or empty value

If the value appears in the user's attributes but not in the application, review the provider's [property mappings](../../add-secure-apps/providers/property-mappings/index.mdx). Storing an attribute on a user does not send that value through a provider. For OAuth2/OIDC, also confirm that the scope mapping is assigned to the provider and that the application requests the scope.

Be aware that when an authentik administrator or any other user creates an invitation link, that link remains valid even if the administrator is deactivated or has permissions revoked. However, if the user who created the link is deleted and removed from the authentik system, the link is also deleted.

---

## Force password reset on next login

You can require users to reset their password on their next login, using expression policies, custom stages, and a custom user attribute. This guide explains how to configure this with the `default-authentication-flow`; however, the same steps apply to any authentication flow.

Configuring forced password reset on next login involves the following steps:

1. Creating two expression policies.
2. Creating and binding two stages to the active authentication flow.
3. Binding the expression policies to the stages.
4. Setting a custom user attribute which triggers the password prompt.

## Create expression policies

You'll need to create two expression policies; one that checks the value of a custom user attribute on the user account attempting to log in, and another that resets the value of the custom user attribute.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Customization** > **Policies** and click **Create** to set up the first policy.

3. Select **Expression Policy** as the policy type, click **Next**, and configure the following settings:
   - **Name**: Provide a descriptive name for the policy (e.g. `reset_password_check`).
   - **Expression**:

     ```python
     # Check if the "reset_password" attribute set to true for the pending user
     if request.context["pending_user"].attributes.get("reset_password") == True:
         return True

     return False
     ```

4. Click **Finish** to save the first policy, then repeat the steps to create the second policy using the following settings:
   - **Name**: Provide a descriptive name for the policy (e.g. `reset_password_update`).
   - **Expression**:

     ```python
     # Check if the "reset_password" attribute is set to true for the pending user
     if request.context["pending_user"].attributes.get("reset_password") == True:
         # Reset the "reset_password" attribute to false to prevent forcing a password reset on next login
         request.context["pending_user"].attributes["reset_password"] = False
         return True

     return False
     ```

5. Click **Finish**.

## Create stages

You'll need to create two stages; a *Prompt stage* to prompt the user to enter a new password, and a *User Write stage* to update the user's account with the new password. Both stages will need to be bound to the active authentication flow, typically the `default-authentication-flow`.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click on the name of the active authentication flow, typically the `default-authentication-flow`.
3. Select the **Stage Bindings** tab and click **Create and bind stage**.
4. Select **Prompt Stage** as the stage type, click **Next**, and configure the following settings for the stage:
   - **Name**: Provide a descriptive name for the stage (e.g. `Force Password Reset Prompt Stage`).
   - Under **Fields**:
     - Click the `x` icon between **Available Fields** and **Selected Fields** to clear the selections.
     - Select `default-password-change-field-password` and `default-password-change-field-password-repeat`.
   - Under **Validation Policies**:
     - Click the `x` icon between **Available Policies** and **Selected Policies** to clear the selections.
     - *(Optional but recommended)* Select `default-password-change-policy`.

Optionally, you can create and add a text field to the prompt stage to inform users that they are required to reset their password. For more details on configuring this, refer to the [Prompt Stage documentation](../../add-secure-apps/flows-stages/stages/prompt/index.mdx).

5. Click **Next** to create the stage and then configure the following settings for the binding:
   - **Order**: `25` or any number higher than the `default-authentication-password` stage order and lower than the `default-authentication-mfa-validation` stage order.
   - Leave the other settings as their default values.

6. Click **Finish** to create the binding and repeat the process for the second stage using the following settings:
   - **Stage type**: Select **User Write Stage** as the type.
   - **Name**: Provide a descriptive name for the stage (e.g. `Force Password Reset User Write Stage`).
   - Leave the other settings as their default values.

7. Click **Next** to create the stage and then configure the following settings for the binding:
   - **Order**: `26` or any number higher than the `Force Password Reset Prompt Stage` stage order and lower than the `default-authentication-mfa-validation` stage order.
   - Leave the other settings as their default values.

8. Click **Finish** to create the binding.

## Bind policies to stages

You will need to bind the previously created policies to the newly created stages. Specifically:

- The `reset_password_check` policy needs to be bound to the `Force Password Reset Prompt Stage`.
- The `reset_password_update` policy needs to be bound to the `Force Password Reset User Write Stage`.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click on the name of the active authentication flow, typically `default-authentication-flow`.
3. Select the **Stage Bindings** tab and click the arrow next to the newly created `Force Password Reset Prompt Stage` to expand it.
4. Click **Bind existing Policy / Group / User**.
5. Set **Policy** to `reset_password_check` and click **Create**.
6. Click the arrow next to the newly created `Force Password Reset User Write Stage` to expand it.
7. Click **Bind existing Policy / Group / User**.
8. Set **Policy** to `reset_password_update` and click **Create**.

## Set custom user attribute

To require a user to reset their password on next login, you will need to set a custom user attribute on their account.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Users** and click the **Edit** icon of the user in question.
3. Add the following values to the user's **Attribute** field:
   ```python
   reset_password: True
   ```
4. Click **Update**.

The next time the user logs in, they will be required to reset their password, and the `reset_password` attribute on their account will be set to `False`.

---

## User interface

End-users who are accessing their applications via authentik typically only access the User interface, not the Admin interface. (There are exceptions; some end-users have [permissions to also access the Admin interface](../../users-sources/access-control/manage_permissions.mdx#assign-can-access-admin-interface-permissions), while some end-users never go to the User interface, but rather [log directly into their application](/customize/branding/index.mdx#external-user-settings) using authentik behind the scenes.)

Conversely, administrators for an authentik instance work primarily in the Admin interface; that is where administrators add applications, create new users and groups, manage system settings, and more.

This document covers the basic tasks that end-users accomplish in the User interface. All of our technical documentation is available to all users, just note that the vast majority of it is for the Admin interface because the User interface is for simple end-user tasks.

## Access the User interface

As an end-user, you will typically first see the User interface when you log in to authentik. The main page of the User interface is the **Application Dashboard** page, where you can find all of the applications that you access through authentik.

To view your own settings click the gear icon in the upper right. The following sections are displayed on the page:

### User details

This section of the User interface displays (and allows you to edit if you have the requisite permissions) the fields below. Note that these are the options available in a default authentik instance; administrators can customize which options show up here.

- **Username**: the username is the unique identifier associated with the user, and is required for logging in. This value can only be edited by the user if the [global System settings](../../sys-mgmt/settings.mdx#allow-users-to-change-username) are configured to allow all users to change their username, or if the attribute [`goauthentik.io/user/can-change-username`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-username) has been added to the **Attributes** field for a specific user (overriding the global System setting).
- **Name**: a display name, or nickname, for the user. Similar to the username, this value can be set globally in [System settings](../../sys-mgmt/settings.mdx#allow-users-to-change-name), or per user with the attribute [`goauthentik.io/user/can-change-name`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-name).
- **Email**: the email address for the user. This value also can be set globally in [System settings](../../sys-mgmt/settings.mdx#allow-users-to-change-email), or if the attribute [`goauthentik.io/user/can-change-email`](../../users-sources/user/user_ref.mdx#goauthentikiousercan-change-email) has been added to the **Attributes** field for a specific user (overriding the global System setting).
- **Locale**: override any global locale settings and either choose a specific language or select **Auto-detect**, which relies on the user's browser local settings.
- **Change your password**: if a user has the [permission to update their password](../user/user_basic_operations.mdx#reset-a-password), they can do so here.

### Sessions

This tab shows all active sessions for the user. Here you can delete sessions, including the current one (which would result in an automatic log out) or a session on a remote device.

### Consent

You can view applications to which you gave consent to allow authentik to share your profile user data with the application.

When an administrator adds this stage to an authorization flow, the user logging in is presented with a pop-up confirmation page asking if they agree to allow the application to directly request their account data (typically profile and email address) from the source. The user clicks **Continue** to give consent.

For more information refer to our documentation on the [Consent stage](../../add-secure-apps/flows-stages/stages/consent/index.mdx).

### Credentials

The **Credentials** tab is where you can add and configure a new MFA device for accessing authentik, create access tokens and App passwords.

#### MFA Devices

This is where users can add and configure MFA devices for accessing authentik. The three default options for MFA are:

- **Static tokens**: authentik generates 6 single-use tokens.
- **TOTP Device**: using your preferred authenticator, scan the QR code, enter the code from the authenticator into the authentik prompt, and then click **Continue**. For authenticators that do not support QR scanning, you can copy the secret and paste it into your authenticator.
- **WebAuthn device**: this option uses the [WebAuthn/FIDO2/Passkeys Authenticator setup stage](../../add-secure-apps/flows-stages/stages/authenticator_webauthn/index.mdx) to allow the user to create a passkey for the device.

An authentik administrator can add additional MFA options for users, such as [Email](../../add-secure-apps/flows-stages/stages/authenticator_email/index.mdx), [SMS](../../add-secure-apps/flows-stages/stages/authenticator_sms/index.mdx), or [Duo](../../add-secure-apps/flows-stages/stages/authenticator_duo/index.mdx), by adding the stage for that authentication method to the flow.

Because LDAP does not natively support OTP, authentik supports [appending the OTP code to the password](../../add-secure-apps/providers/ldap/index.mdx#code-based-mfa-support) for situations where the protocol is LDAP and they are required to use MFA. If enabled, the user can enter the authenticator's code as part of the bind/authentication password, separated by a semicolon. For example, for the password `example-password` and the MFA code `123456`, the input in the password field must be `example-password;123456`.

#### Tokens and app passwords

- **Tokens**: API tokens authenticate requests to the authentik API at `/api/v3/`. Send them in an `Authorization: Bearer <api_token>` header. They do not grant access to an application's API behind authentik.
- **App passwords**: generated passwords that you use with your authentik username in supported authentication methods, such as LDAP binds, proxy HTTP Basic authentication, and OAuth2 machine-to-machine authentication. An app password is not an API token or an OAuth2 access token.

To create an app password:

1. Open your user settings and select **Credentials**.
2. Under **Tokens and App passwords**, click **New App Password**.
3. Enter a unique **Identifier**, optionally add a **Description**, and set **Expires on**.
4. Click **Create App Password**.
5. Use the copy button beside the new entry to copy the generated password. The **Identifier** is a label, not the password or your username.

Administrators can also create app passwords for users under **Directory** > **Tokens and App passwords** by selecting the user and setting **Intent** to **App password**. For automation, see [Service accounts](./account-types/service-accounts.mdx).

Choose the authentication method that your application uses:

- **LDAP**: use the app password as the bind password for your user's DN. The password stage in the provider's **Bind Flow** must enable **User database + app passwords**. See [Bind with an app password](../../add-secure-apps/providers/ldap/index.mdx#bind-with-an-app-password).
- **Proxy or forward auth**: send your authentik username and app password using HTTP Basic authentication. See the [proxy request example](../../add-secure-apps/providers/proxy/header_authentication.mdx#receiving-http-basic-authentication). Sending the app password directly as `Authorization: Bearer <app_password>` does not work.
- **OAuth2/OIDC**: exchange your username and app password for an access token using [machine-to-machine authentication](../../add-secure-apps/providers/oauth2/machine_to_machine.mdx#request-with-username-and-app-password), then send the returned access token to the application as a Bearer token.

App passwords authenticate as their owner and do not grant additional application access or permissions. They can be accepted wherever app-password authentication is enabled; the **Identifier** does not restrict a password to one application. To revoke an app password, delete its entry. To rotate it, create a replacement, update the client, and delete the old entry.

### Connected services

If an authentik administrator adds a [source](../sources/index.mdx) to the instance, such as GitHub, Discord, Google Workspace or Microsoft Entra ID, then users will see a list of those sources here and can choose to log in (**Connect**) using credentials from that source, or **Disconnect** from the service. Note that SCIM and LDAP sources are not displayed.

---

## User account switching

authentik can keep multiple user accounts signed in within the same browser. Users can switch between their user accounts from the User interface header.

## How it works

Each login creates its own session. authentik groups sessions created by the same browser, so a user can only switch to user accounts that are already signed in from that browser.

Only the most recent login is active at a time. When a user selects another user account from the switcher, authentik verifies that the browser has a live session for that user account, then starts the configured user switch flow. authentik verifies the target session again immediately before completing the switch. The user must complete the authentication stages required by that flow, such as password or MFA validation.

The previous user's session stays signed in as a switch target, but its session cookie can no longer be used to act as that user account. This prevents an old recorded session cookie from being replayed after the browser has switched to another user account.

Logins performed through a user switch are recorded in the event log.

## Switch user accounts

Users can start an account switch from the User interface header. To add another user account, users select **Add user** from the header menu and complete a normal login.

After the login completes, that user account appears in the same menu and can be selected as long as the browser still has a live session for that user account.

## Configure user switching

User switches authenticate through the brand's **User switch flow**. If no user switch
flow is set, the switcher is disabled and the switch endpoint cannot be used.

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **System** > **Brands** and edit the brand you want to configure.
3. Under **Default flows**, set **User switch flow** to the authentication flow users should complete when switching user accounts.
4. Click **Update**.

Any authentication flow can be used. To reuse the default authentication flow for switching, set it
explicitly as the **User switch flow**.

During a user switch, the selected user account is already known and is available to the flow as
`pending_user`. To skip a stage only during user switches, bind an expression policy to that
stage binding:

```python
flow_plan = request.context.get("flow_plan")
is_user_switch = bool(flow_plan and flow_plan.context.get("user_switch_from_user"))

return not is_user_switch
```

Bind the policy to the identification, password, authenticator validation, or other stage bindings to control which stages are shown to users when they switch to another user account.

Without these policies, the selected user switch flow runs in full.

## Require only MFA for recently used users

To require only MFA when the selected user account was used in the last 24 hours, create a dedicated
user switch flow with a Password stage, an Authenticator Validation stage, and a User Login stage.

Then bind the following expression policy to the Password stage binding:

```python
from datetime import timedelta

from authentik.core.user_switching import is_user_switch_target_recent

return not is_user_switch_target_recent(request, timedelta(hours=24))
```

When the policy returns `False`, authentik skips the Password stage and continues to the Authenticator Validation stage.

When the user account has not had an active session in the past 24 hours, the Password stage is triggered and they must complete the full flow.

---

## Manage users

Use these procedures to create, modify, deactivate, delete, and recover users.

[Policies](../../customize/policies/index.mdx) can be used to further manage how users are authenticated. For example, by default authentik does not require email addresses be unique, but you can use a policy to [enforce unique email addresses](../../customize/policies/types/expression/unique_email.mdx).

## Create a user

If you want to automate user creation, you can do that either by [invitations](./invitations.mdx), [`user_write` stage](../../add-secure-apps/flows-stages/stages/user_write/index.mdx), or [using the API](/api/reference/core-users-create).

1. In the Admin interface of your authentik instance, select **Directory** > **Users** in the left menu.
2. In the **User folders** area, select the folder where you want to create a user.
3. Click **New User**, and then select either **Internal User** or **External User**.
4. Fill in the required fields:
    - **Username**: This value must be unique across all users.
    - **Display Name** (_optional_): The display name of the user.
    - **Email** (_optional_): The email address of the user. For more information, see the [email documentation](../../install-config/email.mdx).
    - **Active** (_optional_): Whether the user account is active. Selected by default.
    - **Path**: The path where authentik creates the user. The field is populated with the folder selected in the previous step.
    - **Attributes**: Custom user attributes in YAML or JSON format. The default value is an empty dictionary.

5. Click **Create**.
   A confirmation notification appears in the upper-right corner, and the new user appears in the user list. Click the username to [modify the user](#modify-a-user).

To create a super-user, you need to add the user to a group that has super-user permissions. For more information, refer to [Create a Group](../groups/manage_groups.mdx#create-a-group).

## Advanced queries for users {#advanced-queries}

You can use AKQL to filter the user list in **Directory** > **Users**. For the user fields, operators, examples, and keyboard shortcuts, see the [AKQL reference](../../sys-mgmt/akql.mdx).

## View user details

In the **Directory** > **Users** menu of the Admin interface, you can browse all the users in your authentik instance.

To view details about a specific user:

1. In the list of all users, click on the name of the user you want to check.

    This takes you to the **Overview** tab, with basic information about the user and quick access to perform basic actions on the user.

2. To see further details, click any of the other tabs:
    - **Session** shows the active sessions established by the user. If there is any need, you can clean up the connected devices for a user by selecting the device(s) and then clicking **Delete**. This forces the user to authenticate again on the deleted devices.
    - **Groups** allows you to manage the group membership of the user. You can find more details on [groups](../groups/index.mdx).
    - **User events** displays all the events generated by the user during a session, such as login, logout, application authorization, password reset, user info update, etc.
    - **Explicit Consent** lists permissions that the user explicitly granted to an application. Entries appear only when the user validates an [explicit consent flow in an OAuth2 provider](../../add-secure-apps/providers/oauth2/index.mdx). To reset consent because an application requires new permissions or the user requested a reset, select the applications and click **Delete**. The application prompts the user to grant consent again.
    - **OAuth Refresh Tokens** lists all the OAuth tokens currently distributed. You can remove the tokens by selecting the applications and then clicking **Delete**.
    - **MFA Authenticators** shows all the authenticators that the user has registered to their profile. You can remove the tokens if the user has lost their authenticator and wants to enroll a new one.

## Modify a user

After the creation of the user, you can edit any parameter defined during the creation.

To modify a user object, go to **Directory** > **Users**, and click the edit icon beside the name. You can also go into [user details](#view-user-details), and click **Edit**.

## Manage user permissions

You cannot directly grant a user any permissions. Instead, either assign the user to a role with the appropriate permissions, or add a user to a group that has the appropriate permissions (via the group's role/roles).

On the flipside, to grant permissions on a user object to a role, review ["Manage permissions"](../access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role).

## Add a user to a group

1. To add a user to a group, navigate to **Directory** > **Users** to display all users.
2. Click the name of the user to display the full user details page.
3. Click the **Groups** tab, and then click either **Add to existing group** (or **Add new group** first).

Starting with authentik 2026.2.7, 2026.5.7 and 2026.8.2, adding a user to a group that grants super-user permission requires the `Enable superuser status` permission.

## Add a user to a role

1. To add a user to a role, navigate to **Directory > Users** to display all users.
2. Click the name of the user to display the full user details page.
3. Click the **Roles** tab, and then click either **Add to existing role** (or **Add new role** first).

Users also inherit roles from the groups they belong to. The **Roles** tab has two sub-tabs: **Assigned Roles** shows roles directly assigned to the user, while **All Roles** shows all roles including those inherited from groups. Inherited roles are marked with an "Inherited" label.

## Bind a user to an application

These bindings control which users can access an application, and whether or not the application is visible in the user's **Application Dashboard** page. If no bindings for an application are defined, this means that all users and groups can access the application.

For instructions refer to [Manage applications](../../add-secure-apps/applications/manage_apps.mdx#bind-a-user-or-group-to-an-application).

## User credentials recovery

If a user has lost their credentials and needs to recover their account, there are two available options:

1. Create a recovery link and send it to the user
2. Have authentik send the user a recovery email

Both options require you to configure a recovery flow and set it as the **Default recovery flow** for the active brand.

If the user only needs their password reset, see these [instructions](#reset-a-password).

### Configure a recovery flow

To get started, you can [import](../../add-secure-apps/flows-stages/flow/index.mdx#import-or-export-a-flow) this example flow: [Recovery with email verification flow](../../add-secure-apps/flows-stages/flow/flows.mdx#recovery-with-email-and-mfa-verification)

Then, set this as the default recovery flow for the active brand:

1. In the Admin interface, navigate to **System** > **Brands**, and select the active brand.
2. Under **Default flows**, set **Recovery flow** to the imported recovery flow: `default-recovery-flow`.
3. Click **Update**.

Now that you've configured a recovery flow, you can select one of the following options:

### 1. Create a recovery link

The example recovery flow includes an email stage. However, if you're manually sending the recovery link to the user, this email stage is not required and can be removed.

1. In the Admin interface, navigate to **Directory** > **Users** to display all users.
2. Click the name of the user to display the full User details page.
3. To generate a recovery link, which you can then send to the user, click **Create recovery link**.

A dialog displays the recovery link. Copy the link and send it to the user.

### 2. Email a recovery link

This option is only available if the recovery flow has an [Email Stage](../../add-secure-apps/flows-stages/stages/email/index.mdx) bound to it. The example recovery flow includes an email stage.

You can email a password-reset link to the user. This option requires [configured email](../../install-config/email.mdx) and an email address on the user account.

1. In the Admin interface, navigate to **Directory** > **Users** to display all users.
2. Click the name of the user to display the full User details page.
3. To send the email to the user, click **Email recovery link**.

If the user does not receive the email, check if the mail server parameters [are properly configured](../../troubleshooting/emails.mdx).

## Reset a password

### Administrator resets a user's password

As an administrator, you can reset a user's password.

1. In the Admin interface, navigate to **Directory** > **Users** to display all users.
2. Either click the name of the user to display the full User details page, or click the chevron beside their name to expand the options.
3. To reset the user's password, click **Reset password**, and then define the new value.

### User resets their password

If a [Recovery flow](#configure-a-recovery-flow) has been applied to the brand, users can reset their own passwords in the [User interface](../user/user-interface.mdx).

## Deactivate or delete a user

### Deactivate a user

1. Go into the user list or detail, and click **Deactivate**.
2. Review the changes and click **Update**.

The active sessions are revoked and the authentication of the user blocked. You can reactivate the account by following the same procedure.

### Delete a user

This deletion is not reversible, so be sure you do not need to recover any identity data of the user.
You may instead deactivate the account to preserve identity data.

1. Go into the user list and select one (or multiple users) to delete and click **Delete** on the top-right of the page.
2. Review the changes and click **Delete**.

The user list refreshes and no longer displays the removed users.

## Impersonate a user

An administrator can impersonate a user, temporarily assuming that user's identity.

1. In the Admin interface, navigate to **Directory** > **Users** to display all users.
2. Click the name of the user to display the full User details page.
3. On the Overview tab, beneath **User details**, in the **Actions** area, click **Impersonate**.
4. At the prompt, provide a reason why you are impersonating this user, and then click **Impersonate**.

An administrator can globally enable or disable impersonation in the [system settings](../../sys-mgmt/settings.mdx#impersonation). By default, this option is enabled, meaning all users can be impersonated.

An administrator can also require a reason for impersonation in the [system settings](../../sys-mgmt/settings.mdx#require-reason-for-impersonation).

## Export users :ak-enterprise

You can export your authentik instance's user data to a CSV file. To generate a data export, follow these steps:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Users** and click **Export**.
3. Set a [search query](#advanced-queries) as well as the ordering for the data export.
4. Click **Export** above the event list.
5. Confirm the export parameters in the confirmation dialog.
6. authentik processes the export in the background and sends a notification when it is ready.
7. In the notification, click **Download**.

To review, download, or delete past data exports, navigate to **Events** > **Data Exports** in the Admin interface.

---

## User properties and attributes

## Object properties

The User object has the following properties:

- `username`: User's username.
- `email`: User's email.
- `uid`: User's unique ID. Read-only.
- `name`: User's display name.
- `is_staff`: Boolean field defining if user is staff.
- `is_active`: Boolean field defining if user is active.
- `date_joined`: Date user joined/was created. Read-only.
- `password_change_date`: Date password was last changed. Read-only.
- `path`: User's path, see [Path](#path)
- `attributes`: Dynamic attributes, see [Attributes](#attributes)
- `group_attributes()`: Merged attributes of all groups the user is a member of and the user's own attributes. Read-only.
- `groups`: This is a queryset of all the user's direct groups.
- `all_groups()`: This is a queryset of all the user's direct and indirect groups.

A user is a member of a group (direct member). If that group in turn has a parent group, then the user is an indirect member of that parent group.

## Examples

These are examples of how User objects can be used within Policies and Property Mappings.

### List a user's group memberships

Use the following example to list all groups that a user object is a direct member of:

```python
for group in user.groups.all():
    yield group.name
```

### List a user's group memberships and filter based on group name

Use the following example to list groups that a user object is a direct member of, filtered based on group name:

```python
user.groups.filter(name__startswith='test')
```

### List a user's group memberships including parent groups

Use the following example to list all groups that a user object is a direct and indirect member of:

```python
groups = [group.name for group in request.user.all_groups()]
```

For Django field lookups, see the [Django documentation](https://docs.djangoproject.com/en/stable/ref/models/querysets/#id4).

## Path

Paths can be used to organize users into folders depending on which source created them or organizational structure. Paths may not start or end with a slash, but they can contain any other character as path segments. Paths are currently used purely for organization; this does not affect permissions, group memberships, or anything else.

## Attributes

### `goauthentik.io/user/can-change-username`

Optional flag, when set to false prevents the user from changing their own username.

### `goauthentik.io/user/can-change-name`

Optional flag, when set to false prevents the user from changing their own name.

### `goauthentik.io/user/can-change-email`

Optional flag, when set to false prevents the user from changing their own email address.

### `goauthentik.io/user/token-expires`:

Optional flag, when set to false, Tokens created by the user will not expire.

Only applies when the token creation is triggered by the user with this attribute set. Additionally, the flag does not apply to superusers.

### `goauthentik.io/user/token-maximum-lifetime`:

Optional flag, when set, defines the maximum lifetime of user-created tokens. Defaults to the system setting if not set.

Only applies when `goauthentik.io/user/token-expires` set to true.

Format is string of format `days=10;hours=1;minute=3;seconds=5`.

### `goauthentik.io/user/debug`:

See [Troubleshooting access problems](../../troubleshooting/access.mdx), when set, the user gets a more detailed explanation of access decisions.

### `additionalHeaders`:

This field is only used by the Proxy Provider.

Some applications can be configured to create new users using header information forwarded from authentik. You can forward additional header information by adding each header
underneath `additionalHeaders`:

#### Example

```yaml
additionalHeaders:
    REMOTE-USER: joe.smith
    REMOTE-EMAIL: joe@jsmith.com
    REMOTE-NAME: Joseph
```

These headers will now be passed to the application when the user logs in. Most applications will need to be configured to accept these headers. Some examples of applications that can accept additional headers from an authentik Proxy Provider are [Grafana](https://grafana.com/docs/grafana/latest/auth/auth-proxy/) and [Tandoor Recipes](https://docs.tandoor.dev/features/authentication/).

---

## Collect custom user attributes during enrollment

Use a Prompt stage and a User Write stage to collect user data during enrollment and store it as custom attributes on the new user.

## About the workflow

The workflow has three parts:

1. A prompt field in a Prompt stage collects a value and stores it in the flow's `prompt_data` context.
2. A User Write stage writes the value from `prompt_data` to the user.
3. A provider property mapping sends the stored value to an application, or a policy reads the attribute.

The prompt field's **Field Key** controls where the User Write stage stores the value:

| Field key                    | Where the value is stored              |
| ---------------------------- | -------------------------------------- |
| `username`                   | The user's username                    |
| `name`                       | The user's display name                |
| `email`                      | The user's email address               |
| `attributes.given_name`      | The `given_name` attribute             |
| `attributes.family_name`     | The `family_name` attribute            |
| `attributes.department`      | The `department` attribute             |
| `attributes.settings.locale` | The nested `settings.locale` attribute |

A field key such as `department` is available to later stages and policies in `prompt_data`, but the User Write stage does not store it on the user. Start the field key with `attributes.` to store the value as a user attribute.

## Create the prompt fields

This example collects a given name and a family name. The default [object attribute](../../../sys-mgmt/object-attributes.mdx) keys for these values are `given_name` and `family_name`.

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Flows and Stages** > **Prompts**, and click **New Prompt**.
3. Configure the given name prompt:
   - **Name**: enter a descriptive name, such as `enrollment-given-name`.
   - **Field Key**: enter `attributes.given_name`.
   - **Label**: enter `Given name`.
   - **Type**: select **Text**.
   - **Required**: enable this option if every user must provide a given name.
   - **Order**: enter an order value.
4. Click **Create Prompt**.
5. Create a second prompt with these values:
   - **Name**: enter a descriptive name, such as `enrollment-family-name`.
   - **Field Key**: enter `attributes.family_name`.
   - **Label**: enter `Family name`.
   - **Type**: select **Text**.
   - **Required**: enable this option if every user must provide a family name.
   - **Order**: enter a value greater than the given name prompt's order.
6. Click **Create Prompt**.

The same pattern works for any custom attribute. For example, use the field key `attributes.department` to store a `department` attribute.

To show these attributes as labeled fields with validation on the user forms in the Admin interface, create or enable [object attribute definitions](../../../sys-mgmt/object-attributes.mdx) for the keys. Definitions do not add fields to enrollment flows.

## Add the prompts to a Prompt stage

1. Navigate to **Flows and Stages** > **Stages**, and click **New Stage**.
2. Select **Prompt Stage**, and click **Next**.
3. Enter a descriptive **Name**.
4. Add the given name and family name prompts to **Fields**.
5. Click **Create Stage**.

You can also add the prompts to an existing Prompt stage in the enrollment flow.

## Bind the stages to the enrollment flow

1. Navigate to **Flows and Stages** > **Flows**, and open the enrollment flow.
2. Open the **Stage Bindings** tab.
3. Bind the Prompt stage before the User Write stage.
4. If the flow does not have a User Write stage, create and bind one that allows user creation.
5. Confirm that the stages run in this order:
   1. Any identification, invitation, or verification stages.
   2. The Prompt stage that collects the attributes.
   3. The User Write stage.
   4. An optional User Login stage.

The User Write stage reads the submitted values from `prompt_data` and writes `attributes.given_name` and `attributes.family_name` to the user's attributes as `given_name` and `family_name`.

## Set attributes from an invitation

An [invitation](../../../users-sources/user/invitations.mdx) can provide attribute values without asking the user to enter them. In the invitation's **Custom attributes** field, set an `attributes` dictionary:

```json
{
    "email": "dominic.roy@example.com",
    "name": "Dominic Roy",
    "attributes": {
        "department": "Engineering",
        "family_name": "Roy",
        "given_name": "Dominic"
    }
}
```

Dotted keys that match the prompt fields work as well:

```json
{
    "attributes.family_name": "Roy",
    "attributes.given_name": "Dominic"
}
```

Bind the Invitation stage before the Prompt and User Write stages.

## Map the attributes to an application

Storing an attribute on the user does not send it to an application. When an OAuth2/OIDC application requires a specific claim or a SAML application requires a specific attribute, configure a [provider property mapping](../../providers/property-mappings/index.mdx#map-stored-user-attributes) that returns the stored value.

## Verify the result

1. Run the enrollment flow and enter values in the new fields.

2. In the Admin interface, navigate to **Directory** > **Users**.

3. Open the enrolled user and confirm that **Attributes** contains the new values:

   ```yaml
   family_name: Roy
   given_name: Dominic
   ```

4. If an application uses the values, test the property mapping or sign in to the application, and confirm that it receives the expected values.

---

## Default flows

When you create a new provider, you can select certain default flows that will be used with the provider and its associated application. For example, you can [create a flow](./index.mdx#create-a-flow) that overrides the defaults configured on the brand.

If no default flow is selected when the provider is created, authentik will first check if there is a default flow configured in the active [**Brand**](../../../customize/branding/index.mdx). If no default is configured there, authentik will go through all flows with the matching designation, sorted by `slug`, evaluate policies bound directly to the flows, and pick the first flow whose policies allow access.

- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.mdx) stage, which attaches the staged user to the current session.

- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required.

- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write/index.mdx) stage, which either updates the currently staged user, or if none exists, creates a new one.

- **Invalidation**: designates a default flow to be used to invalidate a session. There are two default invalidation flows:

  - `default-invalidation-flow`: Used when a user logs out directly from authentik. This flow **includes** a [**User Logout**](../../stages/user_logout/index.mdx) stage, which ends the authentik session and triggers [Single Logout](../../../providers/single-logout/index.mdx) for all connected applications.

  - `default-provider-invalidation-flow`: The default flow used when a user logs out from an application (OIDC, SAML, Proxy, or RAC providers). This flow does **not** include a User Logout stage, meaning only the specific application session ends while the authentik session remains active.

  You can also create custom invalidation flows with branded background images or different logout options.

- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.mdx) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.mdx). Afterwards, use the [**Prompt**](../../stages/prompt/index.mdx) stage to ask the user for a new password and the [**User Write**](../../stages/user_write/index.mdx) stage to update the password.

- **Stage Configuration**: designates a flow for general setup. This designation doesn't impose any constraints on what you can do. For example, by default this designation is used to configure authenticators, like changing a password and setting up TOTP.

- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.mdx). As a final stage, to delete the account, use the [**user\_delete**](../../stages/user_delete/index.mdx) stage.

---

## Example flows

You can apply these flows multiple times to stay updated; however, this discards all changes you've made.

The example flows provided below **override** the default flows. Review the contents of the example flow before importing and consider exporting the affected existing flows first.

These example flow blueprints are bundled with authentik. To import one, open the authentik Admin interface, navigate to **Flows and Stages** > **Flows**, click **Import**, select **Local path**, and choose the blueprint path shown below. You can also download the blueprint manually and import it with **File upload**.

## Two-stage enrollment

Blueprint path: `example/flows-enrollment-2-stage.yaml`

Flow: right-click here and save the file.

Sign-up flow for new users that prompts them for their username, email, password, and name. No verification is done. Users are also immediately logged in after this flow.

## Enrollment with email verification

Blueprint path: `example/flows-enrollment-email-verification.yaml`

Flow: right-click here and save the file.

Same flow as above, with an extra email verification stage.

You'll probably have to adjust the Email stage and set your connection details.

## Two-factor login

Blueprint path: `example/flows-login-2fa.yaml`

Flow: right-click here and save the file.

Login flow that follows the default pattern (username/email, then password), but also checks for the user's OTP token, if they have one configured.

You can force two-factor authentication by editing the *Not configured action* in the Authenticator Validation Stage.

## Log in with an email magic link

Blueprint path: `example/flows-login-email-magic-link.yaml`

Flow: right-click here and save the file.

Passwordless login flow that lets users sign in from a link sent to their email address. Users enter their email address or username, authentik sends them a confirmation link, and they are signed in after they open the link.

Before importing this flow, make sure that global email settings are configured and that users have valid email addresses. Use this flow only when access to the user's email inbox is an acceptable sign-in factor for your environment.

After import, review the Email stage binding in the flow. The example uses the built-in account confirmation email template. You can replace it with a [custom email template](../stages/email/index.mdx#custom-templates) if you want the email text to match the magic-link login experience.

## Log in with conditional CAPTCHA

Blueprint path: `example/flows-login-conditional-captcha.yaml`

Flow: right-click here and save the file.

Login flow that conditionally shows users a CAPTCHA, based on the reputation of their IP and username.

By default, the CAPTCHA test keys are used. You can get a production key from the [Google reCAPTCHA website](https://www.google.com/recaptcha/intro/v3.html).

## Recovery with email and MFA verification

Blueprint path: `example/flows-recovery-email-mfa-verification.yaml`

Flow: right-click here and save the file.

With this recovery flow, the user is sent an email after they've identified themselves. After they click the link in the email, they must verify their configured MFA device, and are prompted for a new password and immediately logged in.

Recovery flows do not automatically reject inactive users. Stages such as the Email and User Write stages can still send a recovery email and change the password of an inactive user. A later User Login stage rejects an inactive user, but it does not prevent the earlier recovery actions.

The example recovery blueprints enable **Activate user on success** on the Email stage. As a result, opening a valid recovery link reactivates the user. Disable this setting if reactivation must remain an administrative action. To prevent inactive users from proceeding through recovery, add an explicit policy and Deny stage after identification and before the Email stage. This denial produces a different response for inactive users and can disclose account state. For details, see [Block password recovery for inactive users](../stages/deny/index.mdx#example-block-password-recovery-for-inactive-users).

There's also a version of this flow available without MFA validation at `example/flows-recovery-email-verification.yaml`, which is not recommended.

## User deletion

Blueprint path: `example/flows-unenrollment.yaml`

Flow: right-click here and save the file.

Flow for users to delete their account.

This is done without any warning.

---

## Flows

Flows are a major component in authentik. In conjunction with [stages](../stages/index.mdx) and [policies](../../../customize/policies/index.mdx), flows are at the heart of our system of building blocks, used to define and execute the workflows of authentication, authorization, enrollment, and user settings.

There are over a dozen default, out-of-the-box flows available in authentik. Users can decide if they already have everything they need with the [default flows](../flow/default-flows.mdx) or if they want to [create](#create-a-flow) their own customized flow, using the Admin interface, Terraform, or via the API.

A flow is a method of describing a sequence of stages. A stage represents a single verification or logic step. By connecting a series of stages within a flow (and optionally attaching policies as needed) you can build a highly flexible process for authenticating users, enrolling them, and more.

For example a standard login flow would consist of the following stages:

- **Identification stage**: user identifies themselves via a username or email address
- **Password stage**: the user's password is checked against the hash in the database
- **Login stage**: this stage attaches a currently pending user to the current session

When these stages are successfully completed, authentik logs in the user.

![](./simple_stages.png)

By default, policies bound to stage bindings are evaluated dynamically, right before the stage is presented to the user. This flexibility allows the login process to continue, change, or stop, based on the success or failure of each policy.

You can change this behavior by enabling the **Evaluate when flow is planned** option on the stage binding. When this option is enabled, authentik uses the [Flow Planner](./planner.mdx) to evaluate the stage binding's policies when the flow starts, and includes the stage in the flow plan only if those policies pass.

## Policies and permissions

Flows can have [policies](../../../customize/policies/index.mdx) assigned to them. These policies determine if the current user is allowed to see and use this flow.

Keep in mind that in certain circumstances, policies cannot match against users and groups as there is no authenticated user yet.

## Import or export a flow

Flows can be imported and exported (as [blueprints](../../../customize/blueprints/working_with_blueprints)) to share with other people, the community, and for troubleshooting.

Flows can be imported to add new functionality to existing flows, or to add a new custom flow.

You can download our [Example flows](./flows.mdx) and then import them into your authentik instance, or create a new flow.

Starting with authentik 2022.8, flows are exported as YAML, but legacy JSON-based flows can still be imported.

Flow imports are blueprint files, which may contain objects other than flows (such as policies, users, groups, etc).

You should only import files from trusted sources and review blueprints before importing them.

## Create a flow

To create a flow, follow these steps:

1. Log in to authentik as an administrator and open the Admin interface.
2. In the Admin interface, navigate to **Flows and Stages > Flows**.
3. Click **New Flow**, define the flow using the [configuration settings](#flow-configuration-options) described below, and then click **Create Flow**.

After creating the flow, you can then [bind specific stages](../stages/index.mdx#bind-a-stage-to-a-flow) to the flow and [bind policies](../../../customize/policies/bindings.mdx) to the flow to further customize the user's log in and authentication process.

To determine which flow should be used, authentik will first check which default authentication flow is configured in the active [**Brand**](../../../customize/branding/index.mdx). If no default is configured there, the policies in all flows with the matching designation are checked, and the first flow with matching policies sorted by `slug` will be used.

## Flow configuration options

When creating or editing a flow in the UI of the Admin interface, you can set the following configuration options.

![](./create-flow.png)

**Name**: Enter a descriptive name. This is the name that will appear on the list of flows in the Admin interface.

**Title**: This is the title that will appear on the flow as the end-user logs in and encounters the flow.

**Slug**: The slug will be used, and appear, in the URL when the flow is in use.

**Designation**: Flows are designated for a single purpose. This designation changes when a flow is used. The following designations are available:

- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.mdx) stage, which attaches the staged user to the current session.

- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required.

- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write/index.mdx) stage, which either updates the currently staged user, or if none exists, creates a new one.

- **Invalidation**: designates a default flow to be used to invalidate a session. There are two default invalidation flows:

  - `default-invalidation-flow`: Used when a user logs out directly from authentik. This flow **includes** a [**User Logout**](../../stages/user_logout/index.mdx) stage, which ends the authentik session and triggers [Single Logout](../../../providers/single-logout/index.mdx) for all connected applications.

  - `default-provider-invalidation-flow`: The default flow used when a user logs out from an application (OIDC, SAML, Proxy, or RAC providers). This flow does **not** include a User Logout stage, meaning only the specific application session ends while the authentik session remains active.

  You can also create custom invalidation flows with branded background images or different logout options.

- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.mdx) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.mdx). Afterwards, use the [**Prompt**](../../stages/prompt/index.mdx) stage to ask the user for a new password and the [**User Write**](../../stages/user_write/index.mdx) stage to update the password.

- **Stage Configuration**: designates a flow for general setup. This designation doesn't impose any constraints on what you can do. For example, by default this designation is used to configure authenticators, like changing a password and setting up TOTP.

- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.mdx). As a final stage, to delete the account, use the [**user\_delete**](../../stages/user_delete/index.mdx) stage.

**Authentication**: Using this option, you can configure whether the flow requires initial authentication or not, whether the user must be a superuser, if the flow can only be started after being redirected by a [Redirect stage](../stages/redirect/index.mdx), or if the flow requires an outpost.

**Behavior settings**:

- **Compatibility mode**: Toggle this option on to increase compatibility with password managers and mobile devices. Password managers like [1Password](https://1password.com/), for example, don't need this setting to be enabled when accessing the flow from a desktop browser. However, accessing the flow from a mobile device might necessitate this setting to be enabled.

  The technical reason for this setting's existence is the JavaScript libraries we're using for the default flow interface. These interfaces are implemented using [Lit](https://lit.dev/), which is a modern web development library. It uses a web standard called ["Shadow DOMs"](https://developer.mozilla.org/en-US/docs/Web/API/Web_components/Using_shadow_DOM), which makes encapsulating styles simpler. Due to differences in Browser APIs, many password managers are not compatible with this technology.

  When the compatibility mode is enabled, authentik uses a polyfill which emulates the Shadow DOM APIs without actually using the feature, and instead a traditional DOM is rendered. This increases support for password managers, especially on mobile devices.

- **Denied action**: Configure what happens when access to a flow is denied by a policy. By default, authentik will redirect to a `?next` parameter if set, and otherwise show an error message.
  - `MESSAGE_CONTINUE`: Show a message if no `?next` parameter is set, otherwise redirect.
  - `MESSAGE`: Always show error message.
  - `CONTINUE`: Always redirect, either to `?next` if set, otherwise to the default interface.

- **Policy engine mode**: Configure the flow to succeed in *any* policy passes, or only if *all* policies pass.

**Appearance settings**:

- **Layout**: select how the UI displays the flow when it is executed; with stacked elements, content left or right, and sidebar left or right.

- **Background**: optionally, select a background image for the UI presentation of the flow. This overrides any default background image configured in the [Branding settings](../../../customize/branding/index.mdx#branding-settings). See [File picker values](../../../customize/file-picker.mdx).

## Edit or delete a flow

- To edit a flow, navigate to **Flows and Stages > Flows** in the Admin interface, and then click **Edit** for the flow that you want to modify.

- To delete a flow, navigate to **Flows and Stages > Flows** in the Admin interface, select the checkbox in front of the flow that you want to delete, and then click **Delete**. You can retrieve and re-apply that flow by following the steps above to create a new flow.

---

## Flow Inspector

The Flow Inspector allows administrators to visually determine how custom flows work, inspect the current [flow context](./context/index.mdx) by stepping through the flow process and observing the Inspector with each step, and investigate issues. It shows details from the active [flow plan](./planner.mdx).

As shown in the screenshot below, the Flow Inspector displays to the right, beside the selected flow (in this case, "Change Password"), with [information](#flow-inspector-details) about that specific flow and flow context.

![](./flow-inspector.png)

## Access the Flow Inspector

Be aware that when running a flow with the Inspector enabled, the flow is still executed normally. This means that, for example, a [User write](../stages/user_write/index.mdx) stage *will* write user data.

The Inspector is accessible to users that have been granted the [permission](../../../users-sources/access-control/permissions.mdx) **Can inspect a Flow's execution**, either directly or through a role. Superusers can always inspect flow executions.

### Manually run a flow with the Inspector

1. To access the Inspector, open the Admin interface and navigate to **Flows and Stages > Flows**.

2. Select the specific flow that you want to inspect by clicking its name in the list.

3. On the flow's detail page, on the left side under **Execute flow**, click **Use inspector**.

4. The selected flow launches in a new browser tab, with the Flow Inspector displayed to the right.

### Additional ways to access the Flow Inspector

Alternatively, a user with the correct permission can launch the Inspector by adding the query parameter `?inspector` to the URL after the URL opens on a flow.

Users with permissions to access the Flow Inspector see a button in the top-right corner of the [default flow executor](./executors/if-flow.mdx) to open the Inspector.

When developing authentik with the debug mode enabled, the Inspector is enabled by default and can be accessed by both unauthenticated users and standard users. However, debug mode should only be used for the development of authentik. Unless you are a developer and need the more verbose error information, the best practice for using the Flow Inspector is to assign the permission, not use debug mode.

- If the Flow Inspector does not launch and a "Bad request" error displays, this is likely either because you selected a flow that has a policy bound directly to it that prevents access (so the Inspector won't open because the flow can't be executed) or because you do not have [view permission](../../../users-sources/access-control/manage_permissions.mdx#view-permissions) on that specific flow.

### Flow Inspector details

The following information is shown in the Inspector:

#### Next stage

This is the currently planned next stage. Stages that are evaluated when they run can still be skipped before they are shown. For more information, see [Planning and stage policies](./planner.mdx#planning-and-stage-policies).

The name and kind of the stage, as well as the unique ID, are shown.

#### Plan history

Here you can see an overview of which stages have run, which is currently active, and which is planned to come next.

#### Current plan context

This shows the current context. The fields depend on the active stage; after an identification stage, for example, you would see "pending\_user" defined.

This data is not cleaned, so if your flow involves inputting a password, it is shown here too.

#### Session ID

The unique ID for the currently used session. This can be used to debug issues with flows restarting/losing state.

---

## Flow Planner

The Flow Planner is the component of authentik that takes a configured [flow](./index.mdx) and, for each incoming request for that flow, determines the specific stages to run and the order in which they will run.

A flow describes a sequence of stages and policies. A flow plan is the per-session execution plan derived from that flow after authentik evaluates the request, the user, and the policies bound to the flow and its stage bindings.

## How the planner works

When a flow is executed, authentik creates a flow plan and does the following:

1. Verifies that the flow can be used in the current authentication context.
2. Evaluates policies bound directly to the flow.
3. Loads the flow's stage bindings in order.
4. Evaluates stage binding policies when **Evaluate when flow is planned** is enabled.
5. Stores the resulting ordered stage list and [flow context](./context/index.mdx) in the user's session.

The [flow executor](./executors/if-flow.mdx) then presents the first stage of the flow plan. When the stage completes successfully, authentik removes it from the flow plan and continues with the next stage. When no stages remain, the flow plan has completed.

## Planning and stage policies

Stage binding policies can be evaluated at two different times:

- **Evaluate when flow is planned**: The policy is evaluated when the flow plan is created. If the policy does not pass, that stage is not included in the plan.
- **Evaluate when stage is run** (*default*): The policy is evaluated immediately before the stage is presented. If the policy does not pass at that point, authentik skips that stage and continues with the next planned stage.

Both options can be enabled for the same stage binding. Use planning-time evaluation when a policy can be evaluated before any stages run. Use run-time evaluation when a policy depends on data that might be added to the flow context by earlier stages.

For example, a password stage usually depends on the user identified by an earlier identification stage. If a policy for a later stage depends on `pending_user`, evaluate that policy when the stage is run, or ensure `pending_user` is already present when the plan is created.

## Inspect a plan

Use the [Flow Inspector](./inspector.mdx) to execute a flow and, while it executes, view the current stage, the next planned stage, the plan history, and the current plan context.

The Flow Inspector is accessed via the Flow Overview page and is particularly useful for troubleshooting flows and determining why stage binding policies fail to pass. It's also useful to evaluate values for use in policies.

## Caching and session state

authentik can cache flow plans so repeated executions of the same flow for the same user do not need to rebuild the same stage list every time. The active plan for a running flow is stored in the HTTP session, so browser-based and API-based flow executors must keep using the same session while the flow is running.

If flow behavior changes after editing stage bindings or policies, start a new flow execution before troubleshooting. Existing sessions may already have a plan in progress.

---

## Example policy snippets

The following are examples of policies that can be used with flows.

## Redirect current flow to another URL

This policy should be bound to the stage after your redirect should happen. For example, if you have an identification and a password stage, and you want to redirect after identification, bind the policy to the password stage. Make sure the stage binding's option *Evaluate when stage is run* is enabled.

```python
plan = request.context.get("flow_plan")
if not plan:
    return False
plan.redirect("https://foo.bar")
return False
```

## Deny flow when user is authenticated

Set the flow's **Denied action** to **CONTINUE**. This will redirect already authenticated users to the default interface if they try to use the respective flow.

```python
return not request.user.is_authenticated
```

---

## Stages

Stages are one of the fundamental building blocks in authentik, along with [flows](../flow/index.mdx) and [policies](../../../customize/policies/index.mdx).

A stage represents a single verification or logic step within a flow. You can bind one or more stages to a flow to create a customized, flexible login and authentication process.

In the following diagram of the `default-authentication-flow`, you see multiple stages, or steps, in the authentication process for a user. Policies are bound to some stages; this provides for dynamic application of a specific stage *if* the policy criteria is met.

```mermaid
graph TD
flow_pre[["Pre-flow policies"]]
flow_pre --Binding 10--> flow_policy_0{{"Policy (Event Matcher Policy)
default-match-update"}}
flow_policy_0 --Policy denied--> done[["End of the flow"]]
flow_policy_0 --> flow_start[["Flow
Welcome to authentik!"]]
stage_0_policy_0 --Policy passed--> stage_0(["Stage (Identification Stage)
default-authentication-identification"])
stage_1_policy_0 --Policy passed--> stage_1(["Stage (Password Stage)
default-authentication-password"])
--> stage_2(["Stage (Authenticator Validation Stage)
default-authentication-mfa-validation"])
--> stage_3(["Stage (User Login Stage)
default-authentication-login"])
flow_start --> stage_0_policy_0{{"Policy (Event Matcher Policy)
default-match-configuration-error"}}
stage_0 --> stage_1_policy_0{{"Policy (Expression Policy)
default-authentication-flow-password-stage"}}
stage_0_policy_0 --Policy denied--> stage_1(["Stage (Password Stage)
default-authentication-password"])
stage_1_policy_0 --Policy denied--> stage_2(["Stage (Authenticator Validation Stage)
default-authentication-mfa-validation"])
stage_3 --> done[["End of the flow"]]
```

## Create a stage

To create a stage, follow these steps:

1. Log in as an admin to authentik, and go to the Admin interface.
2. In the Admin interface, navigate to **Flows and Stages > Stages**.
3. Click **New Stage**, select the stage type, define the stage using the configuration settings, and then click **Create Stage**.

After creating the stage, you can use bindings to determine whether the stage runs in a flow.

## Stage bindings

A stage binding connects a stage to a flow. The binding adds that stage as a step in the flow.

You can use bindings to determine which [stages](../stages/index.mdx) are presented to a user or group.

For an overview of binding types and behavior, see [Bindings in authentik](../../bindings-overview/index.mdx).

Some stages and flows do not allow user or group bindings. In some authentication or enrollment scenarios, the [flow plan](../flow/planner.mdx) does not yet know the current user or group.

### Bind a stage to a flow

To bind a stage to a flow, follow these steps:

1. Log in as an admin to authentik, and go to the Admin interface.
2. In the Admin interface, navigate to **Flows and Stages > Flows**.
3. In the list of flows, click the name of the flow to which you want to bind one or more stages.
4. On the Flow page, click the **Stage Bindings** tab at the top.
5. Click **Create or bind...**.
6. Select **Existing Stage** to bind an existing stage to the flow, or select **Bind New Stage** to create a new stage and bind it to the flow.

### Control access to a stage

There are several ways to control access to a specific stage of a flow:

- Bind a policy to a stage binding. See [Bind a policy to a stage binding](../../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-stage-binding).
- Bind a user or group to the stage binding. See [Bind users and groups to a flow's stage binding](#bind-users-and-groups-to-a-flows-stage-binding).

### Bind users and groups to a flow's stage binding

You can use bindings to determine whether a stage is presented to a single user or to members of a group. Bind the user or group to the stage binding within a specific flow. For example, if a flow contains an MFA stage that should run only for certain users, bind the appropriate group or user to that stage binding.

To bind a user or a group to a stage binding for a specific flow, follow these steps:

1. Log in as an admin to authentik, and go to the Admin interface.
2. In the Admin interface, navigate to **Flows and Stages > Flows**.
3. In the list of flows, click the name of the flow to which you want to bind one or more stages.
4. On that Flow's detail page, click the **Stage Bindings** tab at the top.
5. In the list, locate the stage binding to which you want to bind a user or group, and then click the caret (>) to expand the stage binding details.
6. In the expanded area, click **Create or bind...**.
7. Under **Bind Existing**, select either **Bind a user** or **Bind a group**.
8. In the drop-down list, select the group or user.
9. Optionally, configure additional settings for the binding, and then click **Create** to create the binding and close the box.

Learn more about the different types of [bindings](../../bindings-overview/index.mdx) in authentik and [working with them](../../bindings-overview/work-with-bindings.mdx).

---

## Embedded Outpost

authentik includes an embedded outpost to simplify deployments that use the Proxy provider.

The embedded outpost runs as part of the main authentik server deployment and is managed by authentik itself. It authenticates to the authentik API by using the secret key.

You can access the embedded outpost on the same ports as authentik itself, `9000` and `9443`.

## When to use the embedded outpost

Use the embedded outpost when you are using the proxy provider and want the simplest deployment model. It is a good fit when authentik is already behind a reverse proxy and you want proxy provider traffic to be handled by the same authentik deployment, without a separate outpost deployment.

Use a [managed outpost](../index.mdx) instead when you want authentik to deploy and update a separate outpost through the [Docker](../integrations/docker.mdx) or [Kubernetes](../integrations/kubernetes.mdx) integrations, or when you want the outpost lifecycle to be separate from the core server.

If the embedded outpost does not fit your deployment, you can ignore it and use a [managed outpost](../index.mdx) instead.

## Configuration

Because authentik does not know its own primary URL, you might need to configure the embedded outpost after installation.

By default, when you open the Admin interface on a fresh install, authentik automatically configures the outpost to use the same URL that was used to access authentik.

If this is not correct, navigate to **Applications** > **Outposts**, edit **authentik Embedded Outpost**, and set `authentik_host` to the correct URL.

Make sure that you set a full URL. A hostname or FQDN by itself does not work.

Most other outpost configuration options also apply to the embedded outpost, except for items that are marked as `non-embedded`.

```yaml
# Log level that the outpost will set
# Allowed levels: trace, debug, info, warning, error
# Applies to: non-embedded
log_level: debug
# Interval at which the outpost will refresh the providers
# from authentik. For caching outposts (such as LDAP), the
# cache will also be invalidated at that interval.
# (Format: hours=1;minutes=2;seconds=3).
refresh_interval: minutes=5
########################################
# The settings below are only relevant when using a managed outpost
########################################
# URL that the outpost uses to connect back to authentik
authentik_host: https://authentik.tld/
# Disable SSL Validation for the authentik connection
authentik_host_insecure: false
# Optionally specify a different URL used for user-facing interactions
# Applies to: proxy outposts
authentik_host_browser:
# Template used for objects created (deployments/containers, services, secrets, etc)
object_naming_template: ak-outpost-%(name)s
# Use a specific docker image for this outpost rather than the default. This also applies to Kubernetes
# outposts.
# Applies to: non-embedded
container_image:
########################################
# Docker outpost specific settings
########################################
# Network the outpost container should be connected to
# Applies to: non-embedded
docker_network: null
# Optionally disable mapping of ports to outpost container, may be useful when using docker networks
# (Available with 2021.9.4+)
# Applies to: non-embedded
docker_map_ports: true
# Optionally additional labels for docker containers
# (Available with 2022.1.2)
# Applies to: non-embedded
docker_labels: null
########################################
# Kubernetes outpost specific settings
########################################
# Replica count for the deployment of the outpost
# Applies to: non-embedded
kubernetes_replicas: 1
# Namespace to deploy in, defaults to the same namespace authentik is deployed in (if available)
kubernetes_namespace: authentik
# Any additional annotations to add to the ingress object, for example cert-manager
kubernetes_ingress_annotations: {}
# Name of the secret that is used for TLS connections, leave empty to disable TLS
kubernetes_ingress_secret_name: authentik-outpost-tls
# pathType to use on routes. Defaults to `Prefix`. Some ingress-nginx deployments need this to be set to `ImplementationSpecific`.
# Service kind created, can be set to LoadBalancer for LDAP outposts for example
kubernetes_service_type: ClusterIP
# Disable any components of the kubernetes integration, can be any of
# - 'secret'
# - 'deployment'
# - 'service'
# - 'prometheus servicemonitor'
# - 'ingress'
# - 'traefik middleware'
kubernetes_disabled_components: []
# If the above docker image is in a private repository, use these secrets to pull.
# NOTE: The secret must be created manually in the namespace first.
# Applies to: non-embedded
kubernetes_image_pull_secrets: []
# Optionally configure an ingress class name. If not set, the ingress will use the cluster's
# default ingress class
# (Available with 2022.11.0+)
# Applies to: proxy outposts
kubernetes_ingress_class_name: null
# Optionally apply an RFC 6902 compliant patch to the Kubernetes objects.
# For an understanding of how this works, refer to the link below:
# https://github.com/kubernetes-sigs/kustomize/blob/master/examples/jsonpatch.md
#
# This value expects a mapping where the key represents
# the Kubernetes component that shall be patched.
# It can be any of the same values supported by `kubernetes_disabled_components`.
#
# For example use this patch to add custom resource requests and limits
# to the outpost deployment:
#
# deployment:
#   - op: add
#     path: "/spec/template/spec/containers/0/resources"
#     value:
#       requests:
#         cpu: 2000m
#         memory: 2000Mi
#       limits:
#         cpu: 4000m
#         memory: 8000Mi
kubernetes_json_patches: null
# Disable strict x509 validation for Kubernetes API server.
#
# On some older Kubernetes clusters, the root certificate may have been
# generated without certain x509 extensions. `urllib3`, which is used in
# the official kubernetes client, introduced stricter validation for
# certificates in version 2.4.0 which will cause `certificate verify failed`
# errors to appear in outpost logs. This option disables the stricter
# validation and allows the outpost to connect to the Kubernetes API server
# even with older certificates.
#
# It is recommended to only enable this option if you are experiencing
# certificate validation issues and understand the security implications
# of disabling strict x509 validation.
kubernetes_disable_x509_strict: false
```

## Routing

Requests are routed as follows:

1. Paths starting with `/static`, `/media`, and `/help` return packaged CSS and JavaScript files, and user-uploaded media files.
2. Paths starting with `/outpost.goauthentik.io` are sent to the embedded outpost.
3. Any hosts configured in the providers assigned to the embedded outpost are sent to the outpost.
4. Everything remaining is sent to the authentik backend server.

## How the embedded outpost differs from managed outposts

There are a few differences between managed outposts and the embedded outpost because authentik cannot fully manage the main authentik server deployment in the same way that it manages a separate outpost deployment.

1. Docker only: no automatic Traefik labels are added to the server container.

   When you deploy a managed outpost on Docker, the container includes labels that can configure Traefik automatically. The embedded outpost does not add those labels to the server container.

2. Kubernetes only: an additional Service is created.

   Because authentik does not know the name of the primary authentik Service, it creates another Service with a common set of labels that is always present.

---

## Docker

The Docker integration automatically deploys and manages outpost containers using the Docker HTTP API.

This integration has the advantage over manual deployments of automatic updates that whenever authentik is upgraded to a later version, it also upgrades the outposts.

The following outpost settings are used:

- `object_naming_template`: Configures how the container is called.
- `container_image`: Optionally overwrites the standard container image (see [Configuration](../../../install-config/configuration/configuration.mdx#authentik_outposts) to configure the global default).
- `docker_network`: The Docker network the container should be added to. This needs to be modified if you plan to connect to authentik using the internal hostname.
- `docker_map_ports`: Enable/disable the mapping of ports. When using a proxy outpost with Traefik for example, you might not want to bind ports as they are routed through Traefik.
- `docker_labels`: Optional additional labels that can be applied to the container.

The container is created with the following hardcoded properties:

- Labels

  - `io.goauthentik.outpost-uuid`: Used by authentik to identify the container, and to allow for name changes.

  Additionally, the proxy outposts have the following extra labels to add themselves into Traefik automatically.

  - `traefik.enable`: "true"
  - `traefik.http.routers.ak-outpost-<outpost-name>-router.rule`: `Host(...)`
  - `traefik.http.routers.ak-outpost-<outpost-name>-router.service`: `ak-outpost-<outpost-name>-service`
  - `traefik.http.routers.ak-outpost-<outpost-name>-router.tls`: "true"
  - `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.healthcheck.path`: "/outpost.goauthentik.io/ping"
  - `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.healthcheck.port`: "9300"
  - `traefik.http.services.ak-outpost-<outpost-name>-service.loadbalancer.server.port`: "9000"

## Permissions

authentik requires the following permissions from the Docker API:

- Images/Pull: authentik tries to pre-pull the custom image if one is configured, otherwise falling back to the default image.
- Containers/Read: Gather infos about currently running container
- Containers/Create: Create new containers
- Containers/Kill: Cleanup during upgrades
- Containers/Remove: Removal of outposts
- System/Info: Gather information about the version of Docker running

## Docker Socket Proxy

Mounting the Docker socket to a container comes with some inherent security risks. Applications inside these containers have unfettered access to the full Docker API, which can be used to gain unauthorized access to sensitive Docker functions.

It can also result in possible root escalation on the host system.

To prevent this, many people use projects like [docker-socket-proxy](https://docs.linuxserver.io/images/docker-socket-proxy/), which limit access to the Docker socket by filtering and restricting API calls that these applications can make.

See [permissions](#permissions) for the list of APIs that authentik needs access to.

Connections from authentik to Docker socket proxy must be made over HTTP, not TCP, e.g. `http://<docker-socket-proxy hostname or container name>:<port>`.

## Remote hosts (TLS)

To connect remote hosts, follow this guide from Docker [Use TLS (HTTPS) to protect the Docker daemon socket](https://docs.docker.com/engine/security/protect-access/#use-tls-https-to-protect-the-docker-daemon-socket) to configure Docker.

Afterwards, create two certificate-keypairs in authentik:

- `Docker CA`, with the contents of `~/.docker/ca.pem` as Certificate
- `Docker Cert`, with the contents of `~/.docker/cert.pem` as the certificate and `~/.docker/key.pem` as the private key.

Create an integration with `Docker CA` as *TLS Verification Certificate* and `Docker Cert` as *TLS Authentication Certificate*.

## Remote hosts (SSH)

authentik can connect to remote Docker hosts using SSH. To configure this, create a new SSH keypair using these commands:

```shell
# Generate the keypair itself, using RSA keys in the PEM format
ssh-keygen -t rsa -f authentik  -N "" -m pem
# Generate a certificate from the private key, required by authentik.
# The values that openssl prompts you for are not relevant
openssl req -x509 -sha256 -nodes -days 365 -out certificate.pem -key authentik
```

You'll end up with three files:

- `authentik.pub` is the public key, this should be added to the `~/.ssh/authorized_keys` file on the target host and user.
- `authentik` is the private key, which should be imported into a Keypair in authentik.
- `certificate.pem` is the matching certificate for the keypair above.

Modify/create a new Docker integration, and set your *Docker URL* to `ssh://hostname`, and select the keypair you created above as *TLS Authentication Certificate/SSH Keypair*.

The *Docker URL* field include a user, if none is specified authentik connects with the user `authentik`.

#### Advanced SSH config

With the above configuration, authentik will create and manage an `~/.ssh/config` file. If you need advanced configuration, for example SSH Certificates, you can mount a custom SSH Config file.

Mount the config file into `/authentik/.ssh/config`, and mount any other relevant files into a directory under `/opt`. Afterwards, create an integration using `ssh://hostname`, and don't select a keypair.

---

## Kubernetes

The Kubernetes integration automatically deploys and manages outposts in a Kubernetes cluster.

Compared with a [manual Kubernetes deployment](../manual-deploy-kubernetes.mdx), this integration keeps managed outposts aligned with authentik updates and reduces the amount of cluster-side configuration that you need to maintain.

## Created resources

This integration creates the following Kubernetes resources:

- A `Deployment` for the outpost container.
- A `Service` for protocol traffic.
- A `Service` for metrics traffic.
- A `Secret` that stores the outpost token.
- A `ServiceMonitor` if the Prometheus Operator is installed in the target cluster.
- An `Ingress` for proxy outposts.
- An `HTTPRoute` for proxy outposts if Gateway API resources are installed in the target cluster and `kubernetes_httproute_parent_refs` is configured.
- A Traefik `Middleware` resource for proxy outposts that use forward auth.

## Supported settings

These settings control how authentik creates and manages Kubernetes resources. For the full shared outpost configuration reference, see [Outposts configuration](../index.mdx#configuration).

### General settings

- `object_naming_template`: Configures the names of created Kubernetes resources.
- `container_image`: Overrides the default outpost image. You can also configure the global default in [Configuration](../../../install-config/configuration/configuration.mdx#authentik_outposts).
- `kubernetes_replicas`: Sets the number of replicas in the generated deployment.
- `kubernetes_namespace`: Sets the namespace where authentik deploys the outpost. By default, this uses the namespace where authentik is installed, if available.
- `kubernetes_service_type`: Sets the generated Service type, for example `ClusterIP` or `LoadBalancer`.
- `kubernetes_image_pull_secrets`: Uses existing image pull secrets for private registries. Create these secrets in the target namespace before you use this setting.
- `kubernetes_json_patches`: Applies [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) JSON patches to generated Kubernetes objects.
- `kubernetes_disable_x509_strict`: Disable strict X.509 validation for the Kubernetes integration. Enable this setting if your cluster's root CA certificate was generated without certain key usage extensions. Seeing `certificate verify failed` errors in the outpost logs is an indicator that this setting should be set to `true`.

### Ingress settings

- `kubernetes_ingress_annotations`: Adds annotations to the generated Ingress, for example for cert-manager.
- `kubernetes_ingress_secret_name`: Sets the TLS secret name for the generated Ingress. Leave this empty to disable TLS configuration on the Ingress.
- `kubernetes_ingress_class_name`: Sets the ingress class for the generated Ingress.
- `kubernetes_ingress_path_type`: Sets the Ingress `pathType`. If unset, authentik uses the controller default.

### Gateway API settings

- `kubernetes_httproute_parent_refs`: Defines which Gateway resources the generated `HTTPRoute` attaches to.
- `kubernetes_httproute_annotations`: Adds annotations to the generated `HTTPRoute`.

### Disabled components

Use `kubernetes_disabled_components` to prevent authentik from creating specific resources. Supported values are:

- `secret`
- `deployment`
- `service`
- `service-metrics`
- `prometheus servicemonitor`
- `ingress`
- `traefik middleware`
- `httproute`

## Permissions

The required permissions for this integration are documented in the Helm chart:

- [Cluster-level permissions](https://github.com/goauthentik/helm/blob/main/charts/authentik-remote-cluster/templates/clusterrolebinding.yaml)
- [Namespace-level permissions](https://github.com/goauthentik/helm/blob/main/charts/authentik-remote-cluster/templates/rolebinding.yaml)

## Remote clusters

To connect a remote cluster, install the [`authentik-remote-cluster` Helm chart](https://artifacthub.io/packages/helm/goauthentik/authentik-remote-cluster) in the target cluster and namespace.

After installation, the chart outputs an example kubeconfig file. Add that kubeconfig to authentik to connect to the cluster.

---

## Configure Entra ID

For more information about using an Entra ID provider, see the [Entra ID Overview](./index.mdx) documentation.

Your Entra ID tenant must be configured before you [create an Entra ID provider](./create-entra-provider.mdx).

This involves creating an app registration, generating a secret, and configuring the required API permissions.

When the default `authentik default Microsoft Entra Mapping: User` property mapping is used, authentik checks whether each user's email domain is verified in your Entra ID tenant.

In which case, you must configure each user's email domain as a [verified custom domain in Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/domains-manage#add-custom-domain-names-to-your-microsoft-entra-organization); otherwise, provisioning fails. The tenant's default `onmicrosoft.com` domain (e.g., `@<tenant name>.onmicrosoft.com`), is considered a verified domain.

Alternatively, if you need to provision users with email domains that you don't control, refer to [Email handling](./create-entra-provider.mdx#email-handling) for more information.

## Configure your Entra ID tenant

1. Log in to the [Entra ID admin center](https://entra.microsoft.com).
2. Navigate to **App registrations**, click **New registration**, and set the following configurations:
   - Provide a **Name** for the app registration (e.g. `authentik Entra Provider`)
   - Under **Supported account types**, select **Accounts in this organizational directory only**
   - Leave **Redirect URI** empty
3. Click **Register**.
4. On the app detail page, take note of the **Application (client) ID** and **Directory (tenant) ID**. These values will be required when you [create the Entra ID provider](./create-entra-provider.mdx) in authentik.
5. Next, in the near-left navigation pane, click on **Certificates and Secrets**.
6. On the **Client secrets** tab, click **New client secret** and set the following configuration:
   - Provide a **Description** for the client secret
   - Set an expiry period for the secret. Please note that you will need to rotate the secret value in Entra ID and authentik upon expiry.
7. Click **Add**.
8. The **Value** of the client secret is shown only once. Take note of the value as it will be required when you [create the Entra ID provider](./create-entra-provider.mdx) in authentik.
9. Next, in the near-left navigation pane, click on **API permissions**.
10. Click **Add a permission** and select **Microsoft Graph** as the API.
11. Select **Application permissions** as the permission type and assign the following permissions:
    - `Group.Create`
    - `Group.ReadWrite.All`
    - `GroupMember.ReadWrite.All`
    - `User.ReadWrite.All`
12. Click **Add permissions**.
13. Under **Configured permissions**, click **Grant admin consent for default directory**.

Now that you have configured your Entra ID tenant, you are ready to [create an Entra ID provider](./create-entra-provider.mdx).

---

## Create an Entra ID provider

For more information about using an Entra ID provider, see the [Overview](./index.mdx) documentation.

## Prerequisites

To create an Entra ID provider in authentik, you must have already [configured Entra ID](./configure-entra.mdx).

## Create an Entra ID provider in authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **New Provider**.
3. Select **Microsoft Entra Provider** as the provider type, then click **Next**.
4. On the **New Microsoft Entra Provider** page, set the following configurations:
    - **Name**: provide a descriptive name (e.g. `Entra ID provider`)
    - Under **Protocol settings**:
        - **Client ID**: the Client ID that you copied when [configuring Entra ID](./configure-entra.mdx)
        - **Client Secret**: the secret from Entra ID
        - **Tenant ID**: the Tenant ID from Entra ID
        - **User deletion action**: controls what happens in Entra ID when a user is deleted from authentik. Defaults to **Delete**. See [Deletion and offboarding](./index.mdx#deletion-and-offboarding) for the available actions and their effects
        - **Group deletion action**: controls what happens in Entra ID when a group is deleted from authentik. Defaults to **Delete**. See [Deletion and offboarding](./index.mdx#deletion-and-offboarding) for the available actions and their effects
    - Under **User filtering**:
        - **Exclude service accounts**: choose whether to include or exclude service accounts
        - **Group**: select a group and only users within that group will be synced to Entra ID
    - Under **Attribute mapping**:
        - **User Property Mappings**: select any property mappings, or use the default
        - **Group Property Mappings**: select any property mappings, or use the default

        The `SkipObject` exception can be used within a property mapping to prevent specific objects from being synced. Refer to the [Provider property mappings documentation](../property-mappings/index.mdx#skip-objects-during-synchronization) for more details.

5. Click **Finish**.

## Create an Entra ID application in authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications**, click **New Application**, and set the following configurations:
    - **Name**: provide a name for the application (e.g. `Entra ID`)
    - **Slug**: enter the name that you want to appear in the URL
    - **Provider**: this field should be left empty
    - **Backchannel Providers**: this field is required for Entra ID. Select the name of the Entra ID provider that you created in the previous section.
    - **UI settings**: leave these fields empty for Entra ID.

3. Click **Create**.

## Email handling (_optional_) {#email-handling}

When the default `authentik default Microsoft Entra Mapping: User` property mapping is used, authentik checks whether each user's email domain is verified in your Entra ID tenant.

In which case, you must configure each user's email domain as a [verified custom domain in Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/domains-manage#add-custom-domain-names-to-your-microsoft-entra-organization); otherwise, provisioning fails. The tenant's default `onmicrosoft.com` domain (e.g., `@<tenant name>.onmicrosoft.com`), is considered a verified domain.

### Email-verified-users

Alternatively, if you need to provision users with email domains that you don't control, you can provision users as "email-verified-users" in Entra ID.

These are limited access accounts that must use email for verification when logging in, refer to the [Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity/users/directory-self-service-signup) for more information about the limitations of these accounts.

This is possible via a modified property mapping:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**.
3. Select **Microsoft Entra Provider Mapping** as the property mapping type and click **Next**.
4. Provide a **Name** for the property mapping and set the following **Expression**:

```python showLineNumbers
# Field reference: (note that keys have to converted to snake_case)
# https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0
from msgraph.generated.models.password_profile import PasswordProfile
from msgraph.generated.models.object_identity import ObjectIdentity

# Domains that are verified in Entra ID
verified_domains = {
    "company.com",
    "example.com",
    # add more domains here...
}

# Extract domain from email
email = request.user.email
domain = email.split("@", 1)[-1].lower()

if domain in verified_domains:
    # For users with verified domains
    user = {
        "display_name": request.user.name,
        "account_enabled": request.user.is_active,
        "mail_nickname": request.user.username,
        "user_principal_name": request.user.email,
    }
    if connection:
        # If there is a connection already made (discover or update), we can use
        # that connection's immutable_id...
        user["on_premises_immutable_id"] = connection.attributes.get("on_premises_immutable_id")
    else:
        user["password_profile"] = PasswordProfile(
            password=request.user.password
        )
        # ...otherwise we set an immutable ID based on the user's UID
        user["on_premises_immutable_id"] = request.user.uid
else:
    # For users with non-verified domains
    # e.g., email-verified-users
    # https://learn.microsoft.com/en-us/entra/identity/users/domains-manage#add-custom-domain-names-to-your-microsoft-entra-organization
    user = {
        "display_name": request.user.name,
        "mail": request.user.email,
        "password_policies": "DisablePasswordExpiration", # this setting is required by Entra ID
        "user_type": "member" # can be set to "guest" to limit a user's access to read user lists
    }

    # for other sign in types
    # refer to https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0
    user["identities"] = [
        ObjectIdentity(
          sign_in_type = "federated",
          issuer = "mail",
          issuer_assigned_id = request.user.email,
        )
    ]

    user["password_profile"] = PasswordProfile(
        password=request.user.password
    )

return user
```

5. Click **Finish**.
6. Navigate to **Applications** > **Providers** and open the Entra ID provider that you previously created.
7. Under **Attribute mapping**, remove the `authentik default Microsoft Entra Mapping: User` property mapping and add the property mapping that you just created.
8. Click **Update**.

---

## Microsoft Entra ID provider

The Entra ID provider allows you to integrate with your Entra ID tenant. It supports syncing users and groups from authentik to Entra ID, allowing authentik to act as a source of truth for all users and groups.

- For instructions on configuring your Entra ID tenant in prepation for creating an Entra ID provider, refer to [Configure Entra ID](./configure-entra.mdx).
- For instructions on creating an Entra ID provider, refer to [Create an Entra ID provider](./create-entra-provider.mdx).

If you also want to authenticate to Entra ID using authentik credentials, refer to our [Microsoft 365 SAML](/integrations/platforms/microsoft-saml/index.mdx) or [Microsoft 365 WS-Federation](/integrations/platforms/microsoft-ws-federation/index.mdx) integrations guides.

## Discovery

Upon creating the Entra ID provider, it will run a discovery task to query your Entra ID tenant for all users and groups, and attempt to match them with their respective counterparts in authentik.

Users are matched on their email address. Groups are matched based on their names.

This discovery also takes into consideration any **User filtering** options configured in the provider, such as only linking to authentik users in a specific group or excluding service accounts. This discovery process occurs each time a [full sync](#full-sync) is initiated.

## Synchronization

There are two types of synchronization: direct sync and full sync.

### Direct sync

A direct sync occurs when a user or group is created, updated or deleted in authentik, or when a user is added to or removed from a group. When any of these events occur, the direct sync automatically syncs those changes to Entra ID.

### Full sync

A full sync occurs when the provider is initially created and when it is saved. During a full sync, all users and groups that match the **User filtering** settings are processed and created or updated in Entra ID. After the initial sync, authentik automatically performs a full sync every four hours by default to maintain consistency between users and groups.

During the full sync, if a user or group exists in both authentik and Entra ID, authentik will automatically link them.

Additionally, any users or groups present in authentik but absent in Entra ID will be created and linked.

## Deletion and offboarding

The provider's **User deletion action** and **Group deletion action** control what happens to the linked Entra ID object when you delete its counterpart in authentik. Both settings default to **Delete**. Deletion is processed by a background sync task and requires the provider to remain assigned to an application. Dry-run mode prevents changes to the remote directory.

| Action                         | When an authentik user is deleted                                                                         | When an authentik group is deleted                                          |
| ------------------------------ | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| **Delete** (`delete`, default) | Deletes the linked Entra ID user account.                                                                 | Deletes the linked Entra ID group.                                          |
| **Suspend** (`suspend`)        | Keeps the Entra ID account and disables sign-in by setting Microsoft Graph's `accountEnabled` to `false`. | Unsupported. Treated as **Do Nothing**, leaving the remote group unchanged. |
| **Do Nothing** (`do_nothing`)  | Leaves the Entra ID account unchanged, including its enabled or suspended status.                         | Leaves the Entra ID group unchanged.                                        |

All three actions remove authentik's connection record for the deleted user or group. **Suspend** retains the remote user account; it does not retain the deleted authentik user. **Do Nothing** does not revoke access to the remote account.

In the Admin interface, **User deletion action** offers **Delete**, **Suspend**, and **Do Nothing**. Suspension applies only to users, so **Group deletion action** offers **Delete** and **Do Nothing**.

### Deactivate a user without deleting the account

Marking an authentik user inactive is an update, so it does not use **User deletion action**. With the default user property mapping, authentik sets `account_enabled` to `False`, which becomes `accountEnabled: false` in Microsoft Graph. The authentik user and its connection record remain, and reactivating the user allows the default mapping to enable the remote account again.

This requires the user to remain included in synchronization. Custom property mappings can change whether active status is synchronized.

### Offboard users and groups

- To retain a user's accounts while disabling sign-in, mark the authentik user inactive and verify that synchronization has disabled the Entra ID account before removing the user from synchronization filters.
- To delete an authentik user while retaining the remote account, select **Suspend** for **User deletion action** before deleting the user. Use **Do Nothing** only if you intend to manage the remote account's access separately.
- To delete the remote user or group as well, use **Delete**. Complete any required data retention or ownership transfers in Entra ID before deleting the authentik object.
- After offboarding, check the provider's sync tasks for errors and verify the account or group state in Entra ID.

Removing a user from the provider's filtering group, changing **User filtering** to exclude the user, or skipping a user with `SkipObject` does not itself delete or suspend the remote account. These changes exclude the user from provisioning updates. Removing group membership can also remove that membership in Entra ID, but it does not disable the account.

Do not rely on filtering alone to revoke access. If you later delete a previously linked authentik user, its retained connection record still allows the configured deletion action to run.

## Error handling

Property mappings are evaluated in name order. If a property mapping fails to evaluate, authentik stops the synchronization and does not evaluate the remaining mappings.

To handle network interruptions, authentik detects transient request failures and retries sync tasks.

## Property mapping

There are several considerations regarding how authentik data is mapped to Entra ID user and group data.

### Users

For users, authentik only saves the full display name, not separate first and family names.

By default, authentik maps a user's email address, name, and whether the user is active.

Refer to the Entra ID documentation for further details on which attributes can be mapped: [Microsoft Graph - Create User](https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0\&tabs=http#request-body)

### Groups

By default, authentik only maps a group's name, `mail_enabled` status, `security_enabled` status and `mail_nickname` (equivalent to name).

Refer to the Entra ID documentation for further details on these attributes and which attributes can be mapped: [Microsoft Graph - Create Group](https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0\&tabs=http#request-body)

### Skip objects during synchronization

To exclude specific users or groups from Entra ID synchronization, you can create a property mapping that raises the `SkipObject` exception. When this exception is raised during the evaluation of a property mapping, the object is skipped and the sync continues with the next object.

For more information, refer to [Skip objects during synchronization](../property-mappings/#skip-objects-during-synchronization).

---

## Configure Google Workspace

For more information about using a Google Workspace provider, see the [Overview](./index.mdx) documentation.

Your Google Workspace organization must be configured before you [create a Google Workspace provider](./create-gws-provider.mdx).

## Configure your Google Workspace organization

The main steps to configure your Google Workspace organization are:

1. [Create a Google Cloud project](#create-a-google-cloud-project)
2. [Create a service account](#create-a-service-account)
3. [Configure service account key and scopes](#configure-service-account-key-and-scopes)
4. [Select a user for the Delegated Subject](#select-a-user-for-the-delegated-subject)

### Create a Google Cloud project

1. Open the [Google Cloud console](https://cloud.google.com/cloud-console).
2. In the upper left, click the drop-down box to open the **Select a project** box, then select **New Project**.
3. Create a new project and provide a name (e.g. `authentik GWS`).
4. Use the search bar at the top of your new project page to search for `API Library`.
5. On the **API Library** page, use the search bar again to find `Admin SDK API`.
6. On the **Admin SDK API** page, click **Enable**.

### Create a service account

1. After the new Admin SDK API is enabled (it might take a few minutes), return to the Google Cloud console home page by clicking on **Google Cloud** in the upper left.
2. Use the search bar to find and navigate to the **IAM** page.
3. On the **IAM** page, click **Service Accounts** in the left navigation pane.
4. At the top of the **Service Accounts** page, click **Create Service Account**.
   - Under **Service account details** page, define the **Name** and **Description** for the new service account, then click **Create and Continue**.
   - Under **Grant this service account access to project** you do not need to define a role, so click **Continue**.
   - Under **Grant users access to project** you do not need to define a role, so click **Done** to complete the creation of the service account.

### Configure service account key and scopes

1. On the **Service Accounts** page, click the account that you just created.

2. Click the **Keys** tab at the top of the page, then click **Add Key** > **Create new key**.

3. Select **JSON** as the key type, then click **Create**.
   A pop-up displays with the private key. The key can be saved to your computer as a JSON file. This key will be required when creating the Google Workspace provider in authentik.

   By default, the Google Cloud organization policy `iam.disableServiceAccountKeyCreation` prevents creating service account keys. To allow key creation:

   1. Navigate to **IAM & Admin** > **Organization Policies** and select the **Disable service account key creation** policy.
   2. Click **Manage policy** and disable the policy.
   3. Click **Set policy** to save your changes.

4. On the service account page, click the **Details** tab, and expand the **Advanced settings** area.

5. Copy the **Client ID** (under **Domain-wide delegation**), and then click **View Google Workspace Admin Console**.

6. Log in to the Admin Console, and then navigate to **Security** > **Access and data control** > **API controls**.

7. On the **API controls** page, click **Manage Domain Wide Delegation**.

8. On the **Domain Wide Delegation** page, click **Add new**.

9. In the **Add a new client ID** box, paste in the Client ID that you copied from the Admin console earlier (the value from the downloaded JSON file) and paste in the following scopes:
   - `https://www.googleapis.com/auth/admin.directory.user`
   - `https://www.googleapis.com/auth/admin.directory.group`
   - `https://www.googleapis.com/auth/admin.directory.group.member`
   - `https://www.googleapis.com/auth/admin.directory.domain.readonly`

### Select a user for the Delegated Subject

**Delegated Subject** is a required field when creating the Google Workspace provider in authentik. This field must be populated with the email address of a Google Workspace user with [suitable permissions](#delegated-subject-permissions).

1. In the sidebar navigate to **Directory** > **Users**.
2. Either select an existing user's email address or **Add New User** and define the user and email address to use as the Delegated Subject.
3. Take note of this email address as it will be required when creating the Google Workspace provider in authentik.

#### Delegated Subject permissions

We do not recommend using an administrator account for the Delegated Subject user. A custom role should be used instead, see the [Google Admin console documentation](https://support.google.com/a/answer/2406043?hl=en) for more details.

The Delagated Subject user requires the following permissions:

##### Admin console privileges

- Users
- Groups

##### Admin API privileges

- Domain management
- Users
- Groups

Now that you have configured your Google Workspace organization, you are ready to [create a Google Workspace provider](./create-gws-provider.mdx).

---

## Create a Google Workspace provider

For more information about using a Google Workspace provider, see the [Overview](./index.mdx) documentation.

## Prerequisites

To create a Google Workspace provider in authentik, you must have already [configured Google Workspace](./configure-gws.mdx).

## Create a Google Workspace provider in authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Providers** and click **New Provider**.

3. Select **Google Workspace Provider** as the provider type, then click **Next**.

4. On the **New Google Workspace Provider** page, set the following configurations:
   - **Name**: provide a descriptive name (e.g. `GWS provider`)
   - Under **Protocol settings**:
     - **Credentials**: paste the contents of the JSON file that you downloaded when [configuring Google Workspace](./configure-gws.mdx)
     - **Delegated Subject**: enter the email address of the Google Workspace user that all authentik actions will be delegated to
     - **Default group email domain**: enter a domain which will be used to generate the email address for groups synced from authentik to Google Workspace
     - **User deletion action**: controls what happens in Google Workspace when a user is deleted from authentik. Defaults to **Delete**. See [Deletion and offboarding](./index.mdx#deletion-and-offboarding) for the available actions and their effects
     - **Group deletion action**: controls what happens in Google Workspace when a group is deleted from authentik. Defaults to **Delete**. See [Deletion and offboarding](./index.mdx#deletion-and-offboarding) for the available actions and their effects
   - Under **User filtering**:
     - **Exclude service accounts**: choose whether to include or exclude service accounts
     - **Group**: select a group and only users within that group will be synced to Google Workspace
   - Under **Attribute mapping**:

     - **User Property Mappings**: select any property mappings, or use the default
     - **Group Property Mappings**: select any property mappings, or use the default

     The `SkipObject` exception can be used within a property mapping to prevent specific objects from being synced. Refer to the [Provider property mappings documentation](../property-mappings/index.mdx#skip-objects-during-synchronization) for more details.

5. Click **Finish**.

## Create a Google Workspace application in authentik

If you have configured the [Google Workspace SAML integration](/integrations/cloud-providers/google/) to enable authenticating to Google Workspace with authentik, you can add the provider created in the previous section as a backchannel provider to the existing application, instead of creating a new one.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Applications**, click **New Application**, and set the following configurations:
   - **Name**: provide a name for the application (e.g. `GWS`)
   - **Slug**: enter the name that you want to appear in the URL
   - **Provider**: when *not* used in conjunction with the [Google SAML configuration](/integrations/cloud-providers/google), this should be left empty.
   - **Backchannel Providers**: this field is required for Google Workspace. Select the name of the Google Workspace provider that you created in the previous section.
   - **UI settings**: leave these fields empty for Google Workspace.

3. Click **Create**.

---

## Google Workspace provider

The Google Workspace provider allows you to integrate with your Google Workspace organization. It supports syncing users and groups from authentik to Google Workspace, allowing authentik to act as a source of truth for all users and groups.

- For instructions on configuring your Google Workspace organization in prepation for creating a Google Workspace provider, refer to the [Configure Google Workspace](./configure-gws.mdx) documentation.
- For instructions on creating a Google Workspace provider, refer to the [Create a Google Workspace provider](./create-gws-provider.mdx) documentation.

## Discovery

Upon creating the Google Workspace provider, it will run a discovery task to query your google workspace for all users and groups, and attempt to match them with their respective counterparts in authentik.

Users are matched on their email address. Groups are matched based on their names.

This discovery also takes into consideration any **User filtering** options configured in the provider, such as only linking to authentik users in a specific group or excluding service accounts. This discovery process occurs each time a full sync is initiated.

## Synchronization

There are two types of synchronization: direct sync and full sync.

### Direct sync

A direct sync occurs when a user or group is created, updated or deleted in authentik, or when a user is added to or removed from a group. When any of these events occur, the direct sync automatically syncs those changes to Google Workspace.

### Full sync

A full sync occurs when the provider is initially created and when it is saved. During a full sync, all users and groups that match the **User filtering** settings are processed and created or updated in Google Workspace. After the initial sync, authentik automatically performs a full sync every four hours to maintain consistency between users and groups.

During the full sync, if a user or group exists in both authentik and Google Workspace, authentik will automatically link them.

Additionally, any users or groups present in authentik but absent in Google Workspace will be created and linked.

## Deletion and offboarding

The provider's **User deletion action** and **Group deletion action** control what happens to the linked Google Workspace object when you delete its counterpart in authentik. Both settings default to **Delete**. Deletion is processed by a background sync task and requires the provider to remain assigned to an application. Dry-run mode prevents changes to the remote directory.

| Action                         | When an authentik user is deleted                                                         | When an authentik group is deleted                                          |
| ------------------------------ | ----------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| **Delete** (`delete`, default) | Deletes the linked Google Workspace user account.                                         | Deletes the linked Google Workspace group.                                  |
| **Suspend** (`suspend`)        | Keeps the Google Workspace account and disables sign-in by setting `suspended` to `true`. | Unsupported. Treated as **Do Nothing**, leaving the remote group unchanged. |
| **Do Nothing** (`do_nothing`)  | Leaves the Google Workspace account unchanged, including its enabled or suspended status. | Leaves the Google Workspace group unchanged.                                |

All three actions remove authentik's connection record for the deleted user or group. **Suspend** retains the remote user account; it does not retain the deleted authentik user. **Do Nothing** does not revoke access to the remote account.

In the Admin interface, **User deletion action** offers **Delete**, **Suspend**, and **Do Nothing**. Suspension applies only to users, so **Group deletion action** offers **Delete** and **Do Nothing**.

### Deactivate a user without deleting the account

Marking an authentik user inactive is an update, so it does not use **User deletion action**. With the default user property mapping, authentik sets `suspended` to `true` in Google Workspace. The authentik user and its connection record remain, and reactivating the user allows the default mapping to enable the remote account again.

This requires the user to remain included in synchronization. Custom property mappings can change whether active status is synchronized.

### Offboard users and groups

- To retain a user's accounts while disabling sign-in, mark the authentik user inactive and verify that synchronization has disabled the Google Workspace account before removing the user from synchronization filters.
- To delete an authentik user while retaining the remote account, select **Suspend** for **User deletion action** before deleting the user. Use **Do Nothing** only if you intend to manage the remote account's access separately.
- To delete the remote user or group as well, use **Delete**. Complete any required data retention or ownership transfers in Google Workspace before deleting the authentik object.
- After offboarding, check the provider's sync tasks for errors and verify the account or group state in Google Workspace.

Removing a user from the provider's filtering group, changing **User filtering** to exclude the user, or skipping a user with `SkipObject` does not itself delete or suspend the remote account. These changes exclude the user from provisioning updates. Removing group membership can also remove that membership in Google Workspace, but it does not disable the account.

Do not rely on filtering alone to revoke access. If you later delete a previously linked authentik user, its retained connection record still allows the configured deletion action to run.

## Error handling

Property mappings are evaluated in name order. If a property mapping fails to evaluate, authentik stops the synchronization and does not evaluate the remaining mappings.

To handle network interruptions, authentik detects transient request failures and retries sync tasks.

## Property mapping

There are several considerations regarding how authentik data is mapped to Google Workspace user and group data.

### Users

For users, authentik only saves the full display name, while Google requires the first (given) name and the family name separately, and as such authentik attempts to separate the full name automatically with the `authentik default Google Workspace Mapping: User` property mapping.

By default, authentik maps a user’s email address, name, and active status.

Refer to Google documentation for further details on which attributes can be mapped: [Google Workspace Reference - Resource: User](https://developers.google.com/admin-sdk/directory/reference/rest/v1/users#User)

### Groups

For groups, Google Workspace groups require an email address. Therefore the Google Workspace provider has an **Default group email domain** setting, which will be used in conjunction with the group’s name to generate an email address. This can be customized with a property mapping.

By default, authentik only maps a group's name.

Refer to Google documentation for further details on which attributes can be mapped: [Google Workspace Reference - Resource: Group](https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups#Group)

### Skip objects during synchronization

To exclude specific users or groups from Google Workspace synchronization, you can create a property mapping that raises the `SkipObject` exception. When this exception is raised during the evaluation of a property mapping, the object is skipped and the sync continues with the next object.

For more information, refer to [Skip objects during synchronization](../property-mappings/#skip-objects-during-synchronization).

---

## Create an LDAP provider

Creating an authentik LDAP provider requires the following steps:

1. [Create an LDAP authentication flow *(optional)*](#create-an-ldap-authentication-flow-optional)
2. [Create an LDAP application and provider](#create-an-ldap-application-and-provider)
3. [Create a service account and assign the LDAP search permission](#create-a-service-account)
4. [Create an LDAP Outpost](#create-an-ldap-outpost)

## Create an LDAP authentication flow *(optional)*

The `default-authentication-flow` validates MFA by default. Duo, TOTP, and static authenticators are supported by the LDAP provider. WebAuthn and SMS are not supported.

If you plan to use only dedicated service accounts to bind to LDAP, or only use LDAP supported MFA authenticators, then you can use the default authentication flow and skip this section and continue with the [Create an LDAP application and provider](#create-an-ldap-application-and-provider) section.

Refer to [Code-Based MFA support](./index.mdx#code-based-mfa-support) for more information on LDAP and MFA.

### Create custom stages

You'll need to create the stages that make up the flow.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Stages**, and click **Create**.

#### Password Stage

First, you'll need to create a Password Stage.

3. Select **Password stage** as the stage type, click **Next**, and set the following required configurations:
   - Provide a **Name** for the stage (e.g. `ldap-authentication-password-stage`).
   - For **Backends**, include **User database + app passwords** to allow [binding with app passwords](./index.mdx#bind-with-an-app-password). Keep **User database + standard password** selected if users should also be able to bind with their regular passwords.
4. Click **Finish**

#### Identification Stage

Next, you'll need to create an Identification Stage.

5. On the **Stages** page, click **Create**.
6. Select **Identification Stage** as the stage type, click **Next**, and set the following required configurations:
   - Provide a **Name** for the stage (e.g. `ldap-identification-stage`).
   - For **User Fields**, select `Username` and `Email` (and UPN if it is relevant to your setup).
   - Set **Password stage** to the Password Stage created in the previous section (e.g. `ldap-authentication-password-stage`)
7. Click **Finish**

#### User Login Stage

Finally, you'll need to create a User Login Stage.

8. On the **Stages** page, click **Create**.
9. Select **User Login Stage** as the stage type, click **Next**, and set the following required configurations:
   - Provide a **Name** for the stage (e.g. `ldap-authentication-login-stage`).
10. Click **Finish**

### Create an LDAP authentication flow

Now you'll need to create the LDAP authentication flow and bind the previously created stages.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**, click **New Flow**, and set the following required configurations:
   - Provide a **Name**, **Title** and **Slug** for the flow (e.g. `ldap-authentication-flow`).
   - Set **Designation** to `Authentication`.
3. Click **Create**.
4. Click the name of the newly created flow, open the **Stage Bindings** tab, and click **Create or bind...**
5. Select **Existing Stage**.
6. Select the previously created LDAP Identification Stage (e.g.`ldap-identification-stage`), set the order to `10`, and click **Create**.
7. Repeat above steps: click **Create or bind...** and then select **Existing Stage**.
8. Select the previously created LDAP User Login Stage (e.g.`ldap-authentication-login-stage`), set the order to `30`, and click **Create**.

## Create an LDAP application and provider

The LDAP application and provider can now be created.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications**, click **New Application** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **LDAP Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure LDAP Provider** page, provide the configuration settings and then click **Submit** to create both the application and the provider.

If you followed the optional [Create an LDAP authentication flow](#create-an-ldap-authentication-flow-optional) section, ensure that you set **Bind Flow** to newly created authentication flow (e.g. `ldap-authentication-flow`).

## Create a service account

Create a service account to bind to LDAP with.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Users** and click **New User**.
3. Provide a name for the service account (e.g. `ldapservice`) and click **Create**.
4. Click the name of the newly created service account.
5. Under **Recovery**, click **Set password**, provide a secure password for the account, and click **Update password**.

The default DN of this user will be `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`

### Assign the LDAP search permission to the service account

The service account must have access to the LDAP application. If the application uses [bindings](../../applications/manage_apps.mdx#use-bindings-to-control-access), configure them to allow the service account access.

To search for other users and groups, the service account also needs the **Search full LDAP directory** permission. Create a role with this permission and add the service account to it:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Roles** and click **New Role**.
3. Provide a name for the role (e.g. `LDAP search`) and then click **Create Role**.
4. Click on the newly created role and open the **Users** tab.
5. Click **Add Existing User**, select the service account, and then click **Assign**.
6. Navigate to **Applications** > **Providers**.
7. Click on the name of the newly created LDAP provider and open the **Permissions** tab.
8. Click **Assign Role Object Permission**.
9. Select the role that you created (e.g. `LDAP search`), enable the **Search full LDAP directory** permission, and then click **Assign Role Object Permission**.

This object permission grants the service account full search access to this LDAP provider only. For more information, see [Searching](./index.mdx#searching).

## Create an LDAP Outpost

The LDAP provider requires the deployment of an LDAP [Outpost](../../outposts/index.mdx).

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Outposts**, click **New Outpost** and set the following required configurations:
   - Provide a **Name** for the outpost (e.g. \`LDAP Outpost').
   - Set the **Type** as `LDAP`.
   - Set **Integration** to match your deployment method or manually deploy an outpost via [Docker-Compose](../../outposts/manual-deploy-docker-compose.mdx) or [Kubernetes](../../outposts/manual-deploy-kubernetes.mdx). For more information, refer to the [Outpost documentation](../../outposts/index.mdx).
   - Under **Applications**, select the LDAP application created in the previous section.
   - Under **Advanced settings**, set the required outpost configurations. For more information, refer to [Outpost Configuration](../../outposts/index.mdx#configuration)

3. Click **Create**.

The LDAP Outpost selects different providers based on their Base DN. Adding multiple providers with the same Base DN will result in inconsistent access.

## Configuration verification

You can test the LDAP provider by using the `ldapsearch` tool on Linux and macOS, or the `dsquery` tool on Windows.

To install the `ldapsearch` tool, use one of the following commands:

```shell
sudo apt-get install ldap-utils -y # Debian-based systems
sudo yum install openldap-clients -y # CentOS-based systems
brew install openldap #macOS based systems (requires Homebrew to be installed)
```

To search the LDAP directory using the previously created `ldapservice` service account, use the following command:

```shell
ldapsearch \
  -x \
  -H ldap://<LDAP outpost IP address>:389 \
  -D 'cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io' \
  -w '<ldapuserpassword>' \
  -b 'DC=ldap,DC=goauthentik,DC=io' \
  '(objectClass=user)'
```

This example query will return all users and log the first successful attempt in an event in **Events** > **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](./index.mdx#bind-modes).

In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](./index.mdx#ldaps-via-ssl-or-starttls) for more information.

To search the LDAP directory using the previously created `ldapservice` service account, use the following command:

```powershell
dsquery * -s <LDAP outpost IP address> -u "cn=ldapservice,ou=users,DC=ldap,DC=goauthentik,DC=io" -p <ldapuserpassword> -b "DC=ldap,DC=goauthentik,DC=io" -filter "(objectClass=user)"
```

This example query will return all users and log the first successful attempt in an event in **Events** > **Logs**. Subsequent successful logins from the same user are not logged by default, as they are cached in the outpost. For more details see [Bind modes](./index.mdx#bind-modes).

In production it is recommended to use LDAPS, which requires `ldaps://` as the protocol, and port number `636` rather than `389`. See [LDAPS](./index.mdx#ldaps-via-ssl-or-starttls) for more information.

---

## LDAP Provider

The LDAP provider allows you to integrate with Service Providers using LDAP. It supports secure connections via LDAPS, code-based MFA authentication, basic LDAP schema compatibility, and can also be integrated with [SSSD](/integrations/infrastructure/sssd/) for authentication on Linux-based systems.

Refer to our documentation to learn how to [create an LDAP provider](./create-ldap-provider.mdx).

## LDAP directory

All users and groups in authentik's database are searchable via the LDAP directory served by the LDAP provider.

### Base DN

You can configure under which **Base DN** the LDAP directory should be available. The default is: `DC=ldap,DC=goauthentik,DC=io`

The setting is available under **Protocol settings** on the LDAP provider.

When using multiple LDAP providers, each LDAP provider must have a unique Base DN. You can achieve this by prepending an application-specific OU or DC. e.g. `OU=appname,DC=ldap,DC=goauthentik,DC=io`

### Users

Users are located under: `ou=users,<base DN>`

To aid compatibility, each user belongs to its own "virtual" group, as is standard on most Unix-like systems. This group does not exist in the authentik database, and is generated on the fly. These virtual groups are located under the `ou=virtual-groups,<base DN>` DN. They have the same attributes as groups but have an additional `objectClass`: `goauthentik.io/ldap/virtual-group`. The `gidNumber` attribute of each virtual group is equal to the `uidNumber` of the user.

The following attributes are returned for users:

| Attribute       | Description                                                                                                                                               |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `cn`            | User's username                                                                                                                                           |
| `uid`           | Unique user identifier                                                                                                                                    |
| `uidNumber`     | A unique numeric identifier for the user                                                                                                                  |
| `name`          | User's name                                                                                                                                               |
| `displayName`   | User's display name                                                                                                                                       |
| `mail`          | User's email address                                                                                                                                      |
| `objectClass`   | List of these strings: "user", "organizationalPerson", "goauthentik.io/ldap/user"                                                                         |
| `memberOf`      | List of all DNs that the user is a member of                                                                                                              |
| `homeDirectory` | Default home directory path for the user, by default `/home/$username`. Can be overwritten by setting `homeDirectory` as an attribute on users or groups. |
| `ak-active`     | `true` if the account is active, otherwise `false`                                                                                                        |
| `ak-superuser`  | `true` if the account is part of a group with superuser permissions, otherwise `false`                                                                    |

Any custom attributes you set are also returned as LDAP attributes. Built-in attributes will be overwritten by custom attributes with matching names. Periods and slashes in custom attributes are sanitized.

### Groups

Groups are located under: `ou=groups,<base DN>`

The following attributes are returned for groups:

| Attribute     | Description                                                                                          |
| ------------- | ---------------------------------------------------------------------------------------------------- |
| `cn`          | The group's name                                                                                     |
| `uid`         | Unique group identifier                                                                              |
| `gidNumber`   | Unique numeric identifier for the group                                                              |
| `member`      | List of all DNs of the group's members, including groups which have this group as their parent group |
| `memberOf`    | The DN of the parent group if this group has a parent group                                          |
| `objectClass` | List of these strings: "group", "goauthentik.io/ldap/group"                                          |

Any custom attributes you set are also returned as LDAP attributes. Built-in attributes will be overwritten by custom attributes with matching names. Periods and slashes in custom attributes are sanitized.

## LDAPS via SSL or StartTLS

The LDAP provider supports secure connections via LDAPS using SSL or StartTLS.

You can configure SSL or StartTLS by configuring the **Certificate** and **TLS Server Name** settings on the provider.

The provider will pick the correct certificate based on the configured **TLS Server Name** setting. The certificate is not picked based on the **Bind DN**, because the StartTLS operation should occur before the bind request to ensure that bind credentials are transmitted over TLS.

Configuring SSL or StartTLS enables you to bind on port 636 using LDAPS.

## Binding

Binding against the LDAP provider uses a flow in the background. This allows you to use the same policies and flows as you do for web-based logins.

The **Bind Flow** determines the flow used for binding/authenticating users, and the **Unbind Flow** determines the flow used when unbinding/de-authenticating users. Each is set under **Flow settings** on the LDAP provider.

The following flow stages are supported by the LDAP provider:

- [Identification stage](../../flows-stages/stages/identification/index.mdx)
- [Password stage](../../flows-stages/stages/password/index.mdx)
- [Authenticator validation stage](../../flows-stages/stages/authenticator_validate/index.mdx)
- [User Logout stage](../../flows-stages/stages/user_logout/index.mdx)
- [User Login stage](../../flows-stages/stages/user_login/index.mdx)
- [Deny stage](../../flows-stages/stages/deny/index.mdx)

### Bind with an app password

An [app password](../../../users-sources/user/user-interface.mdx#tokens-and-app-passwords) can replace the user's regular password in an LDAP bind. To enable this:

1. In the Admin interface, open the LDAP provider under **Applications** > **Providers** and identify its **Bind Flow**.
2. Open that flow under **Flows and Stages** > **Flows** and locate its [password stage](../../flows-stages/stages/password/index.mdx). If the identification stage has a **Password stage** configured, use that stage.
3. Edit the password stage under **Flows and Stages** > **Stages** and select **User database + app passwords** in **Backends**.
4. Configure the LDAP client with the user's bind DN, such as `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`, adjusted for your username and **Base DN**. Use the generated app password as the bind password.

The app password must belong to the user in the bind DN and must not have expired. An API token cannot be used as an app password.

An app password satisfies the password stage only. Other stages and policies in the **Bind Flow**, including MFA requirements, still apply unless explicitly skipped by a policy. If the flow requires MFA, configure a supported method as described in [Code-based MFA support](#code-based-mfa-support). The user must also have [access to the LDAP application](#searching).

### Bind modes

The LDAP provider supports two different bind modes:

#### Direct bind

In this mode, the outpost will always execute the configured flow when a new bind request is received.

#### Cached bind

This mode uses the same logic as direct bind, however the result is cached for the entered credentials, and saved in memory for the standard session duration. Sessions are saved independently, meaning that revoking sessions does *not* remove them from the outpost, and neither will changing a users credentials.

## Searching

A user must have access to the LDAP application before they can bind and search the directory. If the application uses [bindings](../../applications/manage_apps.mdx#use-bindings-to-control-access), they must allow the user access according to the application's **Policy engine mode**.

By default, users can search only for their own user details and the groups they belong to. Group results include only the searching user as a member.

To search the full directory, add the [user](../../../users-sources/user/index.mdx) to a [role](../../../users-sources/roles/index.mdx) and assign the role the **Search full LDAP directory** permission. This permission allows the user to retrieve all users and groups that the LDAP provider exposes.

You can assign the permission in one of two ways:

- **Object permission** *(recommended)*: Open the LDAP provider's **Permissions** tab, click **Assign Role Object Permission**, select the role, enable **Search full LDAP directory**, and click **Assign Role Object Permission**. This permission applies only to that LDAP provider.
- **Global permission**: Open the role's **Permissions** tab and assign **Search full LDAP directory** under **Assigned global permissions**. This permission applies to every LDAP provider, but the user still needs access to each provider's application. For detailed instructions, see [Manage permissions](../../../users-sources/access-control/manage_permissions.mdx#assign-or-remove-permissions-for-a-specific-role).

### Search modes

The LDAP provider supports two different search modes:

#### Direct search

In this mode, every LDAP search request will trigger one or more requests to the authentik core API. This will always return the latest data, however this has a performance hit due to all the layers the backend requests have to go through.

#### Cached search

In this mode, the outpost periodically fetches all users and groups from the backend, holds them in memory, and responds to search queries directly. This improves performance, but can return stale data.

## Code-based MFA support

Authenticator validation currently only supports DUO, TOTP and static authenticators. SMS-based authenticators are not supported as they require a code to be sent from authentik, which is not possible during the bind.

The LDAP provider supports code-based MFA.

Code-based authenticators are only supported when the **Code-based MFA Support** setting is enabled on the provider and the configured **Bind Flow** includes a [Authenticator Validation stage](../../flows-stages/stages/authenticator_validate/index.mdx).

When enabled, all users that bind to the LDAP provider should have a supported authenticator configured, as otherwise a password might be incorrectly rejected if it contains a semicolon.

For code-based authenticators, the code must be given as part of the bind/authentication password, separated by a semicolon.

For example, for the password `example-password` and the MFA code `123456`, the input must be `example-password;123456`.

---

## Create an OAuth2 provider

To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. (Alternatively, you can first create only the provider and then later pair it with an application, by navigating to **Applications** > **Providers** and clicking **New Provider**.)

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications > Applications** and click **New Application** to create an application and provider pair.
3. On the **New application** page, define the application settings, and then click **Next**.
4. Select **OAuth2/OIDC** as the **Provider Type**, and then click **Next**.
5. On the **Configure Provider** page, provide the required configuration settings.
6. Click **Create Application** to create both the application and the provider.

Optionally, configure the provider with the `offline_access` scope mapping. By default, applications only receive an access token. To receive a refresh token, applications and authentik must be configured to request the `offline_access` scope. Do this in the Scope mapping area on the **Configure OAuth2/OpenID Provider** page.

---

## Device code flow

The device code flow is also known as *device flow* or *device authorization grant flow*. This type of authentication flow is useful for devices with limited input capabilities and/or devices without browsers. The Request for Comments (RFC) 8628) abstract for this flow states:

> The OAuth 2.0 device authorization grant is designed for Internet-connected devices that either lack a browser to perform a user-agent-based authorization or are input constrained to the extent that requiring the user to input text in order to authenticate during the authorization flow is impractical. It enables OAuth clients on such devices (like smart TVs, media consoles, digital picture frames, and printers) to obtain user authorization to access protected resources by using a user agent on a separate device.

### Requirements

This device flow is only possible if the active [brand](../../../customize/branding/index.mdx) has a device code flow configured. This flow is run *after* the user logs in, and before the user authenticates.

authentik does not include a default flow for this use case, so it is necessary to create a new one with a **Designation** of `Stage Configuration`.

### Device flow initiation

The flow is initiated by sending a POST request to the device authorization endpoint, `/application/o/device/`, with the following contents:

```http
POST /application/o/device/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

client_id=application_client_id&
scope=openid email my-other-scope
```

Alternatively the client id may be sent via the HTTP Authorization header:

```http
POST /application/o/device/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded
Authorization: Bearer YXBwbGljYXRpb25fY2xpZW50X2lkOg==

scope=openid email my-other-scope
```

The response contains the following fields:

- `device_code`: Device code, which is the code kept on the device
- `verification_uri`: The URL to be shown to the enduser to input the code
- `verification_uri_complete`: The same URL as above except the code will be prefilled
- `user_code`: The raw code for the enduser to input
- `expires_in`: The total seconds after which this token will expire
- `interval`: The interval in seconds for how often the device should check the token status

With this response, the device can start checking the status of the token by sending requests to the token endpoint like this:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:device_code&
client_id=application_client_id&
device_code=device_code_from_above
```

If the user has not opened the link above yet, or has not finished the authentication and authorization yet, the response will contain an `error` element set to `authorization_pending`. The device should re-send the request in the interval set above.

If the user *has* finished the authentication and authorization, the response will be similar to any other generic OAuth2 Token request, containing `access_token` and `id_token`.

### Create and apply a device code flow

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows** and click **New Flow**.
3. Set the following required configurations:
   - **Name**: provide a name (e.g. `default-device-code-flow`)
   - **Title**: provide a title (e.g. `Device code flow`)
   - **Slug**: provide a slug (e.g `default-device-code-flow`)
   - **Designation**: `Stage Configuration`
   - **Authentication**: `Require authentication`
4. Click **Create**.
5. Navigate to **System** > **Brands** and click the **Edit** icon on the default brand.
6. Set **Default code flow** to the newly created device code flow and click **Update**.

---

## Dynamic Client Registration (DCR)

## About Dynamic Client Registration

DCR allows an authorized client to dynamically register an OAuth2 or OpenID Connect (OIDC) application with authentik, instead of requiring an administrator to manually create the application and provider.

The client authenticates to the registration endpoint using a Bearer access token that includes the required DCR scope. If the request is authorized, authentik creates an application and OAuth2/OIDC provider and returns the generated client metadata and credentials.

authentik implements dynamic client registration as defined by:

- [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html)
- [RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591)

## Requirements and limitations

- The user associated with the access token must be authorized by the policies and bindings on the application that the parent provider belongs to.
- DCR creates a new application and provider for every successful registration.
- Configuration is not inherited dynamically from the parent provider. Settings from the parent provider are copied to a dynamically created provider when it is created. Subsequent changes to the parent provider do not automatically update providers that were already created through DCR.
- authentik's DCR implementation does not provide RFC 7592 client-management endpoints for dynamically updating or deleting a client with a registration access token.
- Dynamically registered application and provider pairs remain stored until an administrator deletes them or an external automation process deletes them using authentik's APIs.

## Configure DCR

### Enable DCR

To enable DCR on an OAuth2/OIDC provider:

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Applications** > **Providers** and click the name of the provider that you want to modify.
3. Open the **Dynamic Client Registration** tab, click **Enable Dynamic Client Registration**, and set the following fields:
   - **Default application group** *(optional)*: Assign newly created dynamic applications to an application group, to group them in the application dashboard.
   - **Override authorization flow** *(optional)*: Specify an authorization flow instead for dynamic applications rather than inheriting the parent provider's.
   - **Override invalidation flow** *(optional)*: Specify an invalidation flow instead for dynamic applications rather than copying the parent provider's.
   - **Override property mappings**: Specify a set of scope mappings for the dynamically generated provider rather than copying the parent provider's.
   - Under **Advanced settings**:
     - **Access token validity**: Set the maximum validity period for access tokens.
     - **Refresh token validity**: Set the maximum validity period for refresh tokens.
     - **Allowed grant types**: Restrict which OAuth2 grant types a client is allowed to request. If left empty, all grant types are allowed.
     - **Policy engine mode**: Set whether `ANY` or `ALL` policies must match to grant access.
4. Click **Create Dynamic Client Registration**.

### Configure DCR policy bindings

Policy bindings configured for DCR determine which bindings are copied to each dynamically created application.

- When the DCR configuration has its own bindings, authentik copies those bindings to each dynamically created application.
- When the DCR configuration has no bindings, authentik copies the parent application's bindings instead.

Changes made to the parent application's or DCR configuration's bindings after registration are not propagated to existing dynamically created applications. The applicable bindings are copied only when each application is created.

To set bindings on the DCR configuration:

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Applications** > **Providers** and click the name of the provider that you want to modify.
3. Open the **Dynamic Client Registration** tab and click **Create or bind...**.
4. Select an existing user, group, or policy, or create a new policy, and bind it to the DCR configuration.
5. Repeat the process for any further bindings.

The **Policy engine mode** can be changed by clicking the **Edit** button on the **Dynamic Client Registration** tab.

## Authorization and policy evaluation

authentik authorizes each registration request before creating an application and provider.

When a client sends a request to the registration endpoint:

1. authentik validates the Bearer access token.
2. authentik identifies the user associated with the token.
3. authentik evaluates the policies and bindings configured for the parent application and DCR configuration.
4. If registration is allowed, authentik creates the child application and provider.
5. authentik copies the applicable bindings to the newly created application.

If the user is not authorized to register a client, authentik returns `403 Forbidden` with the error code `access_denied`.

A successful registration is therefore not an anonymous or open registration unless the configured policies explicitly allow that behavior.

## Requests

### Registration endpoint

When DCR is enabled for a provider, authentik publishes the registration endpoint on the provider's OIDC discovery endpoint under the `registration_endpoint` property:

```text
https://authentik.company/application/o/<application_slug>/register/
```

### Request format

A registration request is an authenticated HTTP `POST` request with a JSON request body.

The request supports the following client metadata:

| Property                     | Description                                                                                                 |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
| `client_name`                | Human-readable name for the dynamically created application                                                 |
| `redirect_uris`              | Array of redirect URIs allowed for authorization responses                                                  |
| `grant_types`                | OAuth2 grant types the client intends to use. If omitted, `authorization_code` is used                      |
| `response_types`             | OIDC response types the client intends to use, when applicable                                              |
| `token_endpoint_auth_method` | Method used by the client to authenticate at the token endpoint. If omitted, `client_secret_basic` is used. |

authentik applies defaults and validates the requested metadata against the DCR configuration and the capabilities of the parent provider.

### Supported grant types

Dynamically registered clients can request the following grant types:

- `authorization_code`
- `implicit`
- `hybrid`
- `refresh_token`
- `client_credentials`
- `password`
- `urn:ietf:params:oauth:grant-type:device_code`
- `urn:ietf:params:oauth:grant-type:token-exchange`

### Client authentication methods

The `token_endpoint_auth_method` value determines the client type:

| Value                 | Client type  | Client secret            |
| --------------------- | ------------ | ------------------------ |
| `client_secret_basic` | Confidential | Returned in the response |
| `client_secret_post`  | Confidential | Returned in the response |
| `none`                | Public       | Not returned             |

If the request contains an unsupported authentication-method value, authentik uses `client_secret_basic`.

### Registration request example

The following example registers a confidential authorization-code client:

```http
POST /application/o/my-application/register/ HTTP/1.1
Host: authentik.company.com
Content-Type: application/json
Authorization: Bearer <access-token-with-goauthentik.io/oidc/dcr-scope>

{
  "client_name": "My Dynamic App",
  "redirect_uris": [
    "https://app.example.com/callback"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "response_types": [
    "code"
  ],
  "token_endpoint_auth_method": "client_secret_basic"
}
```

The access token must be sent as a Bearer token. Do not place the access token in the JSON request body or in the URL.

### Successful response example

A successful registration returns HTTP `201 Created`:

```http
HTTP/1.1 201 Created
Content-Type: application/json
```

For a confidential client, the response includes the generated client secret:

```json
{
    "client_id": "gkjs82kdbva72910ns",
    "client_id_issued_at": 1722340800,
    "client_secret": "dynamic-super-secret-string",
    "client_secret_expires_at": 0,
    "client_name": "My Dynamic App",
    "redirect_uris": ["https://app.example.com/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "scope": "openid profile email offline_access",
    "token_endpoint_auth_method": "client_secret_basic"
}
```

For a public client registered with `"token_endpoint_auth_method": "none"`, the response does not include `client_secret` or `client_secret_expires_at`.

### Error response

Error responses include a JSON object with an `error` field and, where available, an `error_description` field.

Error responses include:

| HTTP status | Error                     | Meaning                                                                                    |
| ----------- | ------------------------- | ------------------------------------------------------------------------------------------ |
| `400`       | `invalid_client_metadata` | The request body is invalid, is not a JSON object, or contains invalid client metadata.    |
| `400`       | `invalid_redirect_uri`    | `redirect_uris` is missing, empty, not an array, or contains a non-string value.           |
| `401`       | `invalid_token`           | The Bearer token is missing, invalid, expired, or does not include the required DCR scope. |
| `403`       | `access_denied`           | The authenticated user is not authorized by the DCR configuration's policies and bindings. |
| `404`       | `not_found`               | DCR is not enabled for the provider associated with the requested application.             |

## Lifecycle and cleanup

DCR controls how a client is created; it does not provide automatic client expiration or cleanup.

The following values are separate from client-registration lifetime:

- **Access token validity** controls how long access tokens issued by the generated provider remain valid.
- **Refresh token validity** controls how long refresh tokens issued by the generated provider remain valid.
- Neither setting automatically deletes the generated application or provider.

Dynamically registered clients are stored as regular authentik provider and application objects. To remove them, an administrator must delete them manually, or an automated cleanup process must be configured through authentik's APIs.

Plan a cleanup process if clients are expected to be short-lived or if registrations may be created frequently.

## Auditing

Registrations can be monitored through the authentik event logs. Notification rules can be configured to notify administrators when applications are registered.

An example of an event log showing an application registration:

## Security recommendations

DCR can create applications without an administrator manually reviewing each request. Before enabling it in production:

- Restrict the DCR configuration with explicit policy bindings.
- Avoid allowing unrestricted registration for general users.
- Use a dedicated parent application and provider for DCR.
- Limit the allowed grant types to those required by the client population.
- Use exact redirect URIs wherever possible.
- Protect DCR access tokens like administrative credentials.
- Monitor registration volume and remove unused registrations.
- Optionally set a policy on applications that checks whether a given request is a DCR request and apply stricter limits.

---

## Front-channel and back-channel logout

## About front-channel and back-channel logout

OAuth2/OIDC logout is a security feature defined in the OpenID Connect specification. It allows an OIDC Provider (OP), such as authentik, to notify Relying Parties (RPs) when a user session ends. This ensures that all associated applications can properly terminate the user's session.

For more information about single logout across all providers, see the [Single Logout (SLO) Overview](../single-logout/index.mdx).

Your OAuth application (Relying Party) must explicitly support OpenID Connect front-channel logout or back-channel logout to properly handle logout requests. Not all OAuth applications support these features, so compatibility should be verified.

## Requirements

Your OAuth application (Relying Party) must:

- **HTTPS**: Use HTTPS in production.
- **Accessible**: Be reachable from authentik.
- **Logout endpoint**: Have a defined endpoint to handle OP logout requests (front-channel, back-channel, or both).

## Configuration

### Set up single logout

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Edit or create an OAuth2 provider.
4. In the **Logout URI** field, enter the logout endpoint provided by your RP, if supported.
5. Select the **Logout Method** to choose **Front-channel** or **Back-channel** based on RP support.
6. Click **Finish** to save your changes.

Back-channel logout is the only way to ensure that users are logged out of the provider when their session is administratively terminated (e.g., when a user is deactivated or their session is deleted).

### Logout URI format

The **Logout URI** should be a single URL provided by your Relying Party application, for example:

#### Back-channel

```
https://app.example.com/oauth/backchannel-logout
https://api.service.com/logout/backchannel
https://client.example.org/backchannel-logout
```

#### Front-channel

```
https://app.example.com/oauth/logout
https://api.service.com/logout
```

## RP-initiated Single Logout

OIDC Relying Parties can initiate logout by redirecting a user to authentik's `end_session` endpoint. By default, only that application's session is ended while the authentik session remains active and the user stays logged in to other applications.

For instructions on how to trigger full Single Logout when a user logs out from an application, see [Choose the logout behavior for a provider](../single-logout/index.mdx#choose-the-logout-behavior-for-a-provider).

## How OpenID Connect single logout works

### Back-channel logout

With back-channel logout, authentik sends logout requests directly from the server to the RP’s logout endpoint via HTTP POST. The logout request includes a signed JWT logout token that contains the following JWT claims:

- `iss` (issuer): The authentik issuer URL
- `sub` (subject): The user's unique identifier
- `aud` (audience): The client ID
- `iat` (issued at): Token creation timestamp
- `jti` (JWT ID): Unique token identifier
- `events`: Logout event claim
- `sid` (session ID): The session identifier (if available)

Example back-channel logout request:

```http
POST /backchannel-logout HTTP/1.1
Host: client.example.org
Content-Type: application/x-www-form-urlencoded

logout_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
```

Back-channel logout is triggered when:

- A user logs out through a logout flow
- An administrator deletes a user's session
- A user account is deactivated
- A session expires or is revoked

### Front-channel logout

With front-channel logout, authentik injects an iframe logout stage into the logout flow. This stage loads the RP's (relying party) front-channel logout URL in a hidden iframe within the user's browser. The logout URL includes session information as query parameters, such as:

- `iss`: The authentik issuer URL
- `sid`: The session identifier

Example front-channel logout iframe:

```html
<iframe
    src="https://app.example.com/oauth/logout?iss=https://authentik.company&sid=session_id"
></iframe>
```

The RP processes the logout request and terminates the user's session. After all iframes complete their requests, the user continues through the authentik logout flow.

Front-channel logout only works for user-initiated logouts through a logout flow. It cannot be used for administrative session termination since it requires an active browser session.

## Resources

- [Single Logout (SLO) Overview](../single-logout/index.mdx)
- [User Logout Stage](../../flows-stages/stages/user_logout/index.mdx)
- [OAuth2 Provider Configuration](./index.mdx)
- [OpenID Connect Back-Channel Logout 1.0 Specification](https://openid.net/specs/openid-connect-backchannel-1_0.html)
- [OpenID Connect Front-Channel Logout 1.0 Specification](https://openid.net/specs/openid-connect-frontchannel-1_0.html)

---

## GitHub compatibility

The OAuth2 provider also exposes a GitHub-compatible endpoint. This endpoint can be used by applications, which support authenticating against GitHub Enterprise, but not generic OpenID Connect.

To use any of the GitHub Compatibility scopes, you have to use the GitHub Compatibility Endpoints.

| Endpoint        | URL                         |
| --------------- | --------------------------- |
| Authorization   | `/login/oauth/authorize`    |
| Token           | `/login/oauth/access_token` |
| User Info       | `/user`                     |
| User Teams Info | `/user/teams`               |

To access the user's email address, a scope of `user:email` is required. To access their groups, `read:org` is required. Because these scopes are handled by a different endpoint, they are not customizable as a Scope Mapping.

## Special scopes for GitHub compatibility

- `user`: No-op, is accepted for compatibility but does not give access to any resources
- `read:user`: Same as above
- `user:email`: Allows read-only access to `/user`, including email address
- `read:org`: Allows read-only access to `/user/teams`, listing all the user's groups as teams.

---

## OAuth 2.0 provider

In authentik, you can [create](./create-oauth2-provider.mdx) an [OAuth 2.0](https://oauth.net/2/) provider to authenticate users to an associated application. The provider supports both OAuth 2.0 and OpenID Connect (OIDC).

## authentik and OAuth 2.0

Before taking a [closer look at OAuth 2.0 and OIDC](#about-oauth-20-and-oidc), it is important to understand how authentik works with these protocols.

authentik can act as either an OpenID Provider (OP) or a Relying Party (RP):

- To use authentik as an OP, create an OAuth 2.0 provider and associate it with an application.
- To use authentik as an RP, configure an OAuth or OIDC [source](../../../users-sources/sources/index.mdx).

authentik can act as both an OP and an RP in the same deployment.

authentik supports common OAuth 2.0 and OIDC flows and grant types, including authorization code, client credentials, implicit, hybrid, device code, refresh token, and token exchange. authentik follows the [OpenID Connect specification](https://openid.net/specs/openid-connect-core-1_0.html) and supports PKCE, [GitHub compatibility](./github-compatibility.mdx), and scope mappings.

The authentik OAuth 2.0 provider supports standard OAuth 2.0 security features, including secure credential storage, configurable signing and encryption, configurable token expiration times, and automatic refresh token rotation.

## About OAuth 2.0 and OIDC

OAuth 2.0 is an authorization framework that allows an application to obtain limited access to protected resources. OpenID Connect is an authentication protocol built on OAuth 2.0 that allows an application to verify a user's identity and obtain information about that user.

In a typical authorization code flow:

1. The RP prepares an authorization request that identifies the client and specifies the access it requires. The RP then redirects the user's browser to the OP.
2. The OP authenticates the user and, when required, requests the user's consent.
3. The OP redirects the user's browser back to the RP with an authorization code.
4. The RP sends the authorization code to the OP's token endpoint and authenticates using its client credentials or another supported client authentication method.
5. The OP returns an access token and, when requested and permitted, a refresh token.

The following diagram shows a typical authorization code flow:

```mermaid
sequenceDiagram
    participant user as User
    participant rp as RP (Relying Party)
    participant op as OP (OpenID Provider)

    user->>rp: User accesses application
    rp->>user: RP prepares authorization request and redirects user to OP
    user->>op: User authentication and authorization occurs
    op->>rp: Redirect back to the RP with an authorization code

    rect
        rp->>op: Exchange authorization code
        op->>rp: RP receives access token and optional refresh token
    end

    rp->>user: User is logged in
```

## OAuth 2.0 endpoints and bindings

| Endpoint             | URL                                                                  |
| -------------------- | -------------------------------------------------------------------- |
| Authorization        | `/application/o/authorize/`                                          |
| Token                | `/application/o/token/`                                              |
| User Info            | `/application/o/userinfo/`                                           |
| Token Revocation     | `/application/o/revoke/`                                             |
| Token Introspection  | `/application/o/introspect/`                                         |
| Device Authorization | `/application/o/device/`                                             |
| End Session          | `/application/o/<application_slug>/end-session/`                     |
| JWKS                 | `/application/o/<application_slug>/jwks/`                            |
| OpenID Configuration | `/application/o/<application_slug>/.well-known/openid-configuration` |

Because of how the OAuth 2.0 provider endpoints are structured, you cannot create applications with the slugs `authorize`, `token`, `device`, `userinfo`, `introspect`, or `revoke`. These slugs conflict with the global OAuth 2.0 endpoints.

### Reverse proxy and firewall access

OAuth 2.0 and OIDC clients access some endpoints directly from the application server instead of through a user's browser. Ensure that reverse proxies, content delivery networks (CDNs), web application firewalls, and bot protection services permit these server-to-server requests. Interactive challenges on endpoints such as the OpenID configuration and JWKS endpoints can prevent clients from validating tokens and can cause repeated authentication redirects.

If an endpoint returns `403 Forbidden`, inspect the proxy or firewall logs. For example, Cloudflare [Browser Integrity Check](https://developers.cloudflare.com/waf/tools/browser-integrity-check/) can reject clients that use non-standard user agents. Configure a narrowly scoped Cloudflare configuration rule or custom skip rule for the affected endpoint. Do not disable security controls for the entire authentik deployment.

The JWKS endpoint is intentionally publicly accessible and contains public keys that clients use to verify tokens. It does not expose the private signing key.

### Cross-provider token introspection and revocation

The token introspection and revocation endpoints are global OAuth 2.0 endpoints, but access to tokens remains scoped by provider. A confidential provider can introspect tokens that it issued. Both public and confidential providers can revoke their own tokens.

To allow confidential provider B to introspect or revoke tokens issued by provider A, open provider A and add provider B under **Federated OAuth2/OpenID Providers**. Authenticate introspection and revocation requests using provider B's client credentials. This permission is directional and does not grant provider A access to provider B's tokens.

### Redirect URIs

When using an OAuth 2.0 provider in authentik, the OP must validate the redirect URI supplied by the RP. An authentik administrator can configure a list of allowed redirect URIs in the provider's **Redirect URIs** field.

If you leave the **Redirect URIs** field empty when creating a provider and application, authentik saves the redirect URI used the first time a user opens the application.

For advanced use cases, an authentik administrator can use regular expressions instead of exact redirect URIs. For example, instead of listing several similar application URLs individually, you can create a regular expression that matches all of them.

When using regular expressions, remember that a period (`.`) matches any single character. To match a literal period in a URL, escape it as `\.`.

### OAuth 2.0 and OpenID Connect logout

Back-channel logout is a server-to-server notification mechanism that allows an identity provider to notify connected OAuth 2.0 or OpenID Connect clients when a user's session ends.

For more information, see [OAuth2/OpenID Connect front-channel and back-channel logout](./frontchannel_and_backchannel_logout.mdx).

## Issuer mode

The **Issuer mode** setting (under **Advanced protocol settings**) controls the value that authentik uses for the `iss` (issuer) claim in the tokens it signs, and for the `issuer` field in the provider's [OpenID Connect discovery document](#oauth-20-endpoints-and-bindings).

| Mode (UI label)                                                                   | `iss` value                                                   |
| --------------------------------------------------------------------------------- | ------------------------------------------------------------- |
| **Each provider has a different issuer, based on the application slug** (default) | `https://authentik.company/application/o/<application_slug>/` |
| **Same identifier is used for all providers**                                     | `https://authentik.company/`                                  |

By default, authentik uses per-provider mode: every provider has a unique issuer derived from its application slug. This is the recommended setting, and matches how the discovery and JWKS endpoints are structured, since both are served under the per-application `/application/o/<application_slug>/` path.

### Global issuer mode

Setting the issuer mode to **Same identifier is used for all providers** (referred to internally as **global** mode) makes every OAuth 2.0 provider configured with this mode share the same issuer: the root URL of the instance (`https://authentik.company/`).

Global issuer mode still serves the discovery document at `https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration`, not at the root issuer URL.

## OAuth 2.0 flows and grant types

authentik supports the following general OAuth 2.0 and OpenID Connect flows:

1. Web-based application authorization
2. Client credentials
3. Device code
4. Token exchange

The [refresh token](#refresh-token-grant) grant allows a client to obtain new access tokens without repeating the original authorization flow.

You can define which grant types are available for your OAuth2 provider when you [create and configure the provider](./create-oauth2-provider.mdx). By default, all types are selected.

### 1. Web-based application authorization

Web-based application authorization typically involves a user authenticating to an application. authentik supports the following flows and grant types for this use case:

- *Authorization code*
- *Implicit* (legacy)
- *Hybrid*

#### Authorization code

The authorization code flow is intended for applications that can exchange an authorization code securely at the token endpoint. The application redirects the user to the OP for authentication and receives an authorization code through the user's browser. The application's backend then exchanges that code for an access token and, when requested and permitted, a refresh token.

Confidential clients authenticate to the token endpoint using a client ID and client secret or another supported client authentication method. Public clients, which cannot securely store a client secret, should use the authorization code flow with PKCE.

The authorization code can be used only once and expires after a short period.

To receive a refresh token, the client must request the `offline_access` scope, and the provider must include the `offline_access` scope mapping.

Starting with authentik 2024.2, applications receive only an access token by default. To receive a refresh token, the application must request the `offline_access` scope, and the authentik provider must include the `offline_access` scope mapping.

#### Implicit

The OAuth 2.0 [Security Best Current Practice](https://datatracker.ietf.org/doc/html/rfc9700) recommends against using the implicit grant. Browser-based applications should use the authorization code flow with PKCE instead.

The implicit flow returns tokens directly from the authorization endpoint without exchanging an authorization code at the token endpoint. It was designed for browser-based applications that could not securely store client credentials.

Because tokens can be exposed through browser history, redirect URIs, and other browser mechanisms, the implicit flow is considered a legacy flow and should not be used for new applications.

#### Hybrid

The OpenID Connect hybrid flow combines elements of the authorization code and implicit flows. It can return an ID token directly from the authorization endpoint while providing an authorization code that the application exchanges for access and refresh tokens at the token endpoint.

This flow can be useful when an application needs to verify the user's identity immediately while securely obtaining additional tokens through a back-channel request.

### 2. Client credentials

The client credentials flow is typically used for machine-to-machine or server-to-server authentication, where no user is involved. For example, a web service might use client credentials to authenticate when calling an API.

For more information, see [Machine-to-machine authentication](./machine_to_machine.mdx).

### 3. Device code

The device code flow is intended for devices that have limited input capabilities or do not have a suitable browser. For example, a television application can display a code that the user enters on a website using a phone or computer. After the user authenticates, the television application receives authorization.

For more information, see [Device code flow](./device_code.mdx).

### 4. Token exchange

The token exchange grant allows a client to exchange an existing token for a new access token. authentik supports both impersonation and delegation as defined by [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693).

With delegation, also known as on-behalf-of (OBO) token exchange, the issued token identifies both the user and the authentik Actor acting on the user's behalf.

For configuration instructions and information about supported parameters, see [Token exchange](./token_exchange.mdx).

Delegation and on-behalf-of token exchange are available in authentik 2026.8 and later.

### Refresh token grant

The refresh token grant allows a client to obtain a new access token without requiring the user to authenticate again. Depending on the provider's configuration, authentik can also rotate the refresh token when it is used.

## Scope mappings

Scopes can be configured using scope mappings, which are a type of [property mapping](../property-mappings/index.mdx#scope-mappings-with-oauth2).

## Scope authorization

By default, every user who has access to an application can request any of the scopes configured on its provider. Starting with authentik 2022.4, you can perform additional scope checks using an expression policy bound to the application:

```python
# Additional fields are available in the context.
# Use `ak_logger.debug(request.context)` to inspect them.

if "my-admin-scope" in request.context["oauth_scopes"]:
    return ak_is_group_member(request.user, name="my-admin-group")
return True
```

## Default and special scopes

For authorization requests, when a client does not request any scopes, authentik treats the request as though all configured scopes were requested. Depending on the configured authorization flow, the user might still need to provide consent, and the consent page lists all requested scopes.

This behavior does not apply to special scopes because they are not configurable on the provider. It also does not apply to token exchange: if `scope` is omitted from a token exchange request, the issued token has no scopes.

### Default scopes

- `openid`: Indicates that an OAuth 2.0 interaction is an OpenID Connect request. This scope does not add data to the token.
- `profile`: Includes basic profile information, such as the user's username, name, and group membership.
- `email`: Includes the user's email address.
- `entitlements`: Includes application entitlement data.
- `offline_access`: Indicates that the application is requesting a refresh token.
- `bound_key`: Requests an ID token bound to a client-held key using OpenID Connect Key Binding and Demonstrating Proof of Possession (DPoP). See [OpenID Connect key binding](./key-binding.mdx) for configuration, proof requirements, and a client example.

The `bound_key` scope applies OpenID Connect Key Binding to the ID token. It does not bind the access token to the client's key.

### authentik scopes

- `goauthentik.io/api`: Grants access to the authentik API on behalf of the user.
- `goauthentik.io/oidc/dcr`: Allows the client to register new OAuth 2.0 clients using [Dynamic Client Registration](./dynamic-client-registration.mdx).

### GitHub compatibility scopes

- `user`: Accepted for compatibility but does not grant access to any resources.
- `read:user`: Accepted for compatibility but does not grant access to any resources.
- `user:email`: Grants read-only access to `/user`, including the user's email address.
- `read:org`: Grants read-only access to `/user/teams`, which lists the user's groups as teams.

### Email scope verification

Some applications require the `email_verified` claim to be `True`. Before authentik 2025.10, the `email` scope always returned `True` for this claim, even though authentik has no single authoritative source for email verification. This could assert that an unverified address was verified. Starting with authentik 2025.10, the claim defaults to `False`.

To configure the claim using an existing verification process or an authentik flow, see [Verify email addresses](./verify-email-address.mdx).

## Signing and encryption

[JWTs](https://jwt.io/introduction) created by authentik are always signed.

When a **Signing Key** is selected in the provider, authentik signs JWTs asymmetrically using the private key of the selected certificate-key pair. Clients can verify the signature using the corresponding public key. The signing key's public key is available through the JWKS endpoint listed on the provider page.

When no **Signing Key** is selected, authentik uses `HS256` and the provider’s **Client secret** to sign JWTs. This does not publish a public signing key through JWKS; select a certificate key pair to use asymmetric signing, such as `RS256`.

### Encryption

authentik can also encrypt the JWTs it issues, producing JSON Web Encryption (JWE) tokens. To enable encryption, select an **Encryption Key** in the provider.

authentik uses the `RSA-OAEP-256` key encryption algorithm with the `A256CBC-HS512` content encryption method.

---

## OpenID Connect key binding

authentik supports [OpenID Connect Key Binding](https://openid.github.io/connect-key-binding/main.html) for clients that need ID tokens tied to a client-held asymmetric key. The client requests the `bound_key` scope and proves possession of its private key with a signed Demonstrating Proof of Possession (DPoP) JWT at the token endpoint.

The resulting ID token has the JOSE header `typ: dpop+id_token` and a `cnf.jwk` claim containing the client's public key. authentik still signs the ID token with the provider's signing key. The client key and the provider signing key have different purposes.

This implementation binds ID tokens. Access tokens have no key-binding `cnf` claim, and the token response still uses `token_type: Bearer`. Call APIs and UserInfo with `Authorization: Bearer <access_token>`. Requesting `bound_key` does not make these access tokens resistant to theft or require APIs to validate DPoP proofs.

A service accepting a bound ID token must validate the ID token and require proof of possession of the key in `cnf.jwk` according to its application protocol. Reading the claim alone does not prove that the presenter holds the private key.

## Supported flows

- Authorization code: Send `bound_key` and `dpop_jkt` in the authorization request, then a DPoP proof when exchanging the code. PKCE can be used alongside key binding.
- Device code: Send `bound_key` and `dpop_jkt` in the device authorization request, then a new DPoP proof for every token polling request.
- Refresh token: Refresh tokens issued through either path retain the original key binding. Every refresh requires a new proof signed by that key.

Use `response_type=code` for browser authorization. Tokens returned directly by implicit or hybrid authorization responses are not key-bound. The authorization-code portion of a hybrid flow can be exchanged with a proof, but this does not bind tokens already returned through the browser. Client credentials and the [RFC 8693 token exchange grant](./token_exchange.mdx) do not establish this ID-token binding.

## Configure the provider and client

1. [Create an OAuth2 provider](./create-oauth2-provider.mdx) and associate it with an application.
2. In the provider's **Advanced protocol settings**, select the `openid` and `bound_key` scope mappings. The built-in binding mapping is named **authentik default OAuth Mapping: OpenID 'bound\_key'**. Select `offline_access` as well if the client needs refresh tokens.
3. Enable the required grant types on the provider: authorization code or device code, plus refresh token if needed. For device code, also [configure a device code flow on the brand](./device_code.mdx#create-and-apply-a-device-code-flow).
4. Configure the client's redirect URI and authentication method as usual. Confidential clients still authenticate to the token endpoint. DPoP does not replace a client secret or PKCE.

Read discovery at `https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration`. The path uses the application's slug, not the provider name or client ID. Check that `scopes_supported` includes `bound_key` and that `dpop_signing_alg_values_supported` includes the client's algorithm. Advertising DPoP algorithms does not mean that access tokens are DPoP-bound.

Request scopes explicitly, for example `openid bound_key offline_access`. If the authorization request omits scopes, authentik defaults to all configured scopes, which can include `bound_key` and require `dpop_jkt`. Scopes without a mapping on the provider are removed before key-binding checks. Merely adding a `DPoP` header to an ordinary code exchange does not enable binding.

## Generate a key and its `dpop_jkt`

Generate an asymmetric key pair on the client. Keep the private key for the lifetime of the authorization and any resulting refresh token. Send only the public JWK in proofs.

Supported keys and signing algorithms are:

- EC P-256 with `ES256`, P-384 with `ES384`, or P-521 with `ES512`.
- RSA with a key size from 2048 through 8192 bits and `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, or `PS512`.

Symmetric keys, `HS256`, `none`, and OKP keys such as Ed25519 are not supported for these proofs.

Compute `dpop_jkt` as the [RFC 7638 SHA-256 JWK thumbprint](https://www.rfc-editor.org/rfc/rfc7638):

1. Take only the required public JWK members: `crv`, `kty`, `x`, and `y` for EC, or `e`, `kty`, and `n` for RSA.
2. Serialize them as JSON with lexicographically sorted member names and no whitespace.
3. Hash the UTF-8 bytes with SHA-256.
4. Base64url-encode the full digest without `=` padding.

The result is a 43-character string. Do not hash a PEM file or include optional JWK members such as `kid`, `alg`, or `use` in the thumbprint input.

## Request authorization

For authorization code, send the following parameters to `/application/o/authorize/` using a URL-encoding library:

```text
response_type=code
client_id=<client_id>
redirect_uri=<redirect_uri>
scope=openid bound_key offline_access
state=<random_state>
nonce=<random_nonce>
code_challenge=<pkce_s256_challenge>
code_challenge_method=S256
dpop_jkt=<jwk_thumbprint>
```

Keep the key, PKCE verifier, state, and nonce until the callback completes. Validate the callback's state before exchanging its code. The key thumbprint must be present in this initial request; sending it only at the token endpoint is too late.

For device code, POST form data to `/application/o/device/` with `client_id`, `scope=openid bound_key offline_access`, and `dpop_jkt`. Follow the returned verification URL and polling interval as described in the [device code guide](./device_code.mdx).

## Construct the DPoP proof

Sign a new JWT with the client's private key immediately before each token request. Put it in the HTTP `DPoP` header. Use this JOSE header structure:

```json
{
    "typ": "dpop+jwt",
    "alg": "ES256",
    "jwk": {
        "kty": "EC",
        "crv": "P-256",
        "x": "<public_x_coordinate>",
        "y": "<public_y_coordinate>"
    }
}
```

The `jwk` must contain the public key whose thumbprint matches the original `dpop_jkt`. A `kid` alone is insufficient. Do not include private fields such as `d`, `p`, or `q`.

| Payload claim | Required value                                                                             |
| ------------- | ------------------------------------------------------------------------------------------ |
| `htm`         | `POST`, matching the token request method.                                                 |
| `htu`         | The absolute token endpoint URL, such as `https://authentik.company/application/o/token/`. |
| `iat`         | The current Unix time as an integer in seconds, within 60 seconds of authentik's clock.    |
| `jti`         | A fresh, unpredictable string for every request, such as a random UUID.                    |
| `c_s256`      | Required for authorization-code and device-code exchanges. Omit for refresh.               |

For `htu`, authentik compares the scheme, host and port, and path, ignoring query strings and fragments. Preserve the trailing slash and use the externally visible token URL. If authentik is behind a reverse proxy, it must reconstruct the same scheme and host.

Compute the code hash as:

```text
c_s256 = BASE64URL_NO_PADDING(SHA256(UTF8(code)))
```

Use the decoded authorization `code` value or the `device_code` value, before form encoding. For device flow, do not hash the human-facing `user_code`. Use the full SHA-256 digest. This claim is different from the ID token's `c_hash`, the PKCE challenge, and the DPoP access-token hash `ath`.

Proofs do not require `ath` or a server-issued DPoP nonce in this implementation. The OIDC authorization `nonce` is separate. authentik caches used `jti` values for 180 seconds to reject replay. Generate a fresh proof even when retrying a failed request or polling after `authorization_pending`.

## Exchange codes and refresh tokens

POST URL-encoded form data to `/application/o/token/`, with the proof in `DPoP` and the client's usual authentication:

- Authorization code: Include `grant_type=authorization_code`, `code`, `redirect_uri`, and `code_verifier` if PKCE was used. The proof must hash the authorization code.
- Device code: Include `grant_type=urn:ietf:params:oauth:grant-type:device_code` and `device_code`. The proof must hash the device code for every poll.
- Refresh token: Include `grant_type=refresh_token` and `refresh_token`. The proof does not need `c_s256`.

Public clients include `client_id` in the form.

Confidential clients must also supply their configured client authentication, for example HTTP Basic authentication or `client_id` and `client_secret` in the form. The successful response contains an ID token with `typ: dpop+id_token` and `cnf.jwk`. Validate the provider's signature, issuer, audience, expiration, and initial authorization nonce before trusting it. Check that the thumbprint of `cnf.jwk` equals the key requested by the client.

To receive a refresh token, both configure and request `offline_access`. Omit `scope` from refresh requests to retain the original scopes. If specifying it, include `offline_access` and do not add scopes that were absent from the original grant.

Sign each refresh proof with the original private key. Removing `bound_key` from the refresh request's scope does not remove the binding. If authentik rotates the refresh token, store the replacement and retain the same key; otherwise keep the existing refresh token. A lost key requires a new authorization flow. A new key cannot be substituted during refresh.

## Run a client example

This Python example performs authorization code with PKCE, verifies the bound ID token, and refreshes it with the same key. It keeps tokens and the private key in memory and prints the verified public key. Run it on the machine with your browser.

Configure a test provider with:

- A **Public** client type.
- Authorization code and refresh token grant types.
- The `openid`, `bound_key`, and `offline_access` scope mappings.
- A strict redirect URI of `http://localhost:8765/callback`.
- An RSA **Signing Key**, producing `RS256` ID tokens, and no **Encryption Key**. The client's DPoP key in this example independently uses `ES256`.

Install the dependencies in a virtual environment:

```shell
python3 -m venv .venv
.venv/bin/python -m pip install 'PyJWT[crypto]==2.10.1' 'requests==2.32.5'
```

Save the following as `key_binding_client.py`:

```python title="key_binding_client.py"
import base64
import hashlib
import json
import os
import secrets
import time
from urllib.parse import parse_qs, urlencode, urlsplit

import jwt
import requests
from cryptography.hazmat.primitives.asymmetric import ec

def b64url(value):
    return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")

def sha256_b64url(value):
    return b64url(hashlib.sha256(value.encode("utf-8")).digest())

def thumbprint(public_jwk):
    members = {name: public_jwk[name] for name in ("crv", "kty", "x", "y")}
    return sha256_b64url(json.dumps(members, sort_keys=True, separators=(",", ":")))

def make_proof(key, public_jwk, token_url, code=None):
    claims = {
        "htm": "POST",
        "htu": token_url,
        "iat": int(time.time()),
        "jti": secrets.token_urlsafe(32),
    }
    if code is not None:
        claims["c_s256"] = sha256_b64url(code)
    return jwt.encode(
        claims, key, algorithm="ES256",
        headers={"typ": "dpop+jwt", "jwk": public_jwk},
    )

def main():
    discovery_url = os.environ["AK_DISCOVERY_URL"]
    client_id = os.environ["AK_CLIENT_ID"]
    redirect_uri = "http://localhost:8765/callback"
    response = requests.get(discovery_url, timeout=30)
    response.raise_for_status()
    metadata = response.json()
    if "bound_key" not in metadata["scopes_supported"]:
        raise ValueError("Configure the bound_key scope mapping on the provider")
    if "ES256" not in metadata["dpop_signing_alg_values_supported"]:
        raise ValueError("Provider does not advertise ES256 proofs")

    key = ec.generate_private_key(ec.SECP256R1())
    public_jwk = json.loads(jwt.algorithms.ECAlgorithm.to_jwk(key.public_key()))
    jkt = thumbprint(public_jwk)
    state, nonce, verifier = (secrets.token_urlsafe(32) for _ in range(3))
    parameters = {
        "response_type": "code", "client_id": client_id,
        "redirect_uri": redirect_uri, "scope": "openid bound_key offline_access",
        "state": state, "nonce": nonce, "dpop_jkt": jkt,
        "code_challenge": sha256_b64url(verifier), "code_challenge_method": "S256",
    }
    print("Open this URL in your browser:")
    print(metadata["authorization_endpoint"] + "?" + urlencode(parameters))
    callback = urlsplit(input("Paste the full callback URL from the address bar: ").strip())
    expected = urlsplit(redirect_uri)
    if (callback.scheme, callback.netloc, callback.path) != (
        expected.scheme, expected.netloc, expected.path
    ):
        raise ValueError("Unexpected callback URL")
    query = parse_qs(callback.query)
    if query.get("state") != [state]:
        raise ValueError("Callback state mismatch")
    if "error" in query:
        raise RuntimeError(query)
    code = query["code"][0]
    jwks = jwt.PyJWKClient(metadata["jwks_uri"])

    def exchange(form, code=None):
        response = requests.post(
            metadata["token_endpoint"],
            data={"client_id": client_id, **form},
            headers={"DPoP": make_proof(key, public_jwk, metadata["token_endpoint"], code)},
            timeout=30, allow_redirects=False,
        )
        if response.status_code != 200:
            raise RuntimeError(f"Token endpoint: {response.status_code} {response.text}")
        return response.json()

    def verify(tokens, expected_nonce=None):
        encoded = tokens["id_token"]
        signing_key = jwks.get_signing_key_from_jwt(encoded).key
        claims = jwt.decode(
            encoded, signing_key, algorithms=["RS256"],
            audience=client_id, issuer=metadata["issuer"],
            options={"require": ["iss", "sub", "aud", "exp", "iat", "cnf"]},
        )
        if jwt.get_unverified_header(encoded).get("typ") != "dpop+id_token":
            raise ValueError("ID token is not key-bound")
        if thumbprint(claims["cnf"]["jwk"]) != jkt:
            raise ValueError("ID token is bound to a different key")
        if expected_nonce is not None and claims.get("nonce") != expected_nonce:
            raise ValueError("ID token nonce mismatch")
        if tokens["token_type"].lower() != "bearer":
            raise ValueError("Unexpected access token type")
        print("Verified bound ID token; access token is Bearer.")
        print(json.dumps(claims["cnf"], indent=2))

    tokens = exchange({
        "grant_type": "authorization_code", "code": code,
        "redirect_uri": redirect_uri, "code_verifier": verifier,
    }, code=code)
    verify(tokens, expected_nonce=nonce)
    refresh_token = tokens["refresh_token"]
    refreshed = exchange({"grant_type": "refresh_token", "refresh_token": refresh_token})
    verify(refreshed)
    refresh_token = refreshed.get("refresh_token", refresh_token)
    print("Refresh succeeded with the same key.")

if __name__ == "__main__":
    main()
```

Run it with your discovery URL and client ID:

```shell
export AK_DISCOVERY_URL='https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration'
export AK_CLIENT_ID='<client_id>'
.venv/bin/python key_binding_client.py
```

After logging in and authorizing the request, the browser redirects to localhost. This example deliberately has no callback listener, so the browser displays a connection error. Copy the entire URL, including `code` and `state`, from the address bar into the script's prompt. Do not share that URL. Leave port 8765 unused while running the example.

The script should report a verified bound ID token twice and a successful refresh. A production client should receive the callback directly, protect stored private keys and refresh tokens, and retain the latest refresh token for subsequent use. It must explicitly support `dpop+id_token` and the required `c_s256` claim; generic DPoP support alone is insufficient.

## Troubleshoot common failures

### Authorization or device request fails

The authorization endpoint reports:

```text
invalid_request
```

Check that `bound_key` and `dpop_jkt` are both present, that the provider has the `bound_key` mapping selected, and that the thumbprint is 43 base64url characters without padding. A thumbprint supplied without the effective scope is also rejected.

The device authorization endpoint distinguishes these cases:

```text
dpop_jkt_required
dpop_jkt_not_allowed
invalid_dpop_jkt
```

Supply the missing thumbprint, enable and request `bound_key`, or correct the thumbprint encoding, respectively.

### Token exchange or refresh fails

Key-binding validation failures at the token endpoint return HTTP 400 with:

```json
{ "error": "invalid_request" }
```

Inspect authentik's logs for `DPoP validation failed` or `Missing DPoP proof for key-bound token`. Check the following:

| Cause                                 | Correction                                                                                                                  |
| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Missing proof or incorrect JWT header | Send `DPoP: <signed_jwt>` with `typ: dpop+jwt`, a supported `alg`, and a public `jwk`.                                      |
| Wrong key                             | Use the private key whose public thumbprint was sent at authorization, including after refresh rotation.                    |
| Missing or incorrect `c_s256`         | Hash the full authorization code or device code, not the PKCE verifier, user code, or refresh token.                        |
| Replayed `jti`                        | Generate a new proof for every attempt, including device polls and retries.                                                 |
| Clock skew                            | Synchronize clocks and generate `iat` in integer seconds immediately before the request.                                    |
| `htm` or `htu` mismatch               | Use `POST` and the absolute token URL with the correct scheme, host, port, and trailing slash. Check reverse proxy headers. |
| Unsupported or private key material   | Use a supported EC or RSA public JWK in the header and keep private fields on the client.                                   |

An `invalid_grant` response can instead indicate an expired or already-used authorization code, a wrong PKCE verifier, or an expired or revoked refresh token. Correct those before troubleshooting the proof. An `invalid_scope` on refresh can indicate that `offline_access` was omitted from an explicit scope list or that new scopes were added.

### Successful response has no binding

A DPoP header alone does not opt an existing unbound authorization or refresh token into key binding. Start a new authorization request with the configured `bound_key` scope and `dpop_jkt`. Inspect the ID token after signature verification. Looking for `cnf` in the access token will not work because it remains a bearer token.

---

## Machine-to-Machine (M2M) authentication

The OAuth 2.0 specification includes the client credentials grant, which allows machine-to-machine (M2M) authentication without user involvement. In authentik, machine clients do not authenticate using the typical `client_id` + `client_secret` combination. This is because OAuth providers can only have a single secret at any given time.

Instead, identification is based on a username, and authentication is based on app password tokens.

```mermaid
sequenceDiagram
    participant Client
    participant authentik
    participant Resource

    Client->>+authentik: POST /application/o/token/<br><client_credentials_request>
    authentik->>-Client: 200 OK<br/><access_token>
    Client->>+Resource: GET /resource<br/><Authorization: Bearer token>
    Resource->>-Client: 200 OK<br/>Resource data

```

## Static authentication

All user account types, including internal users, external users, and service accounts, can be used for authentication. These can be created manually beforehand or [automatically during authentication](#automatic-service-account-creation).

authentik treats a grant type of `password` the same as `client_credentials` to support applications that rely on a password grant. Scopes, if required, must be defined in the request and follow the same behavior as other OAuth requests.

To include custom claims from scope mappings in the issued JWT, select the scope mappings on the OAuth2 provider and request their scope names in the token request with the `scope` parameter, for example `scope=profile custom-scope`.

### Request with username and app password

**Example**:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=<client_id>&
username=<username>&
password=<app_password>&
scope=profile
```

This will return a JSON response with an `access_token`, which is a signed JWT token. This token can be sent along with requests to other hosts, which can then validate the JWT based on the signing key configured in authentik.

### Request with Base64-encoded username and app password

You can also encode the username and app password of the user to authenticate with, separated by a colon, into a base64 string and pass it as the `client_secret` value.

**Example**:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=<client_id>&
client_secret=<base64(username:token)>&
scope=profile
```

### Automatic service account creation

Alternatively, you can pass the configured `client_secret` value of an OAuth provider. In that case, authentik automatically generates a service account for which the JWT token will be issued.

**Example**:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=<client_id>&
client_secret=<client_secret>&
scope=profile
```

The automatically generated service account follows this naming scheme: `ak-<provider_name>-client_credentials`. Currently, the service account creation settings cannot be altered.

## JWT authentication

For both externally issued and authentik-issued JWTs, authentik creates a service account based on the provider name and the subject claim of the token it receives. You may end up with multiple service accounts depending on the tokens that are provided to authentik. These service accounts expire and are deleted based on the expiry claim, if one is set on the token.

### Externally issued JWTs

You can authenticate and obtain a token using an existing JWT. For readability, this page refers to the JWT issued by the external issuer or platform as the input JWT, and the resulting JWT from authentik as the output JWT.

To configure this, define a JWKS URL or raw JWKS data in OAuth Sources. If a JWKS URL is specified, authentik fetches the data and stores it in the source. Then select the source in the OAuth2 provider that will be authenticated against.

With this configuration, any JWT issued by the configured sources' certificates can be used to authenticate.

**Example**:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&
client_assertion=<inputJWT>&
client_id=<client_id>
```

Alternatively, you can set the `client_secret` parameter to `<inputJWT>`, for applications that can set the password from a file but not other parameters.

Input JWTs are checked to verify that they are signed by any of the selected **Federated OIDC Sources**, and that their `exp` attribute is not set to the current time or a past time.

#### Kubernetes service account tokens

[Projected Kubernetes service account tokens](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) work with this flow. The cluster or an auxiliary service must expose the service account issuer through OpenID Connect discovery or a JWKS endpoint. In practice, this means you can:

1. Create a generic **OAuth Source** in authentik.
2. Configure the source with either the issuer's `.well-known/openid-configuration` URL or the issuer's JWKS URL.
3. Add that source to the OAuth2 provider under **Federated OIDC Sources**.
4. Send the projected service account token as the `client_assertion` in the `client_credentials` request.

When the token validates, authentik creates or updates a generated service account and then issues a new access token from the selected OAuth2 provider. The generated account is derived from the provider name and the incoming JWT subject claim.

To propagate claims from the Kubernetes token into the token issued by authentik, create an **OAuth Source Property Mapping** to transfer the incoming JWT values to the generated service account, then use an **OAuth2 Scope Mapping** to include them as claims for the relying party.

Example OAuth source property mapping:

```python
return {
    "attributes": {
        "kubernetes_subject": info.get("sub"),
        "kubernetes_namespace": info.get("kubernetes.io", {}).get("namespace"),
    },
}
```

Example OAuth2 scope mapping:

```python
return {
    "kubernetes_namespace": request.user.attributes.get("kubernetes_namespace"),
}
```

To dynamically limit access based on the claims of the tokens, you can use [Expression policies](../../../customize/policies/types/expression/index.mdx), for example:

```python
return request.context["oauth_jwt"]["iss"] == "https://my.issuer"
```

Other information is also available in the policy expression context:

- `request.context["oauth_scopes"]` - list of scope names requested
- `request.context["oauth_grant_type"]` - the grant type
- `request.context["oauth_code_verifier"]` - a string or none

If you're authorizing with a JWT, then `request.context["oauth_jwt"]` is also available, which is the parsed JWT as a dictionary.

### authentik-issued JWTs

To allow federation between providers, modify the provider settings of the application whose token will be used for authentication to select the provider of the application to which you want to federate.

With this configuration, any JWT issued by the configured providers can be used to authenticate.

**Example**:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&
client_assertion=<inputJWT>&
client_id=<client_id>
```

Alternatively, you can set the `client_secret` parameter to `<inputJWT>`, for applications which can set the password from a file but not other parameters.

Input JWTs must be valid access tokens issued by any of the configured **Federated OAuth2/OpenID Providers**. They must not have been revoked and must not have expired.

To dynamically limit access based on the claims of the tokens, you can use [Expression policies](../../../customize/policies/types/expression/index.mdx).

**Example**:

```python
return request.context["oauth_jwt"]["iss"] == "https://my.issuer"
```

Other information is also available in the policy expression context:

- `request.context["oauth_scopes"]` - list of scope names requested
- `request.context["oauth_grant_type"]` - the grant type
- `request.context["oauth_code_verifier"]` - a string or none

If you're authorizing with a JWT, then `request.context["oauth_jwt"]` is also available, which is the parsed JWT as a dictionary.

## Troubleshooting

### More detailed error information

If you receive an error response from authentik, it only includes a generic error, an error description, and the `request_id`.

However, you can obtain more detailed error information from the [authentik server container logs](../../../troubleshooting/logs/logs.mdx) by searching for the `request_id` from the response.

### OAuth introspection and revocation endpoints

To use the OAuth introspection endpoint to obtain more information on a token, authenticate with a confidential provider. By default, a confidential provider can introspect tokens that it issued. Both public and confidential providers can revoke their own tokens.

For cross-provider introspection and revocation configuration, refer to [Cross-provider token introspection and revocation](./index.mdx#cross-provider-token-introspection-and-revocation).

### Event logging

All of these authentication methods create a login event in the event logs rather than an authorization event. The event logs contain different information depending on the scenario:

- [Static authentication using credentials](#static-authentication): Authentication method `token`, with a dictionary containing the token identifier.
- [Static authentication and automatically generating the service account](#automatic-service-account-creation): Authentication method `oauth_client_secret`.
- [JWT authentication](#jwt-authentication): Authentication method `JWT`, with the parsed JWT and a reference to the source or provider.

---

## Token exchange

Token exchange allows a client to exchange a token it already holds for a new token issued by an authentik provider. Token exchange is defined by [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693), whose abstract states:

> This specification defines a protocol for an HTTP- and JSON-based Security Token Service (STS) by defining how to request and obtain security tokens from OAuth 2.0 authorization servers, including security tokens employing impersonation and delegation.

A typical use case involves a service calling another service on behalf of a user. The calling service presents the user's access token as a *subject token* and receives a new token that the other service accepts.

authentik supports both token exchange modes defined by RFC 8693:

- **Impersonation**: When the request contains only a subject token, the issued token identifies the user represented by that token and does not record an acting party.
- **Delegation**, also known as on-behalf-of (OBO) token exchange 2026.8: When the request also contains an actor token, the issued token identifies the user as its subject and records the authentik Actor that represents the acting party.

## Requirements

The provider performing the exchange must:

- Have `Token exchange` selected under **Grant Types**.
- Be bound to an application.

The provider performing the exchange must be able to verify the subject token. Under **Machine-to-Machine authentication settings**, configure one of the following trust relationships:

- Add the provider that issued the subject token to **Federated OAuth2/OpenID Providers**.
- Add the source that issued the subject token to **Federated OIDC Sources**.

Normally, authentik rejects a subject token that cannot be verified through either trust relationship. When `audience` targets a different provider, authentik also accepts a subject token issued by the provider performing the exchange. The target provider must explicitly trust the provider performing the exchange, as described in [Audience](#audience).

These trust relationships are also used by the [machine-to-machine](./machine_to_machine.mdx) JWT flow.

Confidential clients must authenticate to the token endpoint. The subject token does not replace the client's credentials.

For delegation, the actor token must identify an authentik Actor. Ordinary users and non-Actor service accounts cannot be used as actors. OBO does not require a separate provider setting. Enabling the `Token exchange` grant also enables delegation.

authentik resolves actor tokens presented as OAuth access tokens or JWTs through **Federated OAuth2/OpenID Providers**. When `audience` targets a different provider, authentik also accepts an actor token issued by the provider performing the exchange. Unlike subject tokens, actor tokens cannot be resolved through **Federated OIDC Sources**.

## Exchange a token

Send a POST request to the token endpoint:

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange&
client_id=application_client_id&
client_secret=application_client_secret&
subject_token=token_issued_by_the_federated_provider&
subject_token_type=urn:ietf:params:oauth:token-type:access_token&
scope=openid email
```

The response contains the following fields:

- `access_token`: The issued access token
- `issued_token_type`: The type identifier of the issued token
- `token_type`: The token type, which is always `Bearer`
- `expires_in`: The number of seconds until the issued token expires
- `scope`: The scopes granted to the issued token

The resulting access token carries the identity of the user identified by the subject token. By default, authentik creates the token using the provider performing the exchange. If [`audience`](#audience) identifies a different provider, authentik uses the target provider's configuration instead.

## Exchange a token on behalf of a user (OBO)

To perform a delegation exchange, include `actor_token` and `actor_token_type` in addition to `subject_token` and `subject_token_type`.

The subject token, supplied using `subject_token`, identifies the user on whose behalf the request is made. The actor token, supplied using `actor_token`, identifies the authentik Actor performing the action.

```http
POST /application/o/token/ HTTP/1.1
Host: authentik.company
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange&
client_id=application_client_id&
client_secret=application_client_secret&
subject_token=token_identifying_the_user&
subject_token_type=urn:ietf:params:oauth:token-type:access_token&
actor_token=authentik_api_token_for_the_actor&
actor_token_type=goauthentik.io/oauth/token-type/authentik_token&
scope=openid email
```

`actor_token` and `actor_token_type` must be included together or omitted together. If both parameters are omitted, authentik performs an impersonation exchange.

The following requirements apply to an OBO exchange:

- The user identified by `subject_token` remains the subject of the issued token.
- The actor must be an authentik Actor. Ordinary users and non-Actor service accounts cannot be used as actors.
- If the Actor has a parent user, that parent must be the user identified by `subject_token`.
- An Actor without a parent can be used only when `actor_token` is an OAuth access token or JWT. An Actor without a parent cannot authenticate using an authentik API token.

The issued JWT contains the RFC 8693 `act` claim, which identifies the Actor:

```json
{
    "sub": "subject_identifier",
    "act": {
        "sub": "actor_identifier"
    }
}
```

The provider used to issue the token determines the identifiers for `sub` and `act.sub` according to its **Subject mode**. When `audience` selects another provider, the target provider's subject mode is used.

## Supported token types

### Subject and requested token types

`subject_token_type` and `requested_token_type` accept the following values:

- `urn:ietf:params:oauth:token-type:access_token`
- `urn:ietf:params:oauth:token-type:jwt`

Because authentik access tokens are JWTs, authentik treats both token-type values equivalently. `requested_token_type` is optional and defaults to `urn:ietf:params:oauth:token-type:access_token`.

For any other subject or requested token type, authentik rejects the request with `invalid_request`.

### Actor token types

`actor_token_type` accepts the following values:

- `urn:ietf:params:oauth:token-type:access_token`
- `urn:ietf:params:oauth:token-type:jwt`
- `goauthentik.io/oauth/token-type/authentik_token`

Because authentik OAuth access tokens are JWTs, authentik treats the first two token-type values equivalently.

Both values indicate that `actor_token` contains an authentik OAuth access token issued to an Actor. The token must correspond to an authentik access-token record and must have been issued by an eligible authentik provider. Normally, the issuing provider must be listed under **Federated OAuth2/OpenID Providers** in the configuration of the provider performing the exchange. When `audience` targets a different provider, the provider performing the exchange is also eligible. authentik does not use federated OIDC sources to resolve actor tokens.

`goauthentik.io/oauth/token-type/authentik_token` is an authentik-specific token type for a built-in authentik API token. The API token must belong to an Actor whose parent is the user identified by the subject token.

If either `actor_token` or `actor_token_type` is supplied without the other, authentik rejects the request with `invalid_request`. authentik also rejects unsupported actor token types with `invalid_request`.

If both parameters are present but the actor token is unknown, expired, or cannot be verified, authentik rejects the request with `invalid_grant`. authentik also returns `invalid_grant` if the token does not belong to an Actor or if the Actor has a parent other than the user identified by the subject token.

## Audience

By default, authentik creates the new token using the provider performing the exchange. Set `audience` to request a token using a different provider's configuration:

```http
audience=target_application_client_id
```

The value must be the target provider's `client_id` or the `pbm_uuid` of the application to which the target provider is bound. authentik accepts only one `audience` value and does not support tokens for multiple providers.

The resulting token uses the target provider's configuration. authentik signs the token using the target provider's signing key. The token uses the target provider's issuer as `iss` and its `client_id` as `aud`. The target provider's subject mode and scope mappings also apply. The target provider's endpoints, including its userinfo, introspection, and revocation endpoints, accept the token.

For an OBO exchange, the target provider's subject mode determines both the user identifier in `sub` and the Actor identifier in `act.sub`.

When `audience` identifies a provider other than the provider performing the exchange, both of the following conditions must be met; otherwise, authentik rejects the request with `invalid_target`:

- The target provider must list the provider performing the exchange under **Federated OAuth2/OpenID Providers**. This trust relationship explicitly permits the provider performing the exchange to mint tokens for the target provider.
- The target provider must be bound to an application.

The user identified by the subject token must also pass the target application's policy bindings; otherwise, authentik rejects the request with `invalid_grant`.

## Unsupported parameters

authentik rejects requests containing `resource` with `invalid_target` rather than ignoring the parameter. This prevents clients from incorrectly assuming that authentik applied the requested restriction. Use `audience` to identify the target provider instead.

## Scopes

The issued token includes only requested scopes with corresponding scope mappings assigned to the provider used to issue it. When `audience` identifies a target provider, authentik uses the target provider's scope mappings. Otherwise, it uses those of the provider performing the exchange.

If `scope` is omitted, the issued token has no scopes.

## Configure token exchange

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click the **Edit** icon for the provider that will perform the exchange.
3. Under **Grant Types**, select `Token exchange`.
4. Expand **Machine-to-Machine authentication settings**.
5. Configure the trust relationships required to verify subject tokens:
   - Add authentik providers that issue subject tokens to **Federated OAuth2/OpenID Providers**.
   - Alternatively, add external OIDC sources that issue subject tokens to **Federated OIDC Sources**.
6. To use an OAuth access token or JWT as `actor_token`, add the provider that issued the token to **Federated OAuth2/OpenID Providers**. When `audience` targets a different provider, an actor token issued by the provider performing the exchange is also accepted.
7. Click **Update**.
8. To target another provider using `audience`, edit the target provider and add the provider performing the exchange to the target provider's **Federated OAuth2/OpenID Providers**.
9. To perform an OBO exchange, obtain a token issued to the Actor that will act on the user's behalf. Supply the token using `actor_token` and set the corresponding `actor_token_type`.

---

## Verify email addresses

Some OpenID Connect (OIDC) applications require the `email_verified` claim to be `True`. Since authentik 2025.10, the default `email` scope mapping returns `False` because an email address alone does not prove that the user controls it. Choose the option that matches how you verify users' addresses.

## Option 1: Use an existing verification process

If another process verifies every user's current email address, you can create a custom email scope mapping under **Customization** > **Property Mappings** that always returns `email_verified` as `True`:

```python
return {
    "email": request.user.email,
    "email_verified": True,
}
```

This mapping asserts that every user's current email address is verified. Do not use it if an address can be unverified or changed without verification.

If you store verification status as a Boolean user attribute, such as `email_verified`, you can return its value dynamically instead:

```python
return {
    "email": request.user.email,
    "email_verified": request.user.attributes.get("email_verified", False),
}
```

Clear the attribute whenever the user's email address changes, including changes made by external sources.

### Configure the email scope mapping

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Customization** > **Property Mappings**, and click **New Property Mapping**.
3. Select **Scope Mapping**, click **Next**, and enter a **Name**. Set **Scope name** to `email`.
4. Enter the expression that matches your verification process in **Expression**.
5. Click **Finish**.
6. Open the application's OAuth2/OIDC provider. In **Scopes**, replace the default `email` scope mapping with the custom mapping and save the provider. Do not assign both email mappings to the same provider.

## Option 2: Verify addresses with authentik

The [email stage](../../flows-stages/stages/email/index.mdx) sends a confirmation link to the user's email address. After the user follows the link, this procedure records the address and maps it to the `email_verified` claim.

### Prerequisites

- [Configure email delivery](../../../install-config/email.mdx).
- Ensure that an email address is saved on the user's account before the email stage runs.

### Create and bind the email stage

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Flows and Stages** > **Stages**, and click **New Stage**.
3. Select **Email Stage**, click **Next**, and enter a **Stage Name**, such as `email-verification`.
4. Enable **Use global connection settings** if you configured global email delivery, or enter the stage-specific SMTP settings. Set **Template** to **Account Confirmation**.
5. Disable **Activate pending user on success** unless verification should activate an inactive account. Click **Create Stage**.
6. Navigate to **Flows and Stages** > **Flows**, open the flow that users will run to verify their address, and select **Stage Bindings**.
7. Bind the email stage after the user has been identified and before a [user login stage](../../flows-stages/stages/user_login/index.mdx). If the flow creates users, place it after the [user write stage](../../flows-stages/stages/user_write/index.mdx) so that the account exists before the email stage runs.

For example, you can add the stage to:

- A [two-stage enrollment flow](../../flows-stages/flow/flows.mdx#two-stage-enrollment) to confirm addresses during sign-up, after the user write stage.
- A [two-factor login flow](../../flows-stages/flow/flows.mdx#two-factor-login) to confirm addresses for existing users, after password and MFA validation. Users receive a link each time they run this flow.

The [enrollment with email verification example](../../flows-stages/flow/flows.mdx#enrollment-with-email-verification) already includes an email stage but does not record a verification attribute. It creates users as inactive and enables **Activate pending user on success** so that they can log in after verification. Review this setting before using the example for existing accounts.

Keep the email stage mandatory and send to the user's saved email address. Do not override the destination with a different address. The stage continues only after the user follows the confirmation link and can send a new link when the flow runs again.

### Record the verified address with a policy

Bind an expression policy to the user login stage binding so that it runs after the email stage. The policy records the address only when the user returns through a flow token for that account.

1. Navigate to **Customization** > **Policies**, click **New Policy**, and select **Expression Policy**.

2. Enter a **Name** and add this code to **Expression**:

   ```python
   user = request.context.get("pending_user")
   token = request.context.get("is_restored")
   if user and user.pk and user.email and token and token.user_id == user.pk:
       user.attributes["email_verified_address"] = user.email
       user.save(update_fields=["attributes"])

   return True
   ```

3. Click **Create Policy**. In **Flows and Stages** > **Flows**, open the same flow and expand its user login stage binding under **Stage Bindings**.

4. Bind the new policy to that stage binding. Keep **Evaluate when stage is run** enabled and **Evaluate when flow is planned** disabled so that the policy runs after the user follows the link.

The policy returns `True` so that the user login stage can proceed without a flow token. It updates the stored verified address only when the token matches the user. Use this policy only in a flow where the email stage is mandatory and no other stage restores a flow token, because other token-based stages can also set `is_restored`.

### Configure the email scope mapping

Create a custom email scope mapping instead of editing the managed default mapping.

1. Navigate to **Customization** > **Property Mappings**, and click **New Property Mapping**.

2. Select **Scope Mapping**, click **Next**, and give the mapping a name. Set **Scope name** to `email`.

3. Enter this expression in **Expression**:

   ```python
   email = request.user.email
   verified_address = request.user.attributes.get("email_verified_address")
   return {
       "email": email,
       "email_verified": bool(email and verified_address == email),
   }
   ```

4. Click **Finish**.

5. Open the application's OAuth2/OIDC provider. Under **Scopes**, replace the default `email` scope mapping with the custom mapping and save the provider. Do not assign both email mappings to the same provider.

The mapping returns `False` if `user.email` differs from the confirmed address. If returning to a previously verified address should require new confirmation, clear `email_verified_address` whenever the address changes, including changes made by another flow, an administrator, or a source sync.

Returning `False` does not itself deny access in authentik. If an application must reject unverified addresses, enforce that requirement in the application or with an [application policy](../../../customize/policies/working_with_policies.mdx#bind-a-policy-to-an-application).

---

## WebFinger support

## About WebFinger

The [WebFinger protocol](https://webfinger.net/) allows for the discovery of information about individuals or entities on the Internet through standard HTTP methods. It enables the retrieval of information associated with a URI that might not be directly usable as a locator, such as those for accounts or email addresses.

## authentik WebFinger support

authentik provides a WebFinger endpoint when the **Default application** setting uses an OIDC provider. Instructions on how to set a **Default application** can be found in the [authentik Branding documentation](../../../customize/branding/index.mdx#external-user-settings).

The WebFinger endpoint is available at: `https://authentik.company/.well-known/webfinger` (where authentik.company is the FQDN of your authentik instance)

---

## Property mapping expressions

A provider property mapping runs a Python expression to produce the data that the provider sends to the integrated application. The documentation for each provider lists the types that its mappings must return. Returning `None` skips the mapping.

## Available functions

### `regex_match(value: Any, regex: str) -> bool`

Check if `value` matches Regular Expression `regex`.

Example:

```python
return regex_match(request.user.username, '.*admin.*')
```

### `regex_replace(value: Any, regex: str, repl: str) -> str`

Replace anything matching `regex` within `value` with `repl` and return it.

Example:

```python
user_email_local = regex_replace(request.user.email, '(.+)@.+', '')
```

### `list_flatten(value: list[Any] | Any) -> Optional[Any]`

Flatten a list by either returning its first element, None if the list is empty, or the passed in object if it's not a list.

Example:

```python
user = list_flatten(["foo"])
# user = "foo"
```

### `ak_call_policy(name: str, **kwargs) -> PolicyResult`

Call another policy with the name *name*. The current request is passed to the policy. Keyword arguments
can be used to modify the request's context.

Example:

```python
result = ak_call_policy("test-policy")
# result is a PolicyResult object, so you can access `.passing` and `.messages`.
# Starting with authentik 2023.4, you can also access `.raw_result`, which is the raw value returned from the called policy
# `result.passing` will always be a boolean if the policy is passing or not.
return result.passing

result = ak_call_policy("test-policy-2", foo="bar")
# Inside the `test-policy-2` you can then use `request.context["foo"]`
return result.passing
```

If the called policy raises an exception, `ak_call_policy` does not propagate it. A failing `PolicyResult`
is returned (`.passing` will be `False`), with the error message available in `.messages`.

If no policy matches *name*, a `ValueError` is raised and the **calling** policy fails.

### `ak_is_group_member(user: User, **group_filters) -> bool`

Check if `user` is member of a group matching `**group_filters`.

Example:

```python
return ak_is_group_member(request.user, name="test_group")
```

### `ak_user_by(**filters) -> Optional[User]`

Fetch a user matching `**filters`.

Returns `None` if no user was found; otherwise, returns the [User](../../users-sources/user/index.mdx) object.

Example:

```python
# Find user by username
other_user = ak_user_by(username="other_user")

# Find user by custom attribute
other_user = ak_user_by(attributes__<custom_attribute_name>="<value>")
```

### `ak_user_has_authenticator(user: User, device_type: Optional[str] = None) -> bool`

Check if a user has any authenticator devices. Only fully validated devices are counted.

Optionally, you can filter by a specific device type. The following options are valid:

- `totp`
- `duo`
- `static`
- `webauthn`

Example:

```python
return ak_user_has_authenticator(request.user)
```

### `ak_create_event(action: str, **kwargs) -> None`

Create a new event with the action set to `action`. Any additional keyword parameters will be saved in the event context. Additionally, `context` will be set to the context in which this function is called.

Before saving, any data structures which are not representable in JSON are flattened, and credentials are removed.

The event is saved automatically.

Example:

```python
ak_create_event("my_custom_event", foo=request.user)
```

### `ak_create_jwt(user: User, provider: OAuth2Provider | str, scopes: list[str], validity = "seconds=60") -> str | None`2025.2

This function will only work when there is an HTTP request in the current context.

Create a new JWT signed by the given `provider` for `user`.

The `provider` parameter can either be an instance of `OAuth2Provider` or the name of a provider instance as a string. Scopes are an array of all scopes that the JWT should have.

The JWT is valid for 60 seconds by default, and this can be customized using the `validity` parameter. The syntax of the parameter is `hours=1,minutes=2,seconds=3`. The following keys are allowed:

- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks

All values accept floating-point values.

Example:

```python
jwt = ak_create_jwt(request.user, "my-oauth2-provider-name", ["openid", "profile", "email"])
```

### `ak_create_jwt_raw(provider: OAuth2Provider | str, validity = "seconds=60", **kwargs) -> str | None`2025.12

Similar to [`ak_create_jwt`](#ak_create_jwtuser-user-provider-oauth2provider--str-scopes-liststr-validity--seconds60---str--none), however this function does *not* require an HTTP request and allows for setting custom claims via `**kwargs`.

The `provider` parameter can either be an instance of `OAuth2Provider` or the name of a provider instance as a string. Scopes are an array of all scopes that the JWT should have.

The JWT is valid for 60 seconds by default, and this can be customized using the `validity` parameter. The syntax of the parameter is `hours=1,minutes=2,seconds=3`. The following keys are allowed:

- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks

All values accept floating-point values.

Example:

```python
jwt = ak_create_jwt_raw("my-oauth2-provider-name", my_claim="my_value")
```

### `ak_send_email(address: str | list[str], subject: str, body: str = None, stage: EmailStage = None, template: str = None, context: dict = None, cc: str | list[str] = None, bcc: str | list[str] = None) -> bool`2025.10

Send an email using authentik's email system.

The `address` parameter specifies the recipient email address(es). It can be:

- A single email address as a string: `"user@example.com"`
- A list of email addresses: `["user1@example.com", "user2@example.com"]`

When using multiple recipients in the `address` or `cc` fields, all email addresses will be visible to all recipients. Use `bcc` to send to multiple recipients without revealing addresses to each other.

The `subject` parameter sets the email subject line.

You must provide either `body` (for plain text/HTML content) or `template` (for template rendering), but not both.

The `stage` parameter can be an `EmailStage` instance for custom email settings. If `None`, global email settings are used.

The `template` parameter specifies a template name to render. When using templates, you can pass additional context variables via the `context` parameter.

The `cc` parameter specifies email address(es) to carbon copy. Same format as `address`.

The `bcc` parameter specifies email address(es) to blind carbon copy. Same format as `address`. Recipients in `bcc` will not be visible to other recipients.

If the email is queued successfully, the function returns `True`; otherwise, it returns `False`.

Examples:

```python
# Send email with plain body to single recipient
ak_send_email("user@example.com", "Welcome!", body="Welcome to our platform!")

# Send email to multiple recipients
ak_send_email(
    ["user1@example.com", "user2@example.com", "admin@example.com"],
    "System Maintenance",
    body="Scheduled maintenance will occur tonight."
)

# Send email using a template
ak_send_email("user@example.com", "Password Reset", template="email/password_reset.html")

# Send email with custom context for template to multiple recipients
ak_send_email(
    ["user@example.com", "admin@example.com"],
    "Account Update",
    template="email/event_notification.html",
    context={
        "title": "Profile Updated",
        "body": "Your account profile has been successfully updated.",
        "key_value": {"Updated Field": "Email Address", "Date": "2025-01-01"}
    }
)

# Send email with custom email stage
ak_send_email("admin@example.com", "Report", body="Daily report", stage=my_custom_stage)

# Send email with CC
ak_send_email(
    "user@example.com",
    "Important Update",
    body="Please review this update.",
    cc="manager@example.com"
)

# Send email with multiple CC and BCC recipients
ak_send_email(
    "user@example.com",
    "Confidential Report",
    body="Attached is the quarterly report.",
    cc=["manager@example.com", "lead@example.com"],
    bcc=["audit@example.com", "compliance@example.com"]
)
```

## Comparing IP Addresses

To compare IP addresses or check if an IP address is within a given subnet, you can use the functions `ip_address('192.0.2.1')` and `ip_network('192.0.2.0/24')`. With these objects you can do [arithmetic operations](https://docs.python.org/3/library/ipaddress.html#operators).

You can also check if an IP Address is within a subnet by writing the following:

```python
ip_address('192.0.2.1') in ip_network('192.0.2.0/24')
# evaluates to True
```

## DNS resolution and reverse DNS lookups

To resolve a hostname to a list of IP addresses, use the functions `resolve_dns(hostname)` and `resolve_dns(hostname, ip_version)`.

```python
resolve_dns("google.com")  # returns a list of all IPv4 and IPv6 addresses
resolve_dns("google.com", 4)  # returns a list of only IPv4 addresses
resolve_dns("google.com", 6)  # returns a list of only IPv6 addresses
```

You can also perform reverse DNS lookups.

Reverse DNS lookups may not return the expected host if the IP address is part of a shared hosting environment.
See: [https://stackoverflow.com/a/19867936](https://stackoverflow.com/a/19867936)

To perform a reverse DNS lookup use `reverse_dns("192.0.2.0")`. If no DNS records are found the original IP address is returned.

DNS resolving results are cached in memory. The last 32 unique queries are cached for up to 3 minutes.

## Available objects

- `ak_logger`: structlog BoundLogger. See [structlog documentation](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger)

  Example:

  ```python
  ak_logger.debug("This is a test message")
  ak_logger.warning("This will be logged with a warning level")
  ak_logger.info("Passing structured data", request=request)
  ```

- `requests`: requests Session object. See [requests documentation](https://requests.readthedocs.io/en/master/user/advanced/)

## Available context

- `request`: an authentik [policy request object](../../../customize/policies/types/expression/reference.mdx#request). Use `request.user` for the contextual user and `request.context` for additional context data.
- `request.http_request`: the underlying Django request when one is available. This value can be `None`. See the [Django request documentation](https://docs.djangoproject.com/en/stable/ref/request-response/).
- `user`: the contextual user when the mapping type provides one. See [User object properties](../../../users-sources/user/user_ref.mdx#object-properties).
- `group`: the contextual group when the mapping type provides one.

Providers can add more variables, such as `provider`, `token`, or `endpoint`. Refer to the provider's documentation for the variables that each mapping type receives.

---

## Provider property mappings

Provider property mappings send information from authentik to integrated applications. For example, a SAML property mapping can send a user's groups to an application as a SAML attribute.

To map data from a source into authentik instead, see [source property mappings](../../../users-sources/sources/property-mappings/index.mdx).

## Choose a property mapping type

Select the mapping type that matches the provider. Each type expects a different result from its expression.

| Mapping type                                                         | Use                                                                                                                                                                                                                         |
| -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [SAML property mapping](../saml/index.mdx#saml-property-mappings)    | Send an attribute to an integrated application in a SAML assertion.                                                                                                                                                         |
| [OAuth2/OIDC scope mapping](../oauth2/index.mdx#scope-mappings)      | Add claims that an OAuth2/OIDC application can request through a scope.                                                                                                                                                     |
| [Proxy scope mapping](../proxy/custom_headers.mdx#property-mappings) | Send dynamic headers to a proxied application or configure other proxy behavior.                                                                                                                                            |
| [RADIUS property mapping](../radius/index.mdx#radius-attributes)     | Add attributes to the RADIUS response sent to a client.                                                                                                                                                                     |
| [RAC property mapping](../rac/index.mdx#rac-property-mappings)       | Configure credentials and connection settings for an integrated RAC endpoint.                                                                                                                                               |
| Synchronization provider mapping                                     | Build user or group data for integrated services such as [SCIM](../scim/index.mdx#attribute-mapping), [Google Workspace](../gws/index.mdx#property-mapping), and [Microsoft Entra ID](../entra/index.mdx#property-mapping). |

## Create a custom provider property mapping

If the default mappings do not send the data that your application needs, create a custom mapping.

1. Log in to authentik as an administrator and open the Admin interface.
2. Navigate to **Customization** > **Property Mappings**.
3. Click **New Property Mapping**.
4. Select the mapping type that matches your provider, and then click **Next**.
5. Enter a **Name** and configure the fields for that mapping type. Most mapping types include an **Expression** field.
6. Click **Finish**.
7. Open the provider or endpoint that should use the mapping.
8. Add the mapping to the appropriate field, such as **Property mappings**, **User Property Mappings**, **Group Property Mappings**, or **Scopes**.
9. Save the provider or endpoint.

## Write a mapping expression

Most property mappings use a Python expression to create their output. The required output depends on the mapping type. For example:

- A SAML property mapping returns a value, such as a string or a list of group names.
- An OAuth2/OIDC scope mapping returns a dictionary of claim names and values.
- A synchronization mapping returns data in the format that the integrated service expects.

Returning `None` skips the mapping. For the available functions, objects, and variables, see [Property mapping expressions](./expression.mdx).

## Map stored user attributes

A property mapping reads user data and sends it to an integrated application. It does not collect or store data on the user. If you collect data with prompt fields in an enrollment flow, add a [User Write stage](../../flows-stages/stages/user_write/index.mdx) to store the data on the user first.

A mapping can read built-in user properties, such as `user.name`, and custom user attributes. Use `ak_obj_attr()` to read a custom attribute. The name sent to the application does not need to match the key stored on the user.

**Example**:

A user stores the custom attributes `given_name` and `family_name`, but an OAuth2/OIDC application expects the claims `first_name` and `last_name`. A scope mapping can rename the values:

```python
return {
    "first_name": ak_obj_attr(user, "given_name", user.name),
    "last_name": ak_obj_attr(user, "family_name", ""),
}
```

For SAML, create a SAML property mapping for each value. Set **SAML Attribute Name** to the name that the application expects, and return the stored value:

```python
return ak_obj_attr(user, "given_name", user.name)
```

Different applications can use different names for the same stored attribute.

## SAML property mappings

A SAML property mapping adds an attribute to the SAML assertion that authentik sends to the service provider (SP). It does not add data to the authentication request that authentik receives from the SP.

See [SAML property mappings](../saml/index.mdx#saml-property-mappings) for the default mappings and more details.

## Scope mappings with OAuth2

An OAuth2/OIDC scope mapping defines a scope and the claims that authentik returns when a client requests that scope. The expression must return a dictionary.

The client must request the scope, and the scope mapping must be assigned to the provider. If either condition is missing, authentik does not return the mapping's claims.

The returned claims are available from the `UserInfo` endpoint. authentik includes them in the ID token and access token only when **Include claims in id\_token** is enabled on the provider.

See [Scope mappings](../oauth2/index.mdx#scope-mappings) for scope authorization, default scopes, and special scopes.

## Synchronization property mappings

Synchronization providers use property mappings to build the user and group data that they send to integrated services. The mapping must return data in the format that the integrated service expects.

Synchronization providers evaluate property mappings in name order. If a property mapping fails to evaluate, authentik stops the synchronization and does not evaluate the remaining mappings. Other provider types generally record the error and continue with the next property mapping.

Refer to the provider documentation for supported fields and examples:

- [SCIM](../scim/index.mdx#attribute-mapping)
- [Google Workspace](../gws/index.mdx#property-mapping)
- [Microsoft Entra ID](../entra/index.mdx#property-mapping)

### Skip objects during synchronization

For SCIM, Google Workspace, and Microsoft Entra ID, raise `SkipObject` to skip the current user or group. The synchronization continues with the next object.

**Example**:

```python
if user.username == "example_username":
    raise SkipObject
```

Only synchronization mappings handle `SkipObject`. It does not apply to SAML attributes or OAuth2/OIDC claims.

---

## Create a proxy provider

For an overview of how proxy providers work, see the [proxy provider](./index.mdx) documentation.

## Workflow to create a proxy provider

Follow this workflow to create and configure a proxy provider:

1. Create a proxy provider and application pair.
2. Select the proxy provider mode.
3. Assign the application to a proxy outpost.
4. Configure your reverse proxy.
5. Verify access to the application.

## Create a proxy provider and application pair

To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to create only the provider by navigating to **Applications** > **Providers** and clicking **New Provider**.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **New Application**.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **Proxy Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure Proxy Provider** page, provide a provider name and select the authorization flow.
6. Configure the provider mode as described below.
7. On the **Review and Submit Application** page, review the settings, and then click **Create Application**.

## Select the proxy provider mode

The proxy provider supports three modes. The correct mode depends on where proxying happens and whether one provider protects one application or a whole domain.

### Proxy

Use **Proxy** mode when the authentik outpost should act as the reverse proxy. The outpost receives requests on the external host, checks authentication and authorization, and forwards allowed requests to the upstream application.

Configure the following settings:

- **External host**: the URL users use to access the protected application. Include the scheme and any non-standard port, for example `https://app.company`.
- **Internal host**: the upstream URL the outpost forwards requests to, for example `http://internal-app:8080`.
- **Internal host SSL Validation**: whether the outpost validates the upstream application's TLS certificate.

### Forward auth (single application)

Use **Forward auth (single application)** mode when your existing reverse proxy should proxy traffic to the application and call the authentik outpost only to check authentication and authorization.

Each protected application needs its own application and provider in authentik. Configure **External host** as the URL users use to access that application.

### Forward auth (domain level)

Use **Forward auth (domain level)** mode when one provider should protect multiple applications under the same parent domain.

Domain-level forward auth reduces the number of providers you need to create, but it cannot enforce different application-level authorization rules for each protected application.

Configure the following settings:

- **Authentication URL**: the external URL used for authentication, typically the authentik URL for the protected domain, for example `https://auth.company`.
- **Cookie domain**: the parent domain where the authentication cookie is valid, for example `domain.tld`.

If your applications run on subdomains such as `app1.domain.tld` and `app2.domain.tld`, set the cookie domain to `domain.tld`.

## Assign the application to a proxy outpost

Proxy providers require a proxy outpost.

For simple deployments, you can use the [embedded outpost](../../outposts/embedded/embedded.mdx), which runs as part of the authentik server. For deployments that need a separate outpost lifecycle, use a managed outpost or manually deploy a proxy outpost.

1. Navigate to **Applications** > **Outposts**.
2. Select an existing proxy outpost or click **Create**.
3. If you create a new outpost, set **Type** to `Proxy` and select the relevant integration or manual deployment option.
4. Under **Applications**, select the application that uses the proxy provider.
5. Click **Update** or **Create**.

For more information, see the [Outposts](../../outposts/index.mdx) documentation.

## Configure your reverse proxy

The reverse proxy configuration depends on the provider mode:

- In **Proxy** mode, route the protected external host to the proxy outpost.
- In **Forward auth (single application)** mode, route the application to its upstream service and route `/outpost.goauthentik.io` on the application domain to the proxy outpost.
- In **Forward auth (domain level)** mode, route each protected application to its upstream service and configure the reverse proxy to send authentication checks to the domain-level authentication URL.

For forward auth configuration examples, see:

- [nginx](./server_nginx.mdx)
- [Traefik](./server_traefik.mdx)
- [Caddy](./server_caddy.mdx)
- [Envoy](./server_envoy.mdx)
- [HAProxy](./server_haproxy.mdx)

## Verify access

Open the protected application URL in your browser.

If you are not already authenticated, authentik should redirect you to the configured authentication flow. After successful authentication and authorization, authentik redirects you back to the application.

If access fails, check the outpost logs and search for the proxy provider's `client_id`. The `client_id` is shown on the provider's **Authentication** tab.

---

## Custom headers

The proxy can send custom headers to your upstream application. Configure these headers in one of two ways:

- Group or user attributes, which allow static values.
- Property mappings, which allow dynamic values.

## Group or user attributes

Edit the group or user that should set the header, and set the following attributes:

```yaml
additionalHeaders:
    X-My-Header: value
```

You can then add users to the group or override the field on individual users.

## Property mappings

Use property mappings for dynamic header values, for example when an application requires `X-App-User` to contain the username.

Create a new scope mapping with a name and scope of your choice, and use an expression like this:

```python
return {
    "ak_proxy": {
        "user_attributes": {
            "additionalHeaders": {
                "X-App-User": request.user.username
            }
        }
    }
}
```

After you create this scope mapping, edit the proxy provider and select the mapping under **Additional scopes**.

The property mapping uses the same `additionalHeaders` structure as group and user attributes, so both methods can be combined. When both methods set the same header, the property mapping value overrides the static attribute value.

## Percent-encode non-ASCII header values

The proxy sends header values without encoding them. Some upstream applications cannot handle non-ASCII values, such as `Céline` in `X-authentik-name`, which can cause requests or WebSocket handshakes to fail.

You can use a scope mapping to override that header with a percent-encoded value. Create a scope mapping with a name and scope of your choice and the following expression:

```python
from urllib.parse import quote

return {
    "ak_proxy": {
        "user_attributes": {
            "additionalHeaders": {
                "X-authentik-name": quote(request.user.name, safe="")
            }
        }
    }
}
```

Edit the proxy provider and select the mapping under **Additional scopes**. Log out of the application and log in again to apply the mapping to an existing session. This works in proxy mode and both forward auth modes.

The expression percent-encodes the UTF-8 bytes of the name, so `Céline` becomes `C%C3%A9line`. It also encodes spaces and literal `%` signs. Use the same approach for other headers that contain non-ASCII values.

The upstream application must percent-decode the value once and interpret the decoded bytes as UTF-8, for example with Python's `urllib.parse.unquote`. Enable this mapping only for applications that support this decoding.

---

## Forward auth

Forward auth uses your existing reverse proxy for application traffic and relies on the authentik outpost only to check authentication and authorization.

To use forward auth, select one of the forward auth modes on the proxy provider and configure your reverse proxy to send authentication checks to the outpost.

## Forward auth modes

### Single application

Single-application mode works for one application hosted on its own domain or subdomain. Set **External host** to the application URL.

In this mode, only `/outpost.goauthentik.io` on the application domain is routed to the authentik outpost. The application traffic itself continues to be routed to the upstream application by your reverse proxy.

Use this mode when each application should have its own provider, policies, bindings, and authorization behavior.

### Domain level

Domain-level mode works for multiple applications under the same parent domain. Set **Authentication URL** to the URL used for authentication, and **Cookie domain** to the parent domain shared by the protected applications.

This mode differs from *Forward auth (single application)* mode in the following ways:

- You do not need to configure an application and provider in authentik for each application domain.
- Users do not need to authorize each application separately.
- You cannot restrict individual applications to different users with separate application-level policies.

Use single-application mode when each application needs separate access rules.

## Configuration templates

For reverse proxy configuration templates, refer to the following:

---

## Header authentication

## Sending authentication

### Send HTTP Basic authentication

Proxy providers can send HTTP Basic authentication credentials to the upstream application. To use this behavior, enable **Send HTTP-Basic Authentication** on the proxy provider and configure the user and password attribute keys.

For example, with **HTTP-Basic Username Key** set to `app_username` and **HTTP-Basic Password Key** set to `app_password`, set the following attributes on a user or a group that the user is a member of:

```yaml
app_username: admin
app_password: admin-password
```

These credentials are only retrieved when the user authenticates to the proxy.

If the user does not have a matching attribute, authentik falls back to using the user's email address as the username. If the password attribute is not found, the password is empty.

## Receiving authentication

By default, when **Intercept header authentication** is enabled, authentik intercepts the `Authorization` header. If the `Authorization` header value is invalid, authentik returns an HTTP `401` error response. Requests without an `Authorization` header are still redirected to the standard login flow.

If the proxied application requires the `Authorization` header, disable **Intercept header authentication**. When this setting is disabled, authentik still tries to interpret the `Authorization` header and falls back to the default behavior when it cannot interpret the header.

### Receiving HTTP Basic authentication

Proxy providers can receive HTTP Basic authentication credentials. The password must be an app password because the credentials are used internally with the [OAuth2 machine-to-machine authentication flow](../oauth2/machine_to_machine.mdx).

Create an [app password](../../../users-sources/user/user-interface.mdx#tokens-and-app-passwords), then send a request to the protected application's URL with your authentik username:

```shell
curl --user '<username>' https://app.company/api
```

When curl prompts for a password, enter the generated app password. This sends an `Authorization: Basic ...` header. It works with proxy and forward auth providers; for forward auth, the reverse proxy must pass the `Authorization` header to the outpost.

**Send HTTP-Basic Authentication** controls credentials sent to the upstream application and is not required to receive these credentials. You do not need to store the app password in user attributes or create a property mapping.

Access control uses the policies bound to the application being accessed.

If the received credentials are invalid, authentik returns HTTP `401` when **Intercept header authentication** is enabled, or starts the standard authentication flow otherwise. If the credentials are correct, authentik removes the `Authorization` header to prevent sending the credentials to the proxied application.

We strongly recommend that the client sending requests with HTTP Basic authentication persists the cookies returned by the outpost. Otherwise, every request must be authenticated independently, which increases load on the authentik server and causes a performance impact.

Starting with authentik 2023.2, logging in with the reserved username `goauthentik.io/token` behaves as if a bearer token was used. The same options as described below apply. This allows token-based authentication for applications that only support basic authentication.

### Receiving HTTP Bearer authentication

Proxy providers can receive HTTP Bearer authentication credentials. The token must be a JWT token issued for the proxy provider. The [OAuth2 machine-to-machine authentication flow](../oauth2/machine_to_machine.mdx) documentation describes this behavior using the `client_id` value shown in the admin interface. Both static and JWT authentication methods are supported.

An app password or authentik API token cannot be sent directly as a Bearer token to the proxy provider. Exchange the app password for an OAuth2 access token first, or use HTTP Basic authentication as described above.

Access control uses the policies bound to the application being accessed.

If the received credentials are invalid, authentik returns HTTP `401` when **Intercept header authentication** is enabled, or starts the standard authentication flow otherwise. If the credentials are correct, authentik removes the `Authorization` header to prevent sending the credentials to the proxied application.

We recommend that the client sending requests with HTTP Bearer authentication persists the cookies returned by the outpost. For bearer authentication, this has a smaller impact than for basic authentication, but each request is still verified with the authentik server.

---

## Proxy provider

The proxy provider protects applications that do not support native authentication protocols such as OIDC, SAML, or LDAP.

Depending on the selected mode, one of the following happens:

1. The authentik outpost proxies requests to the upstream application.
2. Your existing reverse proxy handles the application traffic and asks the authentik outpost to check authentication and authorization.

Refer to the [create a proxy provider](./create-proxy-provider.mdx) documentation for setup instructions.

```mermaid
sequenceDiagram
    participant u as User accesses service
    participant rp as Reverse proxy
    participant ak as authentik
    participant s as Service

    u->>rp: Initial request
    rp->>ak: Checks authentication
    alt User is authenticated
        ak ->> rp: Successful response
        rp ->> s: Initial request is forwarded
    else User needs to be authenticated
        ak ->> rp: Redirect to the login page
        rp ->> u: Redirect is passed to enduser
    end
```

## Proxy modes

The proxy provider supports the following modes:

| Mode                              | Use when                                                                                                                 |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Proxy                             | The authentik outpost should proxy traffic to one upstream application.                                                  |
| Forward auth (single application) | Your existing reverse proxy should proxy traffic to one application and use authentik only for authentication checks.    |
| Forward auth (domain level)       | Your existing reverse proxy should use one proxy provider to protect multiple applications under the same parent domain. |

Domain-level forward auth cannot enforce different application-level authorization rules for each protected application. Use single-application mode when each application needs its own policies, bindings, or authorization behavior.

## Headers sent to upstream applications

The proxy outpost sets the following user-specific headers:

| Header                     | Example value                                                      | Description                                                        |
| -------------------------- | ------------------------------------------------------------------ | ------------------------------------------------------------------ |
| `X-authentik-username`     | `akadmin`                                                          | Username of the currently logged in user.                          |
| `X-authentik-groups`       | `foo\|bar\|baz`                                                    | Groups the user is a member of, separated by pipes.                |
| `X-authentik-entitlements` | `foo\|bar\|baz`                                                    | Entitlements the user has for the application, separated by pipes. |
| `X-authentik-email`        | `root@localhost`                                                   | Email address of the currently logged in user.                     |
| `X-authentik-name`         | `authentik Default Admin`                                          | Full name of the currently logged in user.                         |
| `X-authentik-uid`          | `900347b8a29876b45ca6f75722635ecfedf0e931c6022e3a29a8aa13fb5516fb` | Hashed identifier of the currently logged in user.                 |

The proxy outpost also sets the following application-specific headers:

| Header                      | Example value                  | Description                                               |
| --------------------------- | ------------------------------ | --------------------------------------------------------- |
| `X-authentik-meta-outpost`  | `authentik Embedded Outpost`   | Name of the authentik outpost.                            |
| `X-authentik-meta-provider` | `test`                         | Name of the authentik provider.                           |
| `X-authentik-meta-app`      | `test`                         | Slug of the authentik application.                        |
| `X-authentik-meta-version`  | `goauthentik.io/outpost/1.2.3` | Version of the authentik outpost.                         |
| `X-Forwarded-Host`          | `app.company`                  | Original host sent by the client. Only set in proxy mode. |

In proxy mode, `X-Forwarded-Host` preserves the original `Host` header sent by the client because the `Host` header is set to the configured upstream host.

### Additional headers

You can set the `additionalHeaders` attribute on groups or users to send additional static headers:

```yaml
additionalHeaders:
    X-test-header: test-value
```

For dynamic headers, see the [custom headers](./custom_headers.mdx) documentation.

If an upstream application cannot handle non-ASCII header values, use a [scope mapping to percent-encode them](./custom_headers.mdx#percent-encode-non-ascii-header-values).

## HTTPS

The outpost listens on port `9000` for HTTP and port `9443` for HTTPS.

If your upstream host is HTTPS, and you're not using forward auth, you need to access the outpost over HTTPS too.

## Log out

Login is initiated automatically when you visit the protected application without a valid cookie.

To log out, navigate to `/outpost.goauthentik.io/sign_out` on the host that serves the outpost:

- In proxy mode and forward auth single-application mode, use the protected application host, for example `https://app.company/outpost.goauthentik.io/sign_out`.
- In forward auth domain-level mode, use the authentication URL configured for the provider, for example `https://auth.company/outpost.goauthentik.io/sign_out`.

Logging out of a provider invalidates all sessions for that user within the respective outpost.

## Allow unauthenticated requests

To allow unauthenticated requests to specific paths or URLs, use the **Unauthenticated Paths** or **Unauthenticated URLs** field on the proxy provider.

Each new line is interpreted as a regular expression and is compiled and checked using the Rust [`regex`](https://docs.rs/regex/latest/regex/#syntax) crate.

A pattern that fails to compile is skipped, and a warning is written to the outpost logs. The remaining patterns still apply, so a typo silently leaves a path authenticated rather than causing an error.

The behavior of this field changes depending on the selected mode.

### Proxy and Forward auth (single application)

In these modes, the regular expressions are matched against the request path.

### Forward auth (domain level)

In this mode, the regular expressions are matched against the full request URL, including the scheme and host.

## Dynamic backend selection

In proxy mode, you can configure the upstream backend dynamically with scope mappings.

Create a scope mapping with a name and scope of your choice, and set the expression to:

```python
return {
    "ak_proxy": {
        "backend_override": f"http://foo.bar.baz/{request.user.username}"
    }
}
```

Edit the proxy provider and add this mapping under **Additional scopes**. The expression is evaluated only when the user logs in to the application.

## Host header2025.6.1

By default, the proxy provider uses the forwarded host header received from the client. Starting with authentik 2025.6.1, you can dynamically adjust the host header with a property mapping.

Create a scope mapping with a name and scope of your choice, and set the expression to:

```python
return {
    "ak_proxy": {
        "host_header": "my-internal-host-header"
    }
}
```

Edit the proxy provider and add this mapping under **Additional scopes**. The expression is evaluated only when the user logs in to the application.

### Dynamically setting host header

You can dynamically set the host header to match the **Internal host** value set on the proxy provider. To do this, create a scope mapping with a name and scope of your choice, and set the expression to:

```python
from urllib.parse import urlparse
parsed_url = urlparse(provider.proxyprovider.internal_host)
return {
    "ak_proxy": {
        "host_header": parsed_url.netloc
    }
}
```

Edit the proxy provider and add this mapping under **Additional scopes**. The expression is evaluated only when the user logs in to the application.

## Proxy authentication

When a user authenticates to the proxy, authentik uses OAuth2 behavior configured on the proxy provider. For header-based authentication options, see [Header authentication](./header_authentication.mdx) and [Machine-to-Machine](../oauth2/machine_to_machine.mdx).

## Troubleshooting

To obtain more detailed information about a failure, search the logs of the outpost or server container for the `client_id` of the proxy provider. The `client_id` is shown on the provider's **Authentication** tab.

---

## Caddy

The configuration template shown below applies to both single-application and domain-level forward auth.

*example-outpost* is used as a placeholder for the outpost name.
*authentik.company* is used as a placeholder for the authentik installation.
*app.company* is used as a placeholder for the external domain for the application.
*outpost.company* is used as a placeholder for the outpost. When using the embedded outpost, this can be the same as *authentik.company*.

Use the following configuration:

```apacheconf
app.company {
    # directive execution order is only as stated if enclosed with route.
    route {
        # always forward outpost path to actual outpost
        reverse_proxy /outpost.goauthentik.io/* http://outpost.company:9000

        # forward authentication to outpost
        forward_auth http://outpost.company:9000 {
            uri /outpost.goauthentik.io/auth/caddy

            # capitalization of the headers is important, otherwise they will be empty
            copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
            # Add the 'authorization' header to the list if you need proxy providers which
            # send a custom HTTP-Basic Authentication header based on values from authentik

            # optional, in this config trust all private ranges, should probably be set to the outposts IP
            trusted_proxies private_ranges
        }

        # actual site configuration below, for example
        reverse_proxy localhost:1234
    }
}
```

If you're trying to proxy to an upstream over HTTPS, you need to set the `Host` header to the value they expect for it to work correctly.

```conf
reverse_proxy /outpost.goauthentik.io/* https://outpost.company {
    header_up Host {http.reverse_proxy.upstream.host}
}
```

---

## Envoy

The configuration template shown below applies to both single-application and domain-level forward auth.

If you are using Istio and Kubernetes, use the port number that is exposed for your cluster.

*example-outpost* is used as a placeholder for the outpost name.
*authentik.company* is used as a placeholder for the authentik installation.
*app.company* is used as a placeholder for the external domain for the application.
*outpost.company* is used as a placeholder for the outpost. When using the embedded outpost, this can be the same as *authentik.company*.

Set the following settings on the *IstioOperator* resource:

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
    name: istio
    namespace: istio-system
spec:
    meshConfig:
        extensionProviders:
            - name: "authentik"
              envoyExtAuthzHttp:
                  # Replace with <service-name>.<namespace>.svc.cluster.local
                  service: "ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local"
                  port: "9000"
                  pathPrefix: "/outpost.goauthentik.io/auth/envoy"
                  headersToDownstreamOnAllow:
                      - cookie
                  headersToUpstreamOnAllow:
                      - set-cookie
                      - x-authentik-*
                      # Add the 'authorization' header to headersToUpstreamOnAllow if you need proxy providers which
                      # send a custom HTTP-Basic Authentication header based on values from authentik
                      # - authorization
                  includeRequestHeadersInCheck:
                      - cookie
```

You can then create *AuthorizationPolicy* resources to protect your applications like this:

```yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
    name: authentik-policy
    namespace: istio-system
spec:
    selector:
        matchLabels:
            istio: ingressgateway
    action: CUSTOM
    provider:
        name: "authentik"
    rules:
        - to:
              - operation:
                    hosts:
                        # You can create a single resource and list all Domain names here, or create multiple resources
                        - "app.company"
```

---

## HAProxy

Use this configuration to protect one HTTPS application with standalone HAProxy and authentik's **Forward auth (single application)** mode. HAProxy checks application requests with the outpost's nginx-compatible forward-auth endpoint and redirects unauthenticated users to sign in.

## Prerequisites

- Use a supported HAProxy release compiled with Lua support (`USE_LUA=1`).
- Install [haproxy-auth-request](https://github.com/TimWolla/haproxy-auth-request), its [haproxy-lua-http](https://github.com/haproxytech/haproxy-lua-http) dependency, and a Lua `json` library.
- [Create an application and proxy provider](./create-proxy-provider.mdx) with **Forward auth (single application)** mode and **External host** set to `https://app.company`. Assign the application to an embedded or deployed proxy outpost.
- Ensure that HAProxy's address is included in authentik's [trusted proxy networks](../../../install-config/reverse-proxy.mdx#trusted-proxy-networks). The Lua module sends the application hostname in `X-Forwarded-Host`.

The Lua module connects directly to the outpost over HTTP and does not support TLS for authorization subrequests. Keep this connection on a trusted network, and restrict direct access to the application backend to HAProxy.

## Configuration

*example-outpost* is used as a placeholder for the outpost name.
*authentik.company* is used as a placeholder for the authentik installation.
*app.company* is used as a placeholder for the external domain for the application.
*outpost.company* is used as a placeholder for the outpost. When using the embedded outpost, this can be the same as *authentik.company*.

The example terminates TLS at HAProxy. Replace the certificate path, application hostname, and backend addresses with your own values. The certificate file must contain the certificate chain and private key in PEM format.

Place `auth-request.lua` at `/usr/share/haproxy/auth-request.lua` and `http.lua` at `/usr/share/haproxy/haproxy-lua-http/http.lua`. Install the `json` library on HAProxy's Lua search path.

```haproxy
global
    # Load haproxy-lua-http and haproxy-auth-request. Adjust these paths to
    # match your installation.
    lua-prepend-path /usr/share/haproxy/?/http.lua
    lua-load /usr/share/haproxy/auth-request.lua

defaults
    mode http
    timeout connect 5s
    timeout client 30s
    timeout server 30s
    timeout tunnel 1h

frontend https
    bind :443 ssl crt /etc/haproxy/certs/app.company.pem

    # This frontend serves only this application.
    acl application_host hdr(host) -i app.company app.company:443
    http-request deny unless application_host
    # Match the provider's hostname, including when the client sends :443.
    http-request set-header Host app.company

    # Do not authenticate authentik outpost endpoints.
    acl authentik_outpost path_beg /outpost.goauthentik.io/

    # Pass the original request information to authentik.
    http-request set-header X-Real-IP %[src]
    http-request set-header X-Forwarded-For %[src]
    http-request set-header X-Forwarded-Method %[method]
    http-request set-header X-Forwarded-Proto https
    http-request set-header X-Forwarded-Host %[req.hdr(Host)]
    # authentik requires an absolute URL for the nginx-compatible endpoint.
    http-request set-header X-Original-URL https://%[req.hdr(Host)]%[pathq]

    # Remove client-supplied identity headers, including underscore aliases.
    http-request del-header X-authentik- -m beg
    http-request del-header _ -m sub
    http-request del-header Authorization

    # Verify protected requests with the authentik outpost. Keep the request
    # header allowlist narrow because forwarding WebSocket Upgrade headers
    # prevents the authorization request from completing.
    http-request lua.auth-intercept authentik_outpost /outpost.goauthentik.io/auth/nginx HEAD x-original-url,x-real-ip,x-forwarded-for,x-forwarded-host,x-forwarded-proto,user-agent,cookie,accept,x-forwarded-method x-authentik-* - if !authentik_outpost

    # Preserve session cookies returned by successful authorization checks.
    http-request set-var(txn.auth_response_set_cookie) var(req.auth_response_header.set_cookie) if { var(req.auth_response_header.set_cookie) -m found }

    # Start login on 401. Deny every other unsuccessful auth check, including
    # errors or an unreachable outpost.
    http-request redirect code 302 location /outpost.goauthentik.io/start?rd=%[hdr(X-Original-URL),url_enc] if !authentik_outpost !{ var(txn.auth_response_successful) -m bool } { var(txn.auth_response_code) -m int 401 }
    http-request deny if !authentik_outpost !{ var(txn.auth_response_successful) -m bool }

    use_backend authentik_outpost if authentik_outpost
    default_backend application

backend authentik_outpost
    server outpost outpost.company:9000 check

backend application
    http-response add-header Set-Cookie %[var(txn.auth_response_set_cookie)] if { var(txn.auth_response_set_cookie) -m found }
    server application app.company:8080 check
```

The template removes incoming `Authorization` headers and headers whose names contain underscores. Client-supplied bearer tokens and HTTP Basic credentials are therefore not available to authentik or the application.

To use **Send HTTP-Basic Authentication** in the proxy provider, add `authorization` to the successful response-header allowlist, changing `x-authentik-*` to `x-authentik-*,authorization`.

Validate the configuration with `haproxy -c -f /etc/haproxy/haproxy.cfg` before reloading HAProxy.

---

## nginx

# nginx

The configuration templates shown below apply to both single-application and domain-level forward auth.

*example-outpost* is used as a placeholder for the outpost name.
*authentik.company* is used as a placeholder for the authentik installation.
*app.company* is used as a placeholder for the external domain for the application.
*outpost.company* is used as a placeholder for the outpost. When using the embedded outpost, this can be the same as *authentik.company*.

```nginx
# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
    default upgrade;
    ''      '';
}

# Preserve an explicit Host header, including a non-standard port.
# Fall back to $host when no Host header is present, such as with HTTP/3.
map $http_host $ak_http_host {
    default $http_host;
    ''      $host;
}

server {
    # SSL and VHost configuration
    listen                  443 ssl http2;
    server_name             _;

    ssl_certificate         /etc/ssl/certs/ssl-cert-snakeoil.pem;
    ssl_certificate_key     /etc/ssl/private/ssl-cert-snakeoil.key;

    # Increase buffer size for large headers
    # This is needed only if you get 'upstream sent too big header while reading response
    # header from upstream' error when trying to access an application protected by goauthentik
    proxy_buffers 8 16k;
    proxy_buffer_size 32k;

    location / {
        # Put your proxy_pass to your application here, and all the other statements you'll need
        # proxy_pass http://localhost:5000;
        # proxy_set_header Host $host;
        # proxy_set_header ...
        # Support for websocket
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade_keepalive;

        ##############################
        # authentik-specific config
        ##############################
        auth_request     /outpost.goauthentik.io/auth/nginx;
        error_page       401 = @goauthentik_proxy_signin;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header       Set-Cookie $auth_cookie;

        # translate headers from the outposts back to the actual upstream
        auth_request_set $authentik_username $upstream_http_x_authentik_username;
        auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
        auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
        auth_request_set $authentik_email $upstream_http_x_authentik_email;
        auth_request_set $authentik_name $upstream_http_x_authentik_name;
        auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

        proxy_set_header X-authentik-username $authentik_username;
        proxy_set_header X-authentik-groups $authentik_groups;
        proxy_set_header X-authentik-entitlements $authentik_entitlements;
        proxy_set_header X-authentik-email $authentik_email;
        proxy_set_header X-authentik-name $authentik_name;
        proxy_set_header X-authentik-uid $authentik_uid;

        # This section should be uncommented when the "Send HTTP Basic authentication" option
        # is enabled in the proxy provider
        # auth_request_set $authentik_auth $upstream_http_authorization;
        # proxy_set_header Authorization $authentik_auth;
    }

    # all requests to /outpost.goauthentik.io must be accessible without authentication
    location /outpost.goauthentik.io {
        # When using the embedded outpost, use:
        proxy_pass              http://authentik.company:9000/outpost.goauthentik.io;
        # For manual outpost deployments:
        # proxy_pass              http://outpost.company:9000;

        # Note: ensure the Host header matches your external authentik URL:
        proxy_set_header        Host $ak_http_host;

        proxy_set_header        X-Original-URL $scheme://$ak_http_host$request_uri;
        add_header              Set-Cookie $auth_cookie;
        auth_request_set        $auth_cookie $upstream_http_set_cookie;
        proxy_pass_request_body off;
        proxy_set_header        Content-Length "";
    }

    # Special location for when the /auth endpoint returns a 401,
    # redirect to the /start URL which initiates SSO
    location @goauthentik_proxy_signin {
        internal;
        add_header Set-Cookie $auth_cookie;
        return 302 /outpost.goauthentik.io/start?rd=$scheme://$ak_http_host$request_uri;
        # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
        # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$ak_http_host$request_uri;
    }
}
```

Create a new ingress for the outpost

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
    name: authentik-outpost
spec:
    rules:
        - host: app.company
          http:
              paths:
                  - path: /outpost.goauthentik.io
                    pathType: Prefix
                    backend:
                        # Or, to use an external Outpost, create an ExternalName service and reference that here.
                        # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
                        service:
                            name: ak-outpost-example-outpost
                            port:
                                number: 9000
```

This ingress handles authentication requests, and the sign-in flow.

Add these annotations to the ingress you want to protect

This configuration requires that you enable [`allow-snippet-annotations`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations), for example by setting `controller.allowSnippetAnnotations` to `true` in your helm values for the ingress-nginx installation.

```yaml
metadata:
    annotations:
        # This should be the in-cluster DNS name for the authentik outpost service
        # as when the external URL is specified here, nginx will overwrite some crucial headers
        nginx.ingress.kubernetes.io/auth-url: |-
            http://ak-outpost-example.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
        # If you're using domain-level auth, use the authentication URL instead of the application URL
        # Write the host as a literal rather than using $http_host. Clients are not required to send a Host
        # header over HTTP/3, which leaves $http_host empty, and $host strips any non-standard port.
        # The literal must match the proxy provider's External host, including a non-standard port.
        # For domain-level auth, set this per Ingress so each application redirects back to its own host.
        nginx.ingress.kubernetes.io/auth-signin: |-
            https://app.company/outpost.goauthentik.io/start?rd=$scheme://app.company$escaped_request_uri
        nginx.ingress.kubernetes.io/auth-response-headers: |-
            Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid
            # Add the 'authorization' header to auth-response-headers if you need proxy providers which
            # send a custom HTTP-Basic Authentication header based on values from authentik
        nginx.ingress.kubernetes.io/auth-snippet: |
            # Must match the proxy provider's External host, including any non-standard port. The outpost
            # reads X-Forwarded-Host in preference to Host when matching a request to an application.
            # Do not set X-Original-URL here: ingress-nginx already sets it earlier in this same location,
            # and its value takes precedence over anything the snippet appends.
            proxy_set_header X-Forwarded-Host app.company;
```

In the proxy host's **Advanced** tab, add the following configuration. Remove any existing `location /` block from this field; it replaces Nginx Proxy Manager's generated location and its Access List rules.

```nginx
# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

# Make sure not to redirect traffic to a port 4443
port_in_redirect off;

# Preserve an explicit Host header, including a non-standard port.
# Fall back to $host when no Host header is present, such as with HTTP/3.
set $ak_http_host $http_host;
if ($ak_http_host = "") {
    set $ak_http_host $host;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    # When using the embedded outpost, use:
    proxy_pass              http://authentik.company:9000/outpost.goauthentik.io;
    # For manual outpost deployments:
    # proxy_pass              http://outpost.company:9000;

    # Note: ensure the Host header matches your external authentik URL:
    proxy_set_header        Host $ak_http_host;

    proxy_set_header        X-Original-URL $scheme://$ak_http_host$request_uri;
    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$scheme://$ak_http_host$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$ak_http_host$request_uri;
}
```

In **Custom Locations**, add or edit `/` with the same **Scheme**, **Forward Hostname / IP**, and **Forward Port** as the proxy host. Click the location's gear icon and add the following directives without a `location` wrapper or `proxy_pass`. Nginx Proxy Manager generates those and the Access List rules.

```nginx
auth_request     /outpost.goauthentik.io/auth/nginx;
error_page       401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header       Set-Cookie $auth_cookie;

# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-entitlements $authentik_entitlements;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;

# This section should be uncommented when the "Send HTTP Basic authentication" option
# is enabled in the proxy provider
# auth_request_set $authentik_auth $upstream_http_authorization;
# proxy_set_header Authorization $authentik_auth;
```

Apply the same authentication directives to any other custom locations that proxy protected application paths. Enable **Websockets Support** in **Details** if your application needs it.

If you use an IP-based **Access List**, keep custom locations set to inherit the host's list where that option is available. Disable **Satisfy Any** and leave **Authorization** empty in the list so that both the IP rules and authentik authentication are required. After saving, verify that a denied IP receives `403 Forbidden` even with a valid authentik session.

---

## Traefik

# Traefik

The configuration templates shown below apply to both single-application and domain-level forward auth.

*example-outpost* is used as a placeholder for the outpost name.
*authentik.company* is used as a placeholder for the authentik installation.
*app.company* is used as a placeholder for the external domain for the application.
*outpost.company* is used as a placeholder for the outpost. When using the embedded outpost, this can be the same as *authentik.company*.

```yaml
http:
    middlewares:
        authentik:
            forwardAuth:
                address: http://outpost.company:9000/outpost.goauthentik.io/auth/traefik
                trustForwardHeader: true
                maxResponseBodySize: 4194304
                authResponseHeaders:
                    - X-authentik-username
                    - X-authentik-groups
                    - X-authentik-entitlements
                    - X-authentik-email
                    - X-authentik-name
                    - X-authentik-uid
                    - X-authentik-jwt
                    - X-authentik-meta-jwks
                    - X-authentik-meta-outpost
                    - X-authentik-meta-provider
                    - X-authentik-meta-app
                    - X-authentik-meta-version
                    # Add the 'authorization' header to authResponseHeaders if you need proxy providers which
                    # send a custom HTTP-Basic Authentication header based on values from authentik
                    # - authorization
    routers:
        default-router:
            rule: "Host(`app.company`)"
            middlewares:
                - authentik
            priority: 10
            service: app
        default-router-auth:
            rule: "Host(`app.company`) && PathPrefix(`/outpost.goauthentik.io/`)"
            priority: 15
            service: authentik
    services:
        app:
            loadBalancer:
                servers:
                    - url: http://ip.internal
        authentik:
            loadBalancer:
                servers:
                    - url: http://outpost.company:9000/outpost.goauthentik.io
```

```yaml
services:
    traefik:
        image: traefik:v3.0
        container_name: traefik
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        ports:
            - 80:80
        command:
            - "--api"
            - "--providers.docker=true"
            - "--providers.docker.exposedByDefault=false"
            - "--entrypoints.web.address=:80"

    authentik-proxy:
        image: ghcr.io/goauthentik/proxy
        ports:
            - 9000:9000
            - 9443:9443
        environment:
            AUTHENTIK_HOST: https://your-authentik.tld
            AUTHENTIK_INSECURE: "false"
            AUTHENTIK_TOKEN: token-generated-by-authentik
            # Starting with 2021.9, you can optionally set this too
            # when authentik_host for internal communication doesn't match the public URL
            # AUTHENTIK_HOST_BROWSER: https://external-domain.tld
        labels:
            traefik.enable: true
            traefik.port: 9000
            traefik.http.routers.authentik.rule: Host(`app.company`) && PathPrefix(`/outpost.goauthentik.io/`)
            # `authentik-proxy` refers to the service name in the compose file.
            traefik.http.middlewares.authentik.forwardauth.address: http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
            traefik.http.middlewares.authentik.forwardauth.trustForwardHeader: true
            traefik.http.middlewares.authentik.forwardauth.authResponseHeaders: X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
            # Add the 'authorization' header to authResponseHeaders if you need proxy providers which
            # send a custom HTTP-Basic Authentication header based on values from authentik
        restart: unless-stopped

    whoami:
        image: containous/whoami
        labels:
            traefik.enable: true
            traefik.http.routers.whoami.rule: Host(`app.company`)
            traefik.http.routers.whoami.middlewares: authentik@docker
        restart: unless-stopped
```

Create a middleware:

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
    name: authentik
spec:
    forwardAuth:
        # This address should point to the cluster endpoint provided by the kubernetes service, not the Ingress.
        address: http://outpost.company:9000/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
            - X-authentik-username
            - X-authentik-groups
            - X-authentik-entitlements
            - X-authentik-email
            - X-authentik-name
            - X-authentik-uid
            - X-authentik-jwt
            - X-authentik-meta-jwks
            - X-authentik-meta-outpost
            - X-authentik-meta-provider
            - X-authentik-meta-app
            - X-authentik-meta-version
            # Add the 'authorization' header to authResponseHeaders if you need proxy providers which
            # send a custom HTTP-Basic Authentication header based on values from authentik
            # - authorization
```

Traefik changed the apiVersion of the middleware CRD in version 3.0, for older versions please substitute "apiVersion: traefik.containo.us/v1alpha1"

Add the following settings to your IngressRoute

By default traefik does not allow cross-namespace references for middlewares:

See the [Traefik cross-namespace reference documentation](https://doc.traefik.io/traefik/v2.4/providers/kubernetes-crd/#allowcrossnamespace) to enable it.

```yaml
spec:
    routes:
        - kind: Rule
          match: "Host(`app.company`)"
          middlewares:
              - name: authentik
                namespace: authentik
          priority: 10
          services: # Unchanged
        # This part is only required for single-app setups
        - kind: Rule
          match: "Host(`app.company`) && PathPrefix(`/outpost.goauthentik.io/`)"
          priority: 15
          services:
              - kind: Service
                # Or, to use an external Outpost, create an ExternalName service and reference that here.
                # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
                name: ak-outpost-example-outpost
                port: 9000
```

---

## Create a Remote Access Control (RAC) provider

For an overview of Remote Access Control (RAC), see the [RAC provider](./index.mdx) documentation.

You can also watch our video on YouTube for setting up RAC:

## Workflow to create an RAC provider

Follow this workflow to create and configure an RAC provider:

1. Create a RAC provider and application pair.
2. Create RAC property mappings (that define the access credentials to each remote machine).
3. Create endpoints for each remote machine you want to connect to.
4. Create an RAC outpost to service the provider.

Depending on whether you are connecting using RDP, SSH, or VNC, the exact configuration choices will differ, but the overall workflow applies to all RAC connections.

### Create a RAC provider and application pair

To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to create only the provider by navigating to **Applications** > **Providers** and clicking **New Provider**.

1. Log in to authentik as an administrator, and open the authentik Admin interface.

2. Navigate to **Applications** > **Applications** and click **New Application** to open the application wizard.

3. On the **New application** page, define the application details, and then click **Next**.

4. Select the **RAC** provider type, and then click **Next**.

5. On the **Configure Remote Access Provider** page, provide the configuration settings:
   - **Connection expiry**: set how long a connection authorization remains valid. The default is `hours=8`. Reconnecting does not reset this limit, and the connection also ends if the user's authentik session expires or the user logs out.
   - **Delete authorization on disconnect**: leave disabled, the default, to allow the browser to reuse a valid authorization when reconnecting after a disconnect. Enable it to require a new authorization after every disconnect, including temporary network failures. authentik deletes the stored authorization during connection setup, so it is already unavailable for reconnecting when the connection ends. This setting does not control the remote operating system's login session. See [Connection management](./index.mdx#connection-management) for details about authorization reuse and expiry.

6. Click **Submit** to create both the application and the provider.

### Create RAC property mappings

Next, you need to add property mappings for each remote machine you want to access. RAC property mappings can be used to pass the access credentials and connection settings of the remote machine.

Refer to the [RAC Credentials Prompt](./rac_credentials_prompt.mdx) and [RAC SSH Public Key Authentication](./rac-public-key.mdx) documentation for alternative methods of handling RAC authentication.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Customization** > **Property Mappings**, and click **New Property Mapping**.

3. Select **RAC Provider Property Mapping** as the property mapping type, and then click **Next**.

4. On the **New RAC Provider Property Mapping** page, provide the following configuration settings:
   - **Name**: provide a name for the property mapping
   - Under **General settings**:
     - **Username**: the username for the remote machine
     - **Password**: the password for the remote machine
   - Under **Advanced settings**:
     - **Expression *(optional)***: define other connection settings to be used, such as an SSH key. For more information, refer to the [Connection settings](./index.mdx#connection-settings) documentation.

5. Click **Finish**.

### Create endpoints for the provider

Then, you need to create an endpoint corresponding to each remote machine you want to connect to. Endpoints define the IP address, port, protocol, and other settings used for connecting to a remote machine.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Providers**.

3. Click the **Edit** button on the RAC provider that you previously created.

4. On the Provider page, under **Endpoints**, click **New RAC Endpoint**, and provide the following settings:
   - **Provider Name** (endpoint name): define a name for the endpoint
   - **Protocol**: select the appropriate protocol
   - **Host**: enter the host name or IP address of the remote machine. Optionally include the port.
   - **Maximum concurrent connections**: select a value or use `-1` to disable the limitation
   - **Property mappings**: select either the property mapping that you previously created, or use one of the default RAC property mappings
   - **Advanced settings *(optional)***: define other connection settings to be used. For more information, refer to the [Connection settings](./index.mdx#connection-settings) documentation

5. Click **Create**.

### Create an RAC outpost

The RAC provider requires the deployment of an [RAC Outpost](../../outposts/index.mdx).

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Outposts**.

3. Click **Create** and set the following values:
   - **Name**: define a name for the outpost.
   - **Type**: `RAC`
   - **Integration**: select either Docker or Kubernetes, or optionally [manually deploy the outpost](../../outposts/index.mdx#outpost-integrations).
   - **Applications**: select the RAC application that you previously created.
   - **Advanced settings *(optional)***: for further optional configuration settings, refer to [RAC Configuration](../../outposts/index.mdx#configuration).

4. Click **Create** to save your new outpost.

## Access the remote machine

To verify your configuration and access the remote machine, go to the **User interface** of your authentik instance. On the **Application Dashboard** page, click the **Remote Access** application to start a secure session on the remote machine in your web browser.

If you defined multiple endpoints, click the endpoint for the remote machine that you want to access.

---

## Remote Access Control (RAC) Provider

The RAC provider allows users to access remote Windows, macOS, and Linux machines via [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol)/[SSH](https://en.wikipedia.org/wiki/Secure_Shell)/[VNC](https://en.wikipedia.org/wiki/Virtual_Network_Computing). Just like other providers in authentik, the RAC provider is associated with an application that appears on a user's **Application Dashboard** page.

For instructions on creating a RAC provider, refer to the [Create a Remote Access Control (RAC) provider](./create-rac-provider.mdx) documentation. Alternatively, watch our ["Remote Access Control (RAC) in authentik" video on YouTube](https://www.youtube.com/watch?v=9wahIBRV6Ts).

## RAC components

A RAC provider uses several components:

```mermaid
architecture-beta
    service application(mdi:application-outline)[Application]
    service provider(mdi:application-cog-outline)[Provider]
    service endpoint(mdi:network-pos)[Endpoint Settings]
    service server(mdi:server)[authentik Server]
    service outpost(mdi:server-plus)[RAC Outpost]

    service machine(mdi:desktop-classic)[Remote Machine]

    application:R --> L:provider
    provider:B -- T:endpoint
    provider:R --> L:server
    server:R <--> L:outpost
    outpost:B <--> T:machine
```

When a user starts the RAC application, it communicates with the authentik server, which then connects to the RAC outpost and sends instructions (based on the endpoint data you defined) on how to connect to the remote machine.

After connecting to the remote machine, the outpost sends a message back to the authentik server (via WebSockets), and the web browser opens the WebSocket connection to the remote machine.

## Endpoints

Unlike other providers, where an application-provider pair is created for each resource you wish to access, RAC works differently. RAC uses a single application connected to one RAC provider. The RAC provider then has an *Endpoint* object for each remote machine (computer/server) you want to connect to.

The *Endpoint* object specifies:

- Hostname, IP address, and port of the remote machine
- Protocol to use: SSH, RDP, or VNC
- RDP connection settings
- [RAC Property mappings](#rac-property-mappings) to apply
- [Connection settings](#connection-settings) to apply

Additionally, it is possible to bind policies to *Endpoint* objects to restrict user access. To connect to a remote machine, users must have access to both the application that the RAC provider is using and the corresponding endpoint.

## Connection management

Launching a RAC application/endpoint from the [User interface](../../../customize/interfaces/user) runs the provider's authorization flow and creates a connection authorization tied to the user's current authentik session. This authorization allows the browser to connect to that endpoint. You can view and delete stored connection authorizations from the **Connections** tab of the RAC provider.

### Delete authorization on disconnect

The RAC provider's **Delete authorization on disconnect** setting is disabled by default.

- When disabled, the connection authorization remains available after a disconnect. The browser can reuse it to reconnect to the same endpoint without repeating the authorization flow, provided that the authorization and the authentik session are still valid. This allows reconnection after a temporary network failure. Launching the application/endpoint again starts a new authorization flow rather than reusing the previous authorization.
- When enabled, the authorization cannot be reused. After a disconnect, the user must launch the application/endpoint again and complete the provider's authorization flow. This also applies when a temporary network failure interrupts the connection, so enabling the setting can cause repeated authorization prompts on unstable networks. The prompts depend on the stages configured in the authorization flow; reauthorization does not necessarily require logging in to authentik again.

Although the UI describes deletion as happening on disconnect, authentik deletes the stored authorization during connection setup, after requesting a connection from the outpost. The current connection continues, but subsequent reconnect attempts cannot use that authorization. A connection attempt that fails after this deletion also requires a new authorization.

### Connection and session expiry

**Connection expiry** limits the authorization's lifetime, starting when authentik creates it. The default is `hours=8`. Reconnecting with the same authorization does not reset this limit. When it expires, authentik disconnects the RAC connection and requires a new authorization, even if the user is still logged in to authentik.

The connection also ends when the user's authentik session expires or the user logs out. **Delete authorization on disconnect** controls authorization reuse; it does not extend or replace either expiry limit. Connection expiry still applies to the current connection when the setting is enabled.

A connection authorization is separate from the login session on the remote operating system. Deleting the authorization prevents reuse through authentik; it does not itself log the user out of the remote operating system or terminate applications running there. Whether a remote session survives a disconnected RAC connection depends on the protocol and the remote machine's session policies.

## RAC Property Mappings

You can create RAC property mappings via **Customization** > **Property Mappings**.

RAC property mappings allow you to configure the following settings:

- **Username**: the username for the remote machine
- **Password**: the password for the remote machine
- **Ignore server certificate**: set whether the validity of the returned RDP server certificate will be ignored
- **Enable wallpaper**: enable/disable the desktop wallpaper of the RDP server
- **Enable font-smoothing**: enable/disable font-smoothing (anti-aliasing) on the RDP server
- **Enable full window dragging**: enable/disable whether the full content of a window is visible while moving it on the RDP server
- **Advanced settings**: set [connection settings](#connection-settings) via a Python expression

## Connection settings

The RAC provider utilizes [Apache Guacamole](https://guacamole.apache.org/) for establishing SSH, RDP and VNC connections. RAC supports the use of Apache Guacamole connection configurations.

Connection settings can include `username`, `password`, `domain`, `private-key`, `security`, `enable-audio`, and more.

For a full list of possible connection settings, see the [Apache Guacamole connection configuration documentation](https://guacamole.apache.org/doc/gug/configuring-guacamole.html#configuring-connections).

RAC connection settings can be set via several methods and are all merged together when connecting:

1. Default settings
2. RAC Provider settings
3. RAC Endpoint settings
4. RAC Provider property mapping settings
5. RAC Endpoint property mapping settings
6. The `connection_settings` object in the flow plan

For examples of how to configure connection settings, see the [RAC SSH public key authentication](./rac-public-key.mdx) and [RAC Credentials Prompt](./rac_credentials_prompt.mdx) documentation.

## Capabilities

The following features are currently supported:

- Bi-directional clipboard
- Audio redirection (from remote machine to browser)
- Resizing

---

## RAC SSH Public Key Authentication

## About RAC SSH public key authentication

The RAC provider supports SSH public key authentication. This allows for secure connections to SSH endpoints without the use of passwords.

SSH private keys can be configured via several methods:

## Apply a private key to an RAC provider

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the **Edit** icon on the RAC provider that requires public key authentication.
4. In the **Settings** codebox enter the private key of the endpoint, for example:
   ```yaml
   private-key: |
       -----BEGIN SSH PRIVATE KEY-----
       SAMPLEgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu
       KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm
       o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k
       TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7
       9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy
       v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs
       /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00
       -----END SSH PRIVATE KEY-----
   ```
5. Click **Update**.

The pipe character (`|`) is required to preserve linebreaks in the YAML text. See the [YAML spec](https://yaml.org/spec/1.2.2/#literal-style) for more information.

## Apply a private key to an RAC endpoint

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the name of the RAC provider that the endpoint belongs to.
4. Under **Endpoints**, click on the **Edit** icon next to the endpoint that requires public key authentication.
5. Under **Advanced settings**, in the **Settings** codebox enter the private key of the endpoint:
   ```yaml
   private-key: |
       -----BEGIN SSH PRIVATE KEY-----
       SAMPLEgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu
       KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm
       o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k
       TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7
       9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy
       v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs
       /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00
       -----END SSH PRIVATE KEY-----
   ```
6. Click **Update**.

The pipe character (`|`) is required to preserve linebreaks in the YAML text. See the [YAML spec](https://yaml.org/spec/1.2.2/#literal-style) for more information.

## Apply a private key to an RAC property mapping

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**, then create a **RAC Provider Property Mapping** with the following settings:

   - **Name**: Choose a descriptive name
   - Under **Advanced Settings**:
     - **Expression**:

   ```python
   import textwrap

   private_key = textwrap.dedent("""
   -----BEGIN SSH PRIVATE KEY-----
   SAMPLEgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu
   KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm
   o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k
   TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7
   9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy
   v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs
   /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00
   -----END SSH PRIVATE KEY-----
   """)

   return {
       "username": "<your_username>",
       "private-key": private_key
   }
   ```

3. Click **Finish**.

4. Navigate to **Applications** > **Providers**.

5. Click the **Edit** icon on the RAC provider that requires public key authentication.

6. Under **Protocol Settings** add the newly created property mapping to **Selected Property Mappings**.

7. Click **Update**.

## Retrieve a private key from a user's attributes and apply it to an RAC property mapping

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Customization** > **Property Mappings** and click **New Property Mapping**. Create a **RAC Provider Property Mapping** with the following settings:
   - **Name**: Choose a descriptive name
   - Under **Advanced Settings**:
     - **Expression**:
     ```python
     return {
     "private-key": request.user.attributes.get("<private-key-attribute-name>", "default"),
     }
     ```

3. Click **Finish**.

4. Navigate to **Applications** > **Providers**.

5. Click the **Edit** icon on the RAC provider that requires public key authentication.

6. Under **Protocol Settings**, add the newly created property mapping to **Selected Property Mappings**.

7. Click **Update**.

For group attributes, the following expression can be used `request.user.group_attributes(request.http_request)`.

---

## RAC Credentials Prompt

## About the RAC credentials prompt

You can configure the RAC provider to prompt users for their credentials when connecting to RAC endpoints. This is particularly useful for establishing RDP connections to modern Windows systems that often require credentials to establish a connection.

After implementing this configuration, when connecting to an RAC endpoint users are prompted to enter their credentials which are then passed to the RAC endpoint. This means that static credentials do not need to be set in the RAC provider, property mapping, or endpoint.

This configurations requires:

1. Creating an authorization flow.
2. Creating two prompts.
3. Creating and binding a prompt stage.
4. Updating the RAC provider.

## Create a new authorization flow

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**, click **New Flow**, and enter the following required settings:
   - **Name**: Enter a descriptive name for the flow.
   - **Title**: Enter a title for the flow. This will be displayed to users when they're prompted for their credentials.
   - **Slug**: Enter a slug for the flow. This will be displayed in the flow URL.
   - **Designation**: `Authorization`
   - **Authentication**: `Require authentication`
3. Click **Create**.

## Create prompts

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Prompts**, click **New Prompt**, and enter the following required settings:
   - **Name**: Enter a descriptive name for the prompt (e.g. `username`).
   - **Field Key**: `connection_settings.username`
   - **Label**: Enter a label for the field which will be displayed above it.
   - **Type**: `Text`
   - **Required**: Toggled on.
   - **Order**: `0`
3. Click **Create Prompt** to save the prompt.
4. On the **Prompts** page, click **New Prompt** again, and enter the following required settings:
   - **Name**: Enter a descriptive name for the prompt (e.g. `password`).
   - **Field Key**: `connection_settings.password`
   - **Label**: Enter a label for the field which will be displayed above it.
   - **Type**: `Password`
   - **Required**: Toggled.
   - **Order**: `1`
5. Click **Create** to save the prompt.

You can optionally add other prompt fields such as `domain` (e.g. `connection_settings.domain`), which can be useful for Windows based RDP. There is also the option of adding a `Text (read-only)` type prompt field that includes explanatory text for the user (e.g. `please enter your RDP credentials`).

## Create and bind a prompt stage

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Flows and Stages** > **Flows**.
3. Click the name of the newly created authorization flow.
4. Click **Stage Bindings**, click **Create or bind...**, select **New Stage**, and enter the following required settings:
   - **Select Type**: Select `Prompt stage` as the prompt type.
   - **Create Prompt Stage**:
     - **Name**: Enter a name for the prompt stage.
     - Under **Fields**:
       - Click the **x** icon to remove all selected fields.
       - Add the two newly created prompt fields (e.g.`username` and `password`) to selected fields.
     - Under **Validation Policies**:
       - Click the **x** icon to remove all selected validation policies.
   - **Create Binding**:
     - Click **Finish**.

## Update the RAC provider

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the **Edit** icon of the RAC provider that you wish to add a credentials prompt to.
4. Change **Authorization flow** to the newly created authorization flow.
5. Click **Update** to save the change.

## Update the RAC endpoint *(sometimes required)*

Depending on the configuration of the RDP server that's being connected to, it is sometimes necessary to set the security type that's used for the connection. For many modern windows RDP servers, this often needs to be set to `tls`.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click the name of the RAC provider that you're using.
3. Under **Endpoints**, click the **Edit** icon of the endpoint that you're using.
4. Under **Advanced Settings** in the **Settings** box, enter `security: tls`
5. Click **Update** to save the change.

Other options for the connection security type are: `any`, `nla`, `nla-ext`, `vmconnect`, and `rdp`. For more information see the [Guacamole RDP Authentication and Security Documentation](https://guacamole.apache.org/doc/gug/configuring-guacamole.html#authentication-and-security).

## Configuration verification

Log in to authentik with a user account that has the required privileges to access the RAC application. Open the User interface, and on the **Application Dashboard** page click the RAC application. You should then be redirected to the prompt stage and prompted for a username and password. Enter the credentials for the RAC endpoint and if the credentials are valid the RDP/SSH/VNC connection should be established.

---

## RADIUS Provider

You can configure a Radius provider for applications that don't support any other protocols or that require Radius.

This provider requires the deployment of a [RADIUS outpost](../../outposts/index.mdx).

Currently, only authentication requests are supported.

### Authentication flow

Authentication requests against the Radius Server use a flow in the background. This allows you to use the same flows, stages, and policies as you do for web-based logins.

The following stages are supported:

    - [Identification](../../flows-stages/stages/identification/index.mdx)
    - [Password](../../flows-stages/stages/password/index.mdx)
    - [Authenticator validation](../../flows-stages/stages/authenticator_validate/index.mdx)

    Authenticator validation currently only supports DUO, TOTP, and static authenticator.

    For code-based authenticators, the code must be given as part of the bind password, separated by a semicolon. For example for the password `example-password` and the MFA token `123456`, the input must be `example-password;123456`.

    SMS-based authenticators are not supported because they require a code to be sent from authentik, which is not possible during the bind.

- [User Logout](../../flows-stages/stages/user_logout/index.mdx)
- [User Login](../../flows-stages/stages/user_login/index.mdx)
- [Deny](../../flows-stages/stages/deny/index.mdx)
- [Mutual TLS stage](../../flows-stages/stages/mtls/index.mdx)

### Protocol support

The RADIUS provider supports EAP-TLS and [PAP](https://en.wikipedia.org/wiki/Password_Authentication_Protocol) (Password Authentication Protocol) protocol. For password-based authentication, only PAP protocol is supported due to other password hashing methods requiring reversible password hashes, which we don’t support for security reasons.

<details>
  <summary>RADIUS compatibility matrix for password-based authentication:</summary>

This table represents the password-hash compatibility with various RADIUS protocols.

</details>

### EAP :ak-enterprise {#eap}

authentik supports EAP with TLS as the inner protocol, between the application and transport layers to encrypt and secure communications. To set this up, a certificate authority needs to be available and client certificates need to be installed on machines, the configuration of which is outside of the scope of this document.

#### EAP-TLS

Create an authentication flow with a [Mutual TLS stage](../../flows-stages/stages/mtls/index.mdx) as its first stage. This stage should be configured to use your CA's certificate. Afterwards a server certificate needs to be selected in the RADIUS provider (which serves as an outpost). Then, configure your RADIUS provider to use this authentication flow to enable EAP-TLS authentication. After the certificate and the authentication flow are configured in the provider, authentication via EAP-TLS is possible.

For certificates, ensure that you use a client certificate and a server certificate that are created by a certificate authority, not a self-generated certificate.

For EAP-TLS, note that you should NOT use a globally known CA.

Using private PKI certificates that are trusted by the end-device is best practice. For example, using a Verisign certificate as a "known CA" means that ANYONE who has a certificate signed by them can authenticate via EAP-TLS, and in addition you should implement [custom validation](../../flows-stages/flow/context/index.mdx#auth_method-string) to prevent unauthorized access.

### RADIUS attributes

Starting with authentik 2024.8, you can create RADIUS provider property mappings, which make it possible to add custom attributes to the RADIUS response packets.

For example, to add the Cisco AV-Pair attribute, this snippet can be used:

```python
define_attribute(
    vendor_code=9,
    vendor_name="Cisco",
    attribute_name="AV-Pair",
    attribute_code=1,
    attribute_type="string",
)
packet["Cisco-AV-Pair"] = "shell:priv-lvl=15"
return packet
```

After creation, make sure to select the RADIUS property mapping in the RADIUS provider.

---

## Create a SAML provider

authentik SAML providers can be created either from scratch or by using SAML metadata exported from the Service Provider (SP). Optionally, the metadata of an authentik SAML provider can be exported back to the SP. Note, however, that many SPs do not support exporting their metadata or importing Identity Provider (IdP) metadata.

## Create a SAML provider and application pair

To create a provider along with the corresponding application that uses it for authentication, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **New Provider**.

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **SAML Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure SAML Provider** page, provide the configuration settings and then click **Create Application** to create both the application and the provider.

## Create a SAML provider from SP metadata (import SP metadata)

If you have exported SAML metadata from your SP, you can optionally create the authentik SAML provider by importing this metadata.

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **New Provider** to create a provider.
3. Select **SAML Provider from Metadata** as the **Provider Type**, and then click **Next**.
4. On the **New SAML Provider from Metadata** page, provide the configuration settings along with an SP metadata file and then click **Finish** to create the provider.
5. (Optional) Edit the created SAML provider and configure any further settings.

## Export authentik SAML provider metadata

After an authentik SAML provider has been created via any of the above methods, you can access its metadata in one of two ways:

### Download authentik metadata

To download the metadata of an authentik SAML provider, follow these steps:

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the name of the provider you want metadata from to open its overview tab.
4. In the **Related objects** section, under **Metadata** click on **Download**. This will download the metadata XML file for that provider.

### Access metadata tab

To view and optionally download the metadata of an authentik SAML provider, follow these steps:

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the name of the provider you want metadata from to open its overview tab.
4. Navigate to the **Metadata** tab.
5. The metadata for the provider will be shown in a codebox. You can optionally use the **Download** button to obtain the metadata as a file.

---

## SAML Provider

The SAML provider allows you to integrate with Service Providers using the SAML2 protocol. It supports [importing and exporting SAML metadata](#saml-metadata), [signed requests](#certificates) and uses [property mappings](../property-mappings/index.mdx#saml-property-mappings) to align, or "map", Service Provider and authentik attributes.

Refer to our documentation to learn how to [create a SAML provider](./create-saml-provider.mdx).

## SAML bindings and endpoints

Bindings define how SAML messages are exchanged between an Identity Provider (IdP) and a Service Provider (SP), typically a service or application. Both IdPs and SPs define various endpoints in their metadata, each associated with a specific SAML binding.

A binding defines how SAML messages are transported over network protocols. In authentik, you can select one of two SAML bindings: `HTTP Redirect` or `HTTP POST`.

Endpoint URLs specify where and how the messages are sent according to that binding. authentik exposes a unified SAML endpoint that handles both SSO and SLO for both `HTTP Redirect` and `HTTP POST` bindings — the operation type is detected from the incoming SAML message:

| Endpoint                  | URL                                              |
| ------------------------- | ------------------------------------------------ |
| SAML endpoint (SSO + SLO) | `/application/saml/<application_slug>/`          |
| SSO (IdP-initiated login) | `/application/saml/<application_slug>/init/`     |
| Metadata Download         | `/application/saml/<application_slug>/metadata/` |

The previous binding-specific endpoints (`/sso/binding/redirect/`, `/sso/binding/post/`, `/sso/binding/init/`, `/slo/binding/redirect/`, `/slo/binding/post/`) remain available for backward compatibility.

## SAML metadata

SAML Metadata ensures that SAML single sign-on works reliably by exchanging and maintaining identity and connection information. SAML metadata is an XML document that defines how IdPs and SPs securely interact for authentication. It includes information such as endpoints, bindings, certificates, and unique identifiers.

### Import SP SAML metadata

You can [import SP SAML metadata](./create-saml-provider.mdx#create-a-saml-provider-from-sp-metadata-import-sp-metadata) to automatically configure a SAML provider based on the requirements of an SP.

### Export authentik SAML metadata

You can [export SAML metadata from an authentik SAML provider](./create-saml-provider.mdx#export-authentik-saml-provider-metadata) to an SP to automatically provide important endpoint and certificate information to the SP.

## EntityID/Issuer override

By default, authentik uses the SAML provider's metadata URL as the IdP `<Issuer>` / `<EntityID>` value:

```
https://authentik.company/application/saml/<application_slug>/metadata/
```

The **EntityID/Issuer override** field (under **Advanced protocol settings** on a SAML provider) replaces this default with a custom value. Set it only in the rare case when the Service Provider requires a specific IdP issuer string that doesn't match the metadata URL.

This field was previously named **Issuer**. Existing values were preserved during the rename. Don't clear the override unless you also update the SP-side **IdP Entity ID** / **IdP Issuer** field to authentik's metadata URL.

## Certificates

Certificates are vital for trust and security during SAML authentication and are used for several purposes.

### Signing certificates

A signing certificate allows authentik to digitally sign SAML assertions and responses. This certificate contains a private key that creates a cryptographic signature, proving the authenticity and integrity of the transmitted data. The SP then uses the corresponding public key from this certificate to verify the signature. Ensuring the response was not tampered with and that it originated from authentik.

#### Signing algorithm

Signing algorithms (such as RSA-SHA256 or ECDSA-SHA256) define the cryptographic method used for creating and validating the signatures.

#### Digest algorithm

A digest algorithm is a cryptographic hash function used to create a fixed-size hash (digest) from the data in the SAML assertion or message. authentik computes a digest value using the chosen algorithm (such as SHA-1 or SHA-256), and it is included as part of the digital signature process. The SP uses the same digest algorithm to independently compare it with the received digest to validate the integrity of the received assertion or message.

### Verification certificates

A verification certificate in authentik acts as the public key used to verify digital signatures on SAML responses and assertions from an SP. When a SAML message is received, authentik validates it by comparing the signature against its configured verification certificate, ensuring that messages originated from the SP.

### Encryption certificates

An encryption certificate is a public key certificate used by authentik to encrypt sensitive data in SAML assertions before sending them to an SP. This ensures that sensitive data within the assertion, such as user attributes and authentication details, remain confidential and can only be decrypted by the SP possessing the corresponding private key.

## SAML property mappings

During a SAML authentication process, communication between the SP and the IdP relies on property mappings to align, or "map", user attributes values between the IdP and SP.

Each SAML property mapping includes the following fields:

- **Name**: The name of the property mapping that's displayed in the authentik admin interface.
- **SAML Attribute Name**: The label that maps IdP user information to SP expectations. Can be a URN OID, a schema reference, or any other string.
- **Friendly Name**: A human-friendly identifier for a SAML attribute.
- **Expression**: The Python expression that maps an authentik user attribute to a value that an SP is expecting.

### Default SAML property mappings

The following property mappings are automatically added when you create a new SAML provider and can be removed at will.

| Property Mapping Name                                         | SAML Attribute Name                                                          |
| ------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| authentik default SAML Mapping: Email                         | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`         |
| authentik default SAML Mapping: Groups                        | `http://schemas.xmlsoap.org/claims/Group`                                    |
| authentik default SAML Mapping: Name                          | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`                 |
| authentik default SAML Mapping: UPN                           | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn`                  |
| authentik default SAML Mapping: User ID                       | `http://schemas.goauthentik.io/2021/02/saml/uid`                             |
| authentik default SAML Mapping: Username                      | `http://schemas.goauthentik.io/2021/02/saml/username`                        |
| authentik default SAML Mapping: WindowsAccountName (Username) | `http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname` |

The default SAML property mappings can be viewed on the **Property Mappings** page of the Admin interface by setting the **Managed** filter to **All**.

### Custom SAML property mappings

If there is not already a property mapping that maps the user attributes that your SP requires, you can [create a custom property mapping](../property-mappings/) or edit one of the existing mappings.

For example, some SPs require users' first name (givenname) and last name (surname) attributes to be provided separately. However, the `authentik default SAML Mapping: Name` property mapping returns both attributes as one string. The following custom property mappings can be useful in such cases:

#### `surname`

- SAML Attribute Name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`
- Expression:

  ```python
  return request.user.name.rsplit(" ", 1)[-1]
  ```

#### `givenname`

- SAML Attribute Name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`
- Expression:

  ```python
  return request.user.name.split(" ", 1)[0]
  ```

## NameID

The NameID attribute acts as a unique identifier for a user. While other attributes might change (givenname, email address, etc) the NameID attribute is persistent and should never change. When the IdP sends a SAML assertion to the SP, the NameID is the unique identifier used to represent a specific user in the assertion. It's not used for authentication itself, only for identification purposes in the assertion.

### NameID property mapping

In authentik, it's possible to configure which property mapping will be used to create the NameID value. The **NameID Property Mapping** field on a SAML provider can be set to any property mapping that's enabled on a SAML provider. When left empty, the NameID Policy of the incoming SP request will be respected.

### Default NameID policy

In authentik, it's also possible to configure the default SAML NameID policy used for IDP-initiated logins or when an incoming SP assertion doesn't specify a NameID policy (also applies when using a custom NameID Mapping). The following table outlines how NameID policies are handled:

| Default NameID policy                                                            | How authentik will handle the NameID                                                                                                                                                                  |
| -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Persistent - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`              | NameID will be set to the user's hashed ID.                                                                                                                                                           |
| x509 Subject - `urn:oasis:names:tc:SAML:2.0:nameid-format:X509SubjectName`       | NameID will be set to the user's `distinguishedName` attribute. This attribute is set by the LDAP source by default. If the attribute does not exist, it will fall back to the persistent identifier. |
| Windows - `urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName` | NameID will be set to the user's UPN. This is also set by the LDAP source, and also falls back to the persistent identifier.                                                                          |
| Transient - `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`                | NameID will be set based on the user's session ID.                                                                                                                                                    |
| Email address - `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`         | NameID will be set to the user's email address.                                                                                                                                                       |

By default, users are free to change their email addresses. Therefore, it is recommended to either: avoid using a user's email address as the NameID attribute or, if possible, disallow changing email addresses.

## ForceAuthn2026.8

An SP can set the `ForceAuthn` attribute on its `AuthnRequest` to require that the user authenticates again, even when they already have a valid authentik session.

authentik honors this attribute. When an incoming `AuthnRequest` sets `ForceAuthn="true"`, the user is sent through the provider's authentication flow before the SSO flow continues. If the provider does not have an authentication flow configured, authentik uses the authentication flow configured for the associated brand. This behaves similarly to `prompt=login` for OAuth 2.0 and OpenID Connect providers. Once the user has re-authenticated, the SSO flow proceeds normally.

This requires no configuration on the provider, and it applies to any SP that sets the attribute. If users of an existing application are prompted to sign in again more often after upgrading to 2026.8, check whether that SP sets `ForceAuthn`.

## AuthnContextClassRef

The AuthnContextClassRef attribute appears in the SAML assertion and contains a URI that describes the assurance level, such as password, multi-factor, or smartcard authentication. SPs use this information to understand and verify how the user was authenticated by an IdP.

In authentik, it's possible to set the AuthnContextClassRef attribute to any property mapping that's enabled on a SAML provider. This is done via the **AuthnContextClassRef Property Mapping** on a SAML provider.

Alternatively, when the **AuthnContextClassRef Property Mapping** field is left unpopulated on a SAML provider, the AuthnContextClassRef will be set based on the method that the user authenticated with.

---

## SAML Single Logout

[Single Logout (SLO)](../single-logout/index.mdx) allows authentik to log out users from all configured providers simultaneously when they sign out of authentik. For SAML providers, this requires your service provider to support Single Logout via a Single Logout Service URL. Check your provider's documentation to confirm Single Logout support.

## Configure your SAML provider

To enable single logout, add a **Single Logout Service URL** to your SAML provider. The URL is the service provider’s endpoint to which authentik sends logout requests.

1. Log in to authentik as an administrator and open the authentik Admin interface
2. Navigate to **Applications** > **Providers**
3. Click the edit icon of the SAML provider that you want to configure for SLO
4. Set the **SLS URL** field to your service provider's logout endpoint
5. Select the appropriate **SLS Binding**:
   - **Redirect** - Uses HTTP redirects to send logout requests to the provider (front-channel only)
   - **POST** - Supports both front-channel and back-channel logout methods
6. Select the appropriate **Logout Method**:
   - **Front-channel iframe** - Performs parallel logout requests using hidden iframes. Supports both Redirect and POST bindings
   - **Front-channel native** - Uses the active browser tab to chain redirects and POST requests for sequential logout. Supports both Redirect and POST bindings
   - **Back-channel** - Performs server-to-server POST requests to log out the user. Requires POST SLS binding. Users are logged out even when their session is administratively terminated
7. (Optional) Enable **Sign Logout Request** to cryptographically sign SAML logout requests sent to the service provider
8. Click **Finish**

Back-channel logout ensures users are logged out even when their session is terminated administratively (e.g., when a user is deactivated or their session is deleted). This requires POST SLS binding.

## SP-initiated Single Logout

SAML Service Providers can initiate logout by sending a SAML logout request to authentik. By default, only that Service Provider's session is ended while the authentik session remains active and the user stays logged in to other applications.

For instructions on how to trigger full Single Logout when a user logs out from a Service Provider, see [Choose the logout behavior for a provider](../single-logout/index.mdx#choose-the-logout-behavior-for-a-provider).

## How SAML Single Logout Works

When a user logs out of authentik through a logout flow, authentik initiates the single logout process for all SAML providers configured with an SLS URL and logout method.

### Front-channel iframe logout

With front-channel iframe logout, authentik injects an iframe logout stage into the logout flow. This stage loads all provider logout URLs simultaneously in hidden iframes within the browser, allowing parallel logout across multiple providers. After all iframes complete their requests, the user continues through the authentik logout flow.

### Front-channel native logout

With front-channel native logout, authentik chains logout requests sequentially using the active browser tab. For POST bindings, the browser automatically submits forms to each provider. For Redirect bindings, the browser follows redirect URLs. Each provider returns the user to authentik who redirects to the next provider. After all providers have been visited, the user completes the authentik logout flow.

### Back-channel logout

With back-channel logout, authentik sends SAML logout requests directly from the server to each provider's SLS URL via HTTP POST. This happens asynchronously and does not require browser interaction. Back-channel logout is also triggered automatically when:

- A user's session is administratively deleted.
- A user account is deactivated.

Back-channel logout requires POST SLS binding.

## Binding Comparison

| Feature              | Redirect Binding      | POST Binding             |
| -------------------- | --------------------- | ------------------------ |
| Front-channel iframe | ✅ Supported           | ✅ Supported              |
| Front-channel native | ✅ Supported           | ✅ Supported              |
| Back-channel         | ❌ Not supported       | ✅ Supported              |
| Request sent via     | URL query parameters  | HTTP POST body           |
| Maximum data size    | Limited by URL length | Large requests supported |

## SAML session tracking

authentik tracks SAML sessions for each provider to support single logout. When a user successfully authenticates to a SAML provider, authentik creates a `SAMLSession` record containing:

- The SAML `SessionIndex`
- The `NameID` and `NameID format` used for the session
- A link to the user's authenticated session

These session records are used to generate proper SAML logout requests with the correct `SessionIndex` and `NameID` values that the service provider expects.

## Resources

- [Single Logout (SLO) Overview](../single-logout/index.mdx)
- [User Logout Stage](../../flows-stages/stages/user_logout/index.mdx)
- [SAML Profiles 2.0 Specification](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)

---

## Create a SCIM provider

## Create a SCIM provider with token authentication

To create a provider along with a corresponding application, navigate to **Applications** > **Applications** and click **New Application**. We recommend this combined approach for most common use cases. Alternatively, you can use the legacy method to solely create the provider by navigating to **Applications** > **Providers** and clicking **New Provider**.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair.
3. On the **Application** page, define the application settings, and then click **Next**.
4. Select **SCIM** as the **Provider Type**, and then click **Next**.
5. On the **Configure Provider** page, provide the configuration settings, and then click **Next**.
6. On the **Configure Bindings** page, click **Next**.
7. Click **Create** to create both the application and the provider.

### Set the SCIM provider as a backchannel provider for the application

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click the edit icon of the new SCIM application.
3. Click the plus icon (+) next to **Backchannel Providers**.
4. Select the new SCIM provider, and then click **Confirm**.
5. Click **Save changes**.

## Create a SCIM provider with OAuth authentication

There are 3 required steps to creating a SCIM provider:

1. [Create an OAuth source](#create-an-oauth-source)
2. [Create a SCIM application and provider](#create-a-scim-application-and-provider)
3. [Set the SCIM provider as a backchannel provider for the application](#set-the-scim-provider-as-a-backchannel-provider-for-the-application)

If using OAuth (Interactive) mode, you will also need to:

4. [Provide admin authorization](#provide-admin-authorization-oauth-interactive-mode-only)

### Create an OAuth source

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login** and click **New Source**.
3. Select **OpenID OAuth Source** as the **Source type**.
4. On the **OpenID OAuth Source Details** page, provide the configuration settings provided by the SCIM endpoint that you are provisioning to, and then click **Create**.

### Create a SCIM application and provider

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair.
3. On the **Application** page, define the application settings, and then click **Next**.
4. Select **SCIM** as the **Provider Type**, and then click **Next**.
5. On the **Configure Provider** page, configure the required settings. Set **Authentication Mode** to the desired OAuth option, select the **OAuth Source** you created in the previous section, and then click **Next**.
6. On the **Configure Bindings** page, click **Next**.
7. Click **Create** to create both the application and the provider.

### Set the SCIM provider as a backchannel provider for the application

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click the edit icon of the new SCIM application.
3. Click the plus icon (+) next to **Backchannel Providers**.
4. Select the new SCIM provider, and then click **Confirm**.
5. Click **Save changes**.

### Provide admin authorization (OAuth Interactive mode only)

If you selected **OAuth (Interactive)** as the **Authentication Mode** for the SCIM provider, you will need to authorize the initial OAuth connection.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click the name of the new SCIM provider.
3. Next to **OAuth Status**, click **(Re-)Authenticate**.
4. You should be redirected to the SCIM endpoint that you are provisioning to for authentication.
5. After you authenticate, you should be redirected back to authentik. If successful, **OAuth Status** should now show as **Authenticated**.
   This step is only required when initially configuring the SCIM provider; subsequent authentications will be automatic.

---

## SCIM Provider

SCIM (System for Cross-domain Identity Management) is a set of APIs to provision users and groups. The SCIM provider in authentik supports SCIM 2.0 and can be used to provision and sync users from authentik into other applications.

A SCIM provider requires a SCIM base URL for the endpoint and an authentication token. SCIM works via HTTP requests, so authentik must be able to reach the specified endpoint. This endpoint usually ends in `/v2`, which corresponds to the SCIM version supported.

SCIM providers in authentik always serve as [backchannel providers](../../applications/manage_apps.mdx#backchannel-providers), which are used in addition to the main provider that supplies SSO authentication. A backchannel provider is used for an application that requires backend authentication, directory synchronization, or other additional authentication needs.

For instructions on creating a SCIM provider, refer to the [Create a SCIM provider](./create-scim-provider.mdx) documentation.

## Authentication modes

In authentik, there are two ways to authenticate SCIM requests:

- **Static token** provided by the application. This is the default authentication mode.
- **OAuth token** that authentik retrieves from a specified source and uses for authentication.

### Static token

When the authentication mode is set to **Static token**, authentik sends the token provided by the application with outgoing SCIM requests to authenticate each request.

### OAuth token :ak-enterprise {#oauth-token}

When you configure a SCIM provider to use OAuth for authentication, authentik generates short-lived tokens through an OAuth flow and sends them to the SCIM endpoint. This offers improved security and control compared with a static token.

authentik supports two types of SCIM OAuth authentication:

- **Silent OAuth** – The system obtains or refreshes access tokens automatically, without any administrator interaction. This is the typical approach used for ongoing SCIM provisioning.

- **Interactive OAuth** – During setup, an administrator is required to authorize the connection before the SCIM integration can obtain its initial token. authentik then stores a refresh token, and provisioning then runs in the background without further admin interaction.

You can also add additional token request parameters such as `grant_type`, `subject_token`, or `client_assertion`.

**Example**:

- `grant_type: client_credentials`
- `grant_type: password`

To use OAuth authentication for your application, create and connect an [OAuth source](../../../users-sources/sources/protocols/oauth/).

## Sync behavior

SCIM data is synchronized in two ways:

- When a user or group is created, modified, or deleted, that change is sent to all SCIM providers.
- Once an hour, all SCIM providers are fully synchronized.

The synchronization process runs in the authentik worker. To improve scalability, authentik starts a task for each batch of 100 users or groups, so the workload can be distributed across multiple workers.

### Attribute mapping

Attribute mapping from authentik to SCIM users is done through property mappings, as with other providers. The default mappings for users and groups work for many setups, but you can define custom mappings to add fields.

All selected mappings are applied in the order of their name, and are deeply merged onto the final user data. The final data is then validated against the SCIM schema, and if the data is not valid, the sync is stopped.

Property mappings are evaluated in name order. If a property mapping fails to evaluate, authentik stops the synchronization and does not evaluate the remaining mappings.

### Custom attributes and schemas

To send attributes in a custom SCIM schema extension, [create or edit a SCIM provider property mapping](../property-mappings/#create-a-custom-provider-property-mapping), then add it to the SCIM provider's **User Property Mappings**.

The property mapping must return both the extension schema URN in `schemas` and the object for that schema. For example, to send a standard work phone number and a custom `github` attribute from a user's authentik attributes, use the following code:

```python
CUSTOM_SCHEMA = "urn:ietf:params:scim:schemas:extension:custom:2.0:User"

return {
    "schemas": [CUSTOM_SCHEMA],
    "phoneNumbers": [
        {
            "primary": True,
            "value": request.user.attributes.get("phone", ""),
            "type": "work",
        }
    ],
    CUSTOM_SCHEMA: {
        "github": request.user.attributes.get("github", ""),
    },
}
```

Use the schema URN and field names expected by the target SCIM service. If the remote service supports only a fixed set of schemas or filters unknown attributes from responses, the attribute might not appear even when authentik sends it.

#### Skip objects during synchronization

To exclude specific users or groups from SCIM synchronization, you can create a property mapping that raises the `SkipObject` exception. When this exception is raised during the evaluation of a property mapping, the object is skipped and the sync continues with the next object.

For more information, refer to [Skip objects during synchronization](../property-mappings/#skip-objects-during-synchronization).

## Filter the sync scope

You can limit which users and groups a SCIM provider synchronizes. User filtering and group filtering are configured separately.

### User filtering

Users that are synchronized via a SCIM provider are controlled through application access policies. When a SCIM provider is configured as a backchannel provider for an application, only users who are bound to that application are synchronized. A common setup is to bind a group to the SCIM application so that all members of that group are synchronized to the target SCIM endpoint.

If no users are bound to the SCIM application, the SCIM provider synchronizes all users.

When a user is no longer assigned to the application—either directly or through a group—and a SCIM sync task runs, that user is deprovisioned from the target SCIM endpoint.

Use **Exclude service accounts** in the SCIM provider settings when you do not want service accounts to be synchronized.

### Group filters

Group filters define the synchronization scope for groups. Group filters apply only to groups. They do not limit which users are synchronized.

If no group filters are selected, the SCIM provider synchronizes all groups.

If group filters are selected, only the selected groups are synchronized.

Changing the selected group filters does _not_ remove groups or memberships that were synchronized previously.

## Compatibility modes

Compatibility modes adjust authentik behavior for vendor-specific SCIM implementations.

Available compatibility modes are:

- **Default**: Standard SCIM 2.0 implementation
- **AWS**: Disables PATCH operations for AWS Identity Center compatibility
- **Slack**: Enables filtering support for Slack's SCIM implementation
- **Salesforce**: Uses the non-standard `/ServiceProviderConfigs` endpoint
- **GitLab**: Skips the `ServiceProviderConfig` endpoint because GitLab's SCIM implementation does not expose it
- **Webex**: Uses the vendor-specific behavior required for Webex SCIM
- **vCenter**: Skips the `ServiceProviderConfig` endpoint, which is not implemented in VMware vCenter

To configure a compatibility mode, select the appropriate option in the **SCIM Compatibility Mode** field when creating or editing a SCIM provider.

## Remote service capabilities

SCIM defines several optional settings that allow clients to discover a service provider's supported features. In authentik, the [`ServiceProviderConfig`](https://datatracker.ietf.org/doc/html/rfc7644#section-4) endpoint provides support for the following options (if the option is supported by the service provider).

The `ServiceProviderConfig` is cached for 1 hour after it is fetched. The cache is automatically cleared when the SCIM provider is updated (such as when changing the compatibility mode).

- Filtering

    When the remote system supports [filtering](https://datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2), authentik uses that operation to match remote users and groups to existing authentik users and groups.

- Bulk

    The [`bulk`](https://datatracker.ietf.org/doc/html/rfc7644#section-3.7) configuration enables clients to send large collections of resource operations in a single request. If the remote system sets this attribute, authentik will respect the `maxOperations` value to determine the maximum number of individual operations a server can process within a single bulk request.

- Patch updates

    If the service provider supports [PATCH updates](https://datatracker.ietf.org/doc/html/rfc7644#section-3.5.2), authentik will use patch requests to add/remove members of groups. For all other updates, such as user updates and other group updates, PUT requests are used.

### Using in conjunction with other providers

Many applications support SCIM together with another SSO protocol such as OAuth/OIDC or SAML. With default settings, the unique user IDs in SCIM and other protocols are identical, which makes it easier for applications to link provisioned users with users who log in through SSO.

Applications can either match users on a unique ID sent by authentik called `externalId`, by their email or username.

#### OAuth/OIDC

The default provider configuration for the _Subject mode_ option of _Based on the User's hashed ID_ matches the `externalId` that's generated by default. If any other _Subject mode_ is selected, the `externalId` attribute can be customized via SCIM mappings.

#### SAML

The SAML NameID policy _urn:oasis:names:tc:SAML:2.0:nameid-format:persistent_ uses the same unique user identifier as the default `externalId` value used by the SCIM provider. If a SAML application does not send a NameID request, this value is also used as fallback.

---

## Single Logout (SLO)

Single Logout (SLO) is a security feature that logs users out of all active applications when they log out of authentik. It uses the OAuth2/OpenID Connect front-channel and back-channel logout specifications in combination with SAML's Single Logout specification.

For example, if a user is concurrently logged into an OIDC application and two SAML applications, when the user logs out of authentik, they will automatically be logged out of all three applications. Without SLO configured, users with active sessions across multiple applications would need to manually log out of each one.

Check with your service provider to see if they support SAML Single Logout or OIDC front-channel/back-channel logout. Not all service providers support these features.

## When Single Logout is triggered

Single Logout behavior depends on where the user initiates logout:

- **Logout from authentik**: When a user logs out directly from authentik, the `default-invalidation-flow` runs. This flow includes a [User Logout stage](../../flows-stages/stages/user_logout/index.mdx) that ends the user's authentik session and triggers Single Logout for all connected applications.

- **Logout from an application**: When a user logs out from an OIDC or SAML application, the invalidation flow that is selected on the provider runs. By default, this is the `default-provider-invalidation-flow`, which does **not** include a User Logout stage, so only that application's session is ended while the user's authentik session and other application sessions remain active.

For instructions on how to enable full Single Logout when a user logs out from an application, see [Choose the logout behavior for a provider](#choose-the-logout-behavior-for-a-provider) below.

## How Single Logout works in authentik

When a user logs out or their session is terminated in authentik, the following process occurs:

1. **Session Termination**: The user's session ends through one of the following:
   - User-initiated logout via a logout flow
   - Administrative action (session deletion or user deactivation)
   - Token revocation or expiration
2. **Provider Identification**: authentik identifies all OAuth2/OIDC and SAML providers with active sessions for the users who have SLO configured.
3. **Logout Request Dispatch**:
   - **Back-channel**: HTTP POST requests are sent directly from the authentik server to each back-channel provider's configured logout endpoint.
   - **Front-channel**: For user-initiated logouts, a logout stage is automatically injected into the flow that handles browser-based logout (typically via iframes or sequential redirects).
4. **Provider Processing**: Each provider processes the logout request, validates it, and terminates the user's active session.
5. **Completion**: After all providers have been notified, the user is redirected back to the authentik login screen.

## Front-channel vs. back-channel logout

authentik supports both front-channel (browser-based) and back-channel (server-to-server) logout methods, depending on how each provider is configured.

### Front-channel logout

Front-channel logout sends logout requests through the user's browser. authentik supports two front-channel modes:

#### iframe mode (default for OIDC)

- Loads all provider logout URLs simultaneously in hidden iframes
- Provides fast, parallel logout across multiple providers
- Required by the OIDC front-channel logout specification
- Most SAML providers also support iframe-based logout

#### Native Mode (SAML Only)

- Uses the active browser tab to chain redirects and POST requests sequentially
- Provides better compatibility with SAML providers that have iframe restrictions
- Each provider redirects the user back to authentik before proceeding to the next provider
- Not available for OIDC providers as the specification requires iframe support

Use native front-channel mode for SAML providers if you encounter iframe compatibility issues, such as Content Security Policy (CSP) restrictions or cookie handling problems.

### Back-channel Logout

Back-channel logout sends logout requests directly from the authentik server to each provider's logout endpoint via HTTP POST.

- Does not require user browser interaction
- Works even when the user is offline or their browser is closed
- Is automatically triggered by administrators terminating a user session (user deactivation or session deletion)
- Requires the provider to accept server-to-server POST requests

**For SAML**: Requires POST SLS binding.
**For OIDC**: Requires a `logout_uri` configured for back-channel that accepts logout tokens.

## Choose the logout behavior for a provider

When a user logs out from an application, authentik runs the flow that is selected in the **Invalidation Flow** field of that application's provider. The flow that you select determines whether only the application session ends, or whether the user is also logged out of authentik and all other applications.

authentik includes two default invalidation flows that you can select for each provider:

| Invalidation flow                    | Behavior when the user logs out from the application                                                                                                                                         |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `default-provider-invalidation-flow` | Only the session of that application ends. The user's authentik session and their sessions in other applications remain active. This flow is selected by default for new providers.          |
| `default-invalidation-flow`          | Full Single Logout. The flow includes a [User Logout stage](../../flows-stages/stages/user_logout/index.mdx), which ends the user's authentik session and logs them out of all applications. |

To choose the logout behavior for a provider, follow these steps:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers**.
3. Click the **Edit** icon of the provider that you want to configure.
4. Under **Advanced flow settings**, select a flow in the **Invalidation Flow** field:
   - To only end the application session, select `default-provider-invalidation-flow`.
   - To enable full Single Logout, select `default-invalidation-flow`.
5. Click **Update**.

Because the flow is selected per provider, you can enable full Single Logout only for sensitive applications and keep the default behavior for others.

## Enable Single Logout

Enabling single logout requires configuring logout endpoints on your SAML or OIDC providers in authentik.

### SAML Providers

See the [SAML Single Logout documentation](../saml/saml_single_logout.mdx) for detailed instructions. You will need to:

1. Configure the **SLS URL** (Single Logout Service URL) - the provider's logout endpoint
2. Select the **SLS Binding** (Redirect or POST)
3. Choose a **Logout Method**; front-channel iframe, front-channel native, or back-channel
4. Optionally, enable **Sign Logout Request** for additional security

### OIDC providers

See the [OIDC Front-channel and Back-channel logout documentation](../oauth2/frontchannel_and_backchannel_logout.mdx) for detailed instructions. You will need to:

1. Configure the **Logout URI** - the provider's logout endpoint
2. Enable the desired **Logout Method**; front-channel or back-channel
3. Optionally configure logout token signing for back-channel requests

## Session tracking

authentik tracks provider sessions to enable single logout:

- **SAML**: Creates `SAMLSession` records containing the `SessionIndex`, `NameID`, and `NameID format` for each successful authentication.
- **OIDC**: Tracks session identifiers (`sid`) and ID tokens required for logout requests.

These session records are automatically created during authentication and deleted after logout or expiration.

## Administrative session termination

Back-channel logout is always triggered when a user session is terminated via administrative actions:

- **Session Deletion**: When an administrator manually deletes a user's session through the Admin interface or API, authentik sends back-channel logout requests to all configured providers.
- **User Deactivation**: When a user account is deactivated, authentik automatically sends back-channel logout requests to terminate all active sessions across all providers.

These requests are processed asynchronously to avoid blocking administrative operations.

## Resources

- [SAML Single Logout](../saml/saml_single_logout.mdx)
- [OIDC Front-channel and Back-channel Logout](../oauth2/frontchannel_and_backchannel_logout.mdx)
- [User Logout Stage](../../flows-stages/stages/user_logout/index.mdx)
- [SAML Profiles 2.0 Specification](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)
- [OpenID Connect Front-Channel Logout 1.0](https://openid.net/specs/openid-connect-frontchannel-1_0.html)
- [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html)

---

## Configure an SSF provider

Follow this workflow to create and configure an SSF provider for an application:

1. Create the SSF provider (which serves as the [backchannel provider](../../applications/manage_apps.mdx#backchannel-providers)).
2. Create an OIDC provider (which serves as the protocol provider for the application).
3. Create the application, and assign both the OIDC provider and the SSF provider.

## Create the SSF provider

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **New Provider** to create a provider.
3. Select **Shared Signals Framework Provider** as the **Provider Type**, and then click **Next**.
4. On the **New SSF Provider** page, provide the configuration settings. Be sure to select a **Signing Key**.
5. Click **Finish** to create the provider.

## Create the OIDC provider

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Providers** and click **New Provider** to create a provider.
3. Select **OAuth2/OpenID Provider** as the **Provider Type**, and then click **Next**.
4. On the **New OAuth2/OpenID Provider** page, provide the configuration settings and then click **Finish** to create the provider.

## Create the application

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications** > **Applications** and click **New Application** to create an application.
3. Configure the following required settings for the application:
   - **Name**: provide a descriptive name of the application.
   - **Slug**: provide the application slug used in URLs.
   - **Provider**: select the OIDC provider that you created.
   - **Backchannel Providers**: select the SSF provider that you created.
4. Click **Create** to save the new application.

The new application, with its OIDC provider and the backchannel SSF provider, should now appear in your application list.

---

## Shared Signals Framework (SSF) Provider

The Shared Signals Framework (SSF) provider allows you to integrate applications with the Shared Signals Framework protocol.

SSF is a common standard for sharing asynchronous real-time security signals and events across multiple applications and an identity provider. The framework is a collection of standards and communication processes, documented in a [specification](https://openid.net/specs/openid-sharedsignals-framework-1_0-ID3.html). SSF leverages the APIs of the application and the IdP, using privacy-protected and secure webhooks.

The authentik SSF provider allows OIDC applications to subscribe to certain types of security signals (which are then translated into SETs, or Security Event Tokens) that are captured by authentik (the IdP), and then the application can respond to each event. In this scenario, authentik acts as the *transmitter* and the application acts as the *receiver* of the events.

Events in authentik that are tracked via SSF include when an MFA device is added or removed, logouts, sessions being revoked by Admin or user clicking logout, or credentials changed.

Refer to our documentation to learn how to [create a SSF provider](./create-ssf-provider.mdx).

## Example use cases

One important use case for SSF is to [integrate Apple Business Manager](https://integrations.goauthentik.io/device-management/apple/) or any of the Apple device management platforms with authentik, so that users can enroll their Apple devices using their authentik credentials. When a user signs in with their email address, Apple redirects them to authentik for authentication. After authentication, Apple enrolls the user's device and grants access to Apple services.

Another use case for SSF is when an administrator wants to know when a user logs out of authentik, so that the user is then also automatically logged out of all other work-focused applications.

Another example use case is when an application uses SSF to subscribe to authorization events because the application needs to know if a user changed their password in authentik. If a user did change their password, then the application receives a POST request to write the fact that the password was changed.

## Use the authentik SSF provider

The SSF provider serves as a [backchannel provider](../../applications/manage_apps#backchannel-providers). Backchannel providers are used to augment the functionality of the main provider for an application.

Therefore you still need to [create a typical OIDC application/provider pair](../../applications/manage_apps#create-an-application-and-provider-pair), and when creating the application, assign the SSF provider as a [backchannel provider](../../applications/manage_apps#backchannel-providers).

When an authentik administrator [creates an SSF provider](./create-ssf-provider), they need to configure both the application (the receiver) and authentik (the IdP and the transmitter).

### The application (the receiver)

Within the application, the administrator creates an SSF stream which lists all the signals that the application wants to subscribe to, and defines the audience (`aud`), which is the URL that identifies the stream. A stream is basically an API request to authentik, which asks for a POST of all events. How that request is sent varies from application to application. An application can also change or delete the stream.

authentik does not specify which events to subscribe to; instead the application defines which events they want to listen for.

### authentik (the transmitter)

To configure authentik as a shared signals transmitter, the authentik administrator [creates a new SSF provider](./create-ssf-provider), to serve as the backchannel provider for the application.

When creating the SSF provider you will need to select a signing key that is used to sign the Security Event Tokens (SET).

Optionally, you can specify an event retention time period, which determines how long events are stored for. If an event could not be sent correctly, and retries occur, the event's expiration is also increased by this duration.

Be aware that the SET events are different events than those displayed in the authentik Admin interface under **Events**.

---

## Create a WS-Federation provider

An authentik WS-Federation provider is typically created as part of an application/provider pair, using the steps below. You can also create a standalone provider, and then later assign an application to use it.

## Create a WS-Federation provider and application pair

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications > Applications** and click **New Application** to create an application and provider pair.
3. On the **New application** page, define the application details, and then click **Next**.
4. Select **WS-Federation Provider** as the **Provider Type**, and then click **Next**.
5. On the **Configure WS-Federation Provider** page, provide a name for the provider, select an authorization flow, and the two required configuration settings:
   - **Reply URL**: Enter the application callback URL, where the token should be sent. This is the specific endpoint on an RP (application) where an Identity Provider (STS) sends the security token and authentication response after a successful login.
   - **Realm**: Enter the identifier (string) of the requesting realm; that is, the Relying Party (RP) or application receiving the token. Realm is similar to the SAML 2.0 Entity ID.
6. Under **Advanced protocol settings**, optionally set the **SAML assertion version**. This defaults to SAML 2.0; select SAML 1.1 if the relying party requires it, such as Microsoft Entra ID or a classic ADFS-style integration.
7. Click **Create Application** to create both the application and the provider.

## Export authentik WS-Federation provider metadata

After an authentik WS-Federation provider has been created via any of the above methods, you can access its metadata in one of two ways:

### Download authentik metadata for a WS-Federation provider

To download the metadata of an authentik WS-Federation provider, follow these steps:

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications > Providers**.
3. Click the name of the provider you want metadata for.
4. On the **Overview** tab, in the **Related objects** section, click on **Download** under **Metadata**. This will download the metadata XML file for that provider.

### Access the Metadata tab for a WS-Federation provider

To view and optionally download the metadata of an authentik WS-Federation provider, follow these steps:

1. Log in to authentik as an administrator, and open the authentik Admin interface.
2. Navigate to **Applications > Providers**.
3. Click the name of the provider you want metadata for, and then click the **Metadata** tab.
4. The metadata for the provider will be shown in a code box. You can optionally use the **Download** button to obtain the metadata as a file.

---

## WS-Federation Provider

The WS-Federation provider is used to integrate with applications and service providers that use [WS-Federation protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adfsod/204de335-ea34-4f9b-ae73-8b7d4c8152d1). WS-Federation is an XML-based identity federation protocol that uses token exchange for federated Single Sign-On (SSO) and IdP authentication, specifically for Windows applications such as SharePoint.

There are similarities between WS-Federation and SAML protocols, but there are several key differences in terminology, most importantly:

- WS-Federation term: **STS (Security Token Service)**
- SAML term: **IdP (Identity Provider)**

Note that we only support the SAML2 token type within WS-Federation providers, and that using the WS-Federation provider with Entra ID is not supported because Entra ID requires a SAML 1.0 token.

## Supported URL request parameters

The following URL request parameters are supported in the authentik WS-Federation provider:

- **`wa`**: This is a required parameter that represents the action being requested, typically `wsignin1.0` for signing in. The parameter's value tells the Security Token Service (STS) which operation to execute.
- **`wtrealm`**: The unique identifier (realm) of the Relying Party (RP) or application requesting the security token, for example, urn\:my-app. It defines the trust relationship between the RP and the Identity Provider (IdP) and indicates which application is initiating the WS-Federation request. This is a required query parameter that tells the Security Token Service (STS) which relying party the token is intended for.
- **`wreply`**: The target URL to which the Identity Provider (IdP) sends the WS-Federation response containing the security token. This URL is supplied by the Service Provider (SP). authentik verifies that the received `wreply` parameter matches the URL configured by the administrator and stored in the database.
- **`wctx`**: A context value that is used to maintain state between the Relying Party (RP) and the Identity Provider (IdP) across redirects. It serves the same purpose as the `RelayState` parameter in SAML. The RP includes this value in the authentication request, and the IdP returns it unchanged in the response, allowing the RP to validate and restore the original session or request context.

## WS-Federation bindings and endpoints

*Bindings* define how an Identity Provider (IdP) and the WS-Federation STS (Security Token Service), or IdP in SAML terms, communicate; how messages are transported over network protocols, specifying transport (like HTTP), encoding, and security detail that allow WS-Federation to facilitate secure identity sharing across systems. Both the IdP and STS define various endpoints in their metadata, each associated with a specific WS-Federation binding.

| Endpoint | URL                   |
| -------- | --------------------- |
| SSO/SLO  | `/application/wsfed/` |

## WS-Federation metadata

Using metadata ensures that WS-Federation single sign-on works reliably by exchanging and maintaining identity and connection information. WS-Federation metadata is an XML document that defines how IdPs and SPs securely interact for authentication. It includes information such as endpoints, bindings, certificates, and unique identifiers. The metadata is what you provide the application to configure it for authenticating with authentik.

You can [export WS-Federation metadata](./create-wsfed-provider.mdx#export-authentik-ws-federation-provider-metadata) from an authentik WS-Federation provider to an STS to automatically provide important endpoint and certificate information to the SP.

## Certificates

The certificates used with WS-Federation to sign Request Security Token Response (RSTR), which contains the assertion, are the same certificates that are used by SAML.

For details, refer to our [SAML certificates documentation](../saml/index.mdx#certificates).

## WS-Federation property mappings

Property mappings are used during the authentication process to align, or "map", user attributes values between the SP and STS (Security Token Service), the latter being the equivalent of SAML's IdP.

The same property mappings that are used in WS-Federation are used in SAML. For details, refer to our [SAML property mapping documentation](../saml/index.mdx#certificates).

## Attributes for WS-Federation

WS-Federation and SAML also share the use of the [NameID](../saml/index.mdx#nameid) and the [AuthnContextClassRef](../saml/index.mdx#authncontextclassref) attributes.

---

## Access Token



---

## Assertion Consumer Service (ACS)



---

## Application



---

## Audience (aud)



---

## Authorization code



---

## Authorization endpoint



---

## Authorization Server (AS)



---

## Back-channel logout



---

## Back-channel



---

## Blueprints



---

## Brand



---

## Claim



---

## Dynamic in-memory stage



---

## Entity ID



---

## Flow



---

## Front-channel logout



---

## Front-channel



---

## Grant type



---

## ID token



---

## Identity Provider (IdP)



---

## IdP-initiated SSO



---

## Introspection endpoint



---

## Issuer (iss)



---

## JWK



---

## JWKS



---

## JWT



---

## Base DN



---

## Bind DN



---

## Distinguished Name (DN)



---

## LDAP search filter



---

## ObjectClass



---

## LDAP



---

## NameID



---

## Notification rule



---

## OIDC discovery document



---

## OpenID Provider (OP)



---

## Outpost



---

## Passkey



---

## PKCE



---

## Policy



---

## Property mappings



---

## Provider



---

## RADIUS auth methods



---

## RADIUS messages



---

## Network Access Server (NAS)



---

## RADIUS shared secret



---

## Vendor‑Specific Attribute (VSA)



---

## RADIUS



---

## Redirect URI



---

## Refresh token



---

## Relying Party (RP)



---

## Response type



---

## Revocation endpoint



---

## SAML assertion



---

## SAML binding



---

## SCIM endpoints (Users, Groups)



---

## SCIM externalId



---

## SCIM provisioning lifecycle



---

## SCIM PATCH



---

## SCIM resource



---

## SCIM



---

## Scope



---

## Service Provider (SP)



---

## Single Logout (SLO)



---

## Source



---

## SP-initiated SSO



---

## Stage



---

## Subject (sub)



---

## System tasks



---

## Token endpoint



---

## UserInfo endpoint



---

## WebAuthn



---

## Example

This is one of the default packaged blueprints to create the default authentication flow.

<!-- prettier-ignore-start -->
```yaml
version: 1
metadata:
    name: Default - Authentication flow
entries:
    # Order of entries is important when using !KeyOf, as tags are evaluated in order they are in
    # the document
    - attrs:
          # Only options that are required should be set here. Default values should not be stated
          # here, as they will prevent anyone from overwriting the value
          designation: authentication
          name: Welcome to authentik!
          title: Welcome to authentik!
      identifiers:
          slug: default-authentication-flow
      model: authentik_flows.flow
      id: flow
    - attrs:
          configure_flow:
              !Find [authentik_flows.flow, [slug, default-password-change]]
      identifiers:
          name: default-authentication-password
      id: default-authentication-password
      model: authentik_stages_password.passwordstage
    - identifiers:
          name: default-authentication-mfa-validation
      # If we're fine with all defaults, `attrs` can be omitted
      id: default-authentication-mfa-validation
      model: authentik_stages_authenticator_validate.authenticatorvalidatestage
    - identifiers:
          name: default-authentication-identification
      id: default-authentication-identification
      model: authentik_stages_identification.identificationstage
    - attrs:
          session_duration: seconds=0
      identifiers:
          name: default-authentication-login
      id: default-authentication-login
      model: authentik_stages_user_login.userloginstage
    - identifiers:
          order: 10
          stage: !KeyOf default-authentication-identification
          target: !KeyOf flow
      model: authentik_flows.flowstagebinding
    - identifiers:
          order: 20
          stage: !KeyOf default-authentication-password
          target: !KeyOf flow
      model: authentik_flows.flowstagebinding
    - identifiers:
          order: 30
          stage: !KeyOf default-authentication-mfa-validation
          target: !KeyOf flow
      model: authentik_flows.flowstagebinding
    - identifiers:
          order: 100
          stage: !KeyOf default-authentication-login
          target: !KeyOf flow
      model: authentik_flows.flowstagebinding
```
<!-- prettier-ignore-end -->

---

## Meta models

# Meta models

Since blueprints have a pretty strict mapping of each entry to an instance of a model in the database, *meta models* exist to trigger other actions within authentik that don't directly map to a model.

### `authentik_blueprints.metaapplyblueprint`

This meta model can be used to apply another blueprint instance within a blueprint instance. This allows for dependency management and ensuring related objects are created.

See [examples](https://github.com/search?q=repo%3Agoauthentik%2Fauthentik+path%3A%2F%5Eblueprints%5C%2F%2F+metaapplyblueprint\&type=code) in the default blueprints for more information.

#### Attributes

- `identifiers`: Key-value attributes used to match the blueprint instance

  Example:

  ```yaml
  attrs:
      identifiers:
          name: Default - Password change flow
  ```

- `required`: (Default: `true`) Configure if the blueprint instance must exist

  If this is set to `true` and no blueprint instance matches the query above, an error will be thrown. Otherwise, execution will continue without applying anything extra.

---

## Models

# Models

Some models behave differently and allow for access to different API fields when created via blueprint.

## `authentik_core.token`

### `key`

Via the standard API, a token's key cannot be changed, it can only be rotated. This is to ensure a high entropy in its key, and to prevent insecure data from being used. However, when provisioning tokens via a blueprint, it may be required to set a token to an existing value.

With blueprints, the field `key` can be set, to set the token's key to any value.

For example:

```yaml
# [...]
- model: authentik_core.token
  state: present
  identifiers:
      identifier: my-token
  attrs:
      key: this-should-be-a-long-value
      user: !KeyOf my-user
      intent: api
```

## `authentik_core.user`

### `password`

Via the standard API, a user's password can only be set via the separate `/api/v3/core/users/<id>/set_password/` endpoint. In blueprints, the password of a user can be set using the `password` field.

Keep in mind that if an LDAP Source is configured and the user maps to an LDAP user, this password change will be propagated to the LDAP server.

For example:

```yaml
# [...]
- model: authentik_core.user
  state: present
  identifiers:
      username: test-user
  attrs:
      name: test user
      password: this-should-be-a-long-value
```

### `password_hash`

In blueprints, a user's password can also be set using the `password_hash` field. The value must be a valid Django password hash, such as one generated with the `hash_password` management command.

Use `password_hash` when you need to import or bootstrap an existing hash without exposing the raw password to authentik. Enter the password when prompted to generate the hash:

```bash
docker compose run --rm server hash_password
```

For automation, pass the password in the `PASSWORD` environment variable and pipe it through standard input to prevent exposing the password in your shell history:

```bash
printf '%s' "$PASSWORD" | docker compose run --rm server hash_password
```

For example:

```yaml
# [...]
- model: authentik_core.user
  state: present
  identifiers:
      username: test-user
  attrs:
      name: test user
      password_hash: pbkdf2_sha256$1000000$xKKFuYtJEE27km09BD49x2$4+Z6j3utmouPF5mik0Z21L2P0og5IlmMmIJ46Tj3zCM=
```

`password` and `password_hash` are mutually exclusive; setting both on the same user causes blueprint validation to fail.

`password_hash` follows the [hashed-password import behavior](../../../install-config/automated-install.mdx#authentik_bootstrap_password_hash): it updates only authentik's local password verifier and does not propagate to LDAP or Kerberos integrations.

### `permissions`

The `permissions` field can be used to set global permissions for a user. A full list of possible permissions is included in the JSON schema for blueprints.

For example:

```yaml
# [...]
- model: authentik_core.user
  identifiers:
      username: test-user
  attrs:
      permissions:
          - authentik_blueprints.view_blueprintinstance
```

## `authentik_core.application`

### `icon`

Application icons can be directly set to URLs with the `icon` field.

For example:

```yaml
# [...]
- model: authentik_core.application
  identifiers:
      slug: my-app
  attrs:
      name: My App
      icon: https://goauthentik.io/img/icon.png
```

## `authentik_sources_oauth.oauthsource`, `authentik_sources_saml.samlsource`, `authentik_sources_plex.plexsource`

### `icon`

Source icons can be directly set to URLs with the `icon` field.

For example:

```yaml
# [...]
- model: authentik_sources_oauth.oauthsource
  identifiers:
      slug: my-source
  attrs:
      name: My source
      icon: https://goauthentik.io/img/icon.png
```

## `authentik_flows.flow`

### `icon`

Flow backgrounds can be directly set to URLs with the `background` field.

For example:

```yaml
# [...]
- model: authentik_flows.flow
  identifiers:
      slug: my-flow
  attrs:
      name: my-flow
      title: My flow
      designation: authentication
      background: https://goauthentik.io/img/icon.png
```

## `authentik_rbac.role`

### `permissions`

The `permissions` field can be used to set global permissions for a role. A full list of possible permissions is included in the JSON schema for blueprints.

For example:

```yaml
# [...]
- model: authentik_rbac.role
  identifiers:
      name: test-role
  attrs:
      permissions:
          - authentik_blueprints.view_blueprintinstance
```

## `authentik_stages_invitation.invitation`2025.12

The `created_by` field can be set to a user. If no value is given, the internal hidden anonymous user is used.

For example:

```yaml
# [...]
- model: authentik_stages_invitation.invitation
  identifiers:
      name: test-invitation
  attrs:
      created_by: !Find [authentik_core.user, [username, "my-admin-user"]]
```

## `authentik_policies.policybinding`

### Required fields

Each PolicyBinding entry must provide **exactly one** of the following fields. These are commonly set in `attrs`, but can also be used in `identifiers` when they are part of the lookup for an existing binding:

- `policy`: Reference to a Policy object
- `group`: Reference to a Group object
- `user`: Reference to a User object

Setting none or multiple in a single binding will cause validation errors. However, you can create multiple separate bindings to the same target with different `order` values.

Policy bindings do not have a `name` field. To identify an existing binding, use fields that exist on the binding, such as `target` with `order`, or `target` with the bound `policy`, `group`, or `user`.

Example with multiple bindings to the same application:

```yaml
# Bind a policy
- model: authentik_policies.policybinding
  identifiers:
      target: !Find [authentik_core.application, [slug, my-app]]
      order: 0
  attrs:
      policy: !Find [authentik_policies.expression.expressionpolicy, [name, my-policy]]

# Bind a group to the same application
- model: authentik_policies.policybinding
  identifiers:
      target: !Find [authentik_core.application, [slug, my-app]]
      order: 1
  attrs:
      group: !Find [authentik_core.group, [name, admins]]
```

## `authentik_endpoints_connectors_agent.enrollmenttoken`

### `key`

Via the standard API, a token's key cannot be changed, it can only be rotated. This is to ensure a high entropy in its key, and to prevent insecure data from being used. However, when provisioning enrollment tokens via a blueprint, it may be required to set a token to an existing value.

With blueprints, the field `key` can be set, to set the enrollment token's key to any value.

For example:

```yaml
# [...]
- model: authentik_endpoints_connectors_agent.enrollmenttoken
  state: present
  identifiers:
      name: my-token
  attrs:
      key: this-should-be-a-long-value
      connector: !KeyOf connector
```

---

## File structure

# File structure

Blueprints are YAML files, which can use some additional tags to ease blueprint creation.

## Schema

The blueprint schema is available under `https://goauthentik.io/blueprints/schema.json`. It is also possible to target a specific version's blueprint schema by using `https://version-2023-4.goauthentik.io/blueprints/schema.json`.

To use the schema with Visual Studio Code and the YAML extension, add this comment at the top of your blueprint files:

```yaml
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
```

## Example

```yaml
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
# The version of this blueprint, currently 1
version: 1
# Optional block of metadata, name is required if metadata is set
metadata:
    # Arbitrary key=value store, special labels are listed below
    labels:
        foo: bar
    name: example-blueprint
# Optional default context, instance context is merged over this.
context:
    foo: bar
# List of entries (required)
entries:
    - # Model in app.model notation, possibilities are listed in the schema (required)
      model: authentik_flows.flow
      # The state this object should be in (optional, can be "present", "created", "must_created", or "absent")
      # - present (default): Creates the object if it doesn't exist, or updates the fields
      #   specified in attrs if it does exist. This will overwrite any manual changes to those
      #   fields, but fields not in attrs are left unchanged.
      # - created: Creates the object if it doesn't exist, but never updates it afterward.
      #   Manual changes are preserved.
      # - must_created: Creates the object only if it doesn't exist. If the object already exists,
      #   the blueprint will fail with a validation error.
      # - absent: Deletes the object if it exists. This uses Django's .delete() which may
      #   cascade to related objects (e.g., deleting a Flow will delete its FlowStageBindings).
      state: present
      # An optional list of boolean-like conditions. If all conditions match (or
      # no conditions are provided) the entry will be evaluated and acted upon
      # as normal. Otherwise, the entry is skipped as if not defined at all.
      # Each condition will be evaluated in Python to its boolean representation
      # bool(<condition>). Furthermore, complex conditions can be built using
      # a special !Condition tag. See the documentation for custom tags for more
      # information.
      conditions:
          - true
          - text
          - 2
          - !Condition [AND, ...] # See custom tags section
      # Key:value filters to uniquely identify this object (required).
      # Identifier keys must be fields on the target model; they are not arbitrary labels.
      # The blueprint JSON schema lists the available fields for each model.
      # On creation: identifiers are merged with attrs to create the object.
      # Avoid setting the same field in both places.
      # On lookup: identifiers are used to find existing objects
      # On update: only attrs are applied (if state is present)
      #
      # Multiple non-pk identifiers are matched together. Use multiple fields when one field
      # is not unique enough on its own, for example target and order on a binding.
      # If pk is set together with other identifiers, the lookup matches either pk or the
      # combined non-pk identifiers.
      #
      # Dictionary values use Django's __contains query for JSON field matching:
      # identifiers:
      #     attributes: {foo: bar}  # Matches if attributes JSON contains {"foo": "bar"}
      identifiers:
          slug: initial-setup
      # Optional ID for use with !KeyOf
      id: flow
      # Attributes to set on the object. Only explicitly required settings should be stated
      # as these values will override existing attributes.
      # Note: When creating objects, identifiers and attrs are merged together.
      # On updates (state: present), only fields specified in attrs are modified - other
      # fields (like auto-generated client_id/client_secret) are left unchanged.
      attrs:
          denied_action: message_continue
          designation: stage_configuration
          name: default-oobe-setup
          title: Welcome to authentik!
      # Optionally set object-level permissions on the object
      # Requires authentik 2024.8
      permissions:
          - permission: inspect_flow
            user: !Find [authentik_core.user, [username, akadmin]]
```

## Special Labels

#### `blueprints.goauthentik.io/system`:

Used by authentik's packaged blueprints to keep globals up-to-date. Should only be removed in special cases.

#### `blueprints.goauthentik.io/instantiate`:

Configure if this blueprint should automatically be instantiated (defaults to `"true"`). When set to `"false"`, blueprints are listed and available to be instantiated via API/Browser.

#### `blueprints.goauthentik.io/description`:

Optionally set a description, which can be seen in the web interface.

---

## YAML Tags

# YAML Tags

To use the custom tags with your preferred editor, you must make the editor aware of the custom tags.

For VS Code, for example, add these entries to your `settings.json`:

```json
{
    "yaml.customTags": [
        "!Condition sequence",
        "!Context scalar",
        "!Enumerate sequence",
        "!Env scalar",
        "!File scalar",
        "!File sequence",
        "!Find sequence",
        "!Format sequence",
        "!If sequence",
        "!Index scalar",
        "!KeyOf scalar",
        "!Value scalar",
        "!AtIndex scalar"
    ]
}
```

#### `!KeyOf`

Example:

```yaml
policy: !KeyOf my-policy-id
```

Resolves to the primary key of the model instance defined by id *my-policy-id*.

If no matching entry can be found, an error is raised and the blueprint is invalid.

#### `!Env`

Example:

```yaml
password: !Env my_env_var
```

Returns the value of the given environment variable. Can be used as a scalar with `!Env my_env_var, default` to return a default value.

#### `!File`

Example:

```yaml
password: !File /path/to/file
```

Returns the contents of the file at the given path. Can be used as a scalar with `!File /file/to/path, default` to return a default value.

#### `!Find`

Examples:

```yaml
configure_flow: !Find [authentik_flows.flow, [slug, default-password-change]]
```

```yaml
configure_flow:
    !Find [
        authentik_flows.flow,
        [!Context property_name, !Context property_value],
    ]
```

Looks up any model and resolves to the matches' primary key.
First argument is the model to be queried, remaining arguments are expected to be pairs of key=value pairs to query for.

#### `!FindObject`2025.8

Examples:

```yaml
flow_designation:
    !AtIndex [
        !FindObject [authentik_flows.flow, [slug, default-password-change]],
        designation,
    ]
```

Looks up any model and resolves to the matches' serialized data.
First argument is the model to be queried, remaining arguments are expected to be pairs of key=value pairs to query for.

#### `!Context`

Example:

```yaml
configure_flow: !Context foo
```

Find values from the context. Can optionally be called with a default like `!Context [foo, default-value]`.

#### `!Format`

Example:

```yaml
name: !Format [my-policy-%s, !Context instance_name]
```

Format a string using python's % formatting. First argument is the format string, any remaining arguments are used for formatting.

#### `!If`

Minimal example:

```yaml
# Short form
# !If [<condition>]
required: !If [true]
```

```yaml
# Longer form
# !If [<condition>, <when true>, <when false>]
required: !If [true, true, false]
```

Full example:

```yaml
attributes: !If [
        !Condition [...], # Or any valid YAML or custom tag. Evaluated as boolean in Python
        {
            # When condition evaluates to true
            dictionary:
                {
                    with: { keys: "and_values" },
                    and_nested_custom_tags: !Format ["foo-%s", !Context foo],
                },
        },
        [
            # When condition evaluates to false
            list,
            with,
            items,
            !Format ["foo-%s", !Context foo],
        ],
    ]
```

Conditionally add YAML to a blueprint.

Similar to a one-line if, the first argument is the condition, which can be any valid yaml or custom tag. It will be evaluated as boolean in python. However, keep in mind that dictionaries and lists will always evaluate to `true`, unless they are empty.

The second argument is used when the condition is `true`, and the third - when `false`. The YAML inside both arguments will be fully resolved, thus it is possible to use custom YAML tags and even nest them inside dictionaries and lists.

#### `!Condition`

Minimal example:

```yaml
required: !Condition [OR, true]
```

Full example:

```yaml
required: !Condition [
    AND, # Valid modes are: EQ, NEQ, AND, NAND, OR, NOR, XOR, XNOR
    !Context instance_name,
    !Find [authentik_flows.flow, [slug, default-password-change],
    "My string",
    123
]
```

Converts one or more arguments to their boolean representations, then merges all representations together.
Requires at least one argument after the mode selection.

If only a single argument is provided, its boolean representation will be returned for all normal modes and its negated boolean representation will be returned for all negated modes.

Normally, it should be used to define complex conditions for use with an `!If` tag or for the `conditions` attribute of a blueprint entry (see [the blueprint file structure](./structure.mdx)). However, this is essentially just a boolean evaluator so it can be used everywhere a boolean representation is required.

#### `!Enumerate`, `!Index` and `!Value`

These tags collectively make it possible to iterate over objects which support iteration. Any iterable Python object is supported. Such objects are sequences (`[]`), mappings (`{}`) and even strings.

1. `!Enumerate` tag:

This tag takes 3 arguments:

```yaml
!Enumerate [<iterable>, <output_object_type>, <single_item_yaml>]
```

- **iterable**: Any Python iterable or custom tag that resolves to such iterable
- **output\_object\_type**: `SEQ` or `MAP`. Controls whether the returned YAML will be a mapping or a sequence.
- **single\_item\_yaml**: The YAML to use to create a single entry in the output object

2. `!Index` tag:

This tag is only valid inside an `!Enumerate` tag

This tag takes 1 argument:

```yaml
!Index <depth>
```

- **depth**: Must be >= 0. A depth of 0 refers to the `!Enumerate` tag this tag is located in. A depth of 1 refers to one `!Enumerate` tag above that (to be used when multiple `!Enumerate` tags are nested inside each other).

Accesses the `!Enumerate` tag's iterable and resolves to the index of the item currently being iterated (in case `!Enumerate` is iterating over a sequence), or the mapping key (in case `!Enumerate` is iterating over a mapping).

For example, given a sequence like this - `["a", "b", "c"]`, this tag will resolve to `0` on the first `!Enumerate` tag iteration, `1` on the second and so on. However, if given a mapping like this - `{"key1": "value1", "key2": "value2", "key3": "value3"}`, it will first resolve to `key1`, then to `key2` and so on.

3. `!Value` tag:

This tag is only valid inside an `!Enumerate` tag

This tag takes 1 argument:

```yaml
!Value <depth>
```

- **depth**: Must be >= 0. A depth of 0 refers to the `!Enumerate` tag this tag is located in. A depth of 1 refers to one `!Enumerate` tag above that (to be used when multiple `!Enumerate` tags are nested inside each other).

Accesses the `!Enumerate` tag's iterable and resolves to the value of the item currently being iterated.

For example, given a sequence like this - `["a", "b", "c"]`, this tag will resolve to `a` on the first `!Enumerate` tag iteration, `b` on the second and so on. If given a mapping like this - `{"key1": "value1", "key2": "value2", "key3": "value3"}`, it will first resolve to `value1`, then to `value2` and so on.

Minimal examples:

```yaml
configuration_stages: !Enumerate [
        !Context map_of_totp_stage_names_and_types,
        SEQ, # Output a sequence
        !Find [
            !Format [
                "authentik_stages_authenticator_%s.authenticator%sstage",
                !Index 0,
                !Index 0,
            ],
            [name, !Value 0],
        ], # The value of each item in the sequence
    ]
```

The above example will resolve to something like this:

```yaml
configuration_stages:
    - !Find [
          authentik_stages_authenticator_<stage_type_1>.authenticator<stage_type_1>stage,
          [name, <stage_name_1>],
      ]
    - !Find [
          authentik_stages_authenticator_<stage_type_2>.authenticator<stage_type_2>stage,
          [name, <stage_name_2>],
      ]
```

Similarly, a mapping can be generated like so:

```yaml
example: !Enumerate [
        !Context list_of_totp_stage_names,
        MAP, # Output a map
        [
            !Index 0, # The key to assign to each entry
            !Value 0, # The value to assign to each entry
        ],
    ]
```

The above example will resolve to something like this:

```yaml
example:
    0: <stage_name_1>
    1: <stage_name_2>
```

Full example:

Note that an `!Enumerate` tag's iterable can never be an `!Index` or `!Value` tag with a depth of `0`. Minimum depth allowed is `1`. This is because a depth of `0` refers to the `!Enumerate` tag the `!Index` or `!Value` tag is in, and an `!Enumerate` tag cannot iterate over itself.

```yaml
example: !Enumerate [
        !Context sequence, # ["foo", "bar"]
        MAP, # Output a map
        [
            !Index 0, # Use the indexes of the items in the sequence as keys
            !Enumerate [
                # Nested enumeration
                # Iterate over each item of the parent enumerate tag.
                # Notice depth is 1, not 0, since we are inside the nested enumeration tag!
                !Value 1,
                SEQ, # Output a sequence
                !Format [
                    "%s: (index: %d, letter: %s)",
                    !Value 1,
                    !Index 0,
                    !Value 0,
                ],
            ],
        ],
    ]
```

The above example will resolve to something like this:

```yaml
"0":
    - "foo: (index: 0, letter: f)"
    - "foo: (index: 1, letter: o)"
    - "foo: (index: 2, letter: o)"
"1":
    - "bar: (index: 0, letter: b)"
    - "bar: (index: 1, letter: a)"
    - "bar: (index: 2, letter: r)"
```

#### `!AtIndex`

Minimal example:

```yaml
value_in_sequence: !AtIndex [["first", "second"], 0] # Resolves to "first"
value_in_mapping: !AtIndex [{ "foo": "bar", "other": "value" }, "foo"] # Resolves to "bar"
```

Example with default value:

```yaml
default_value: !AtIndex [["first"], 100, "default"] # Resolves to "default"
default_value: !AtIndex [["first"], 100] # Throws an error
```

Resolves to the value at a specific index in a sequence or a mapping.

If no value can be found at the specified index and no default is provided, an error is raised and the blueprint is invalid.

---

## Customize the Admin interface

The Admin interface can be customized using attributes configured in [Brands](../../../customize/branding/index.mdx).

To add, remove, or modify attributes for a brand, log in to the Admin interface and navigate to **System > Brands > Other global settings > Attributes**.

Most attributes defined in a brand apply to *both* the User and Admin interfaces. However, any settings that are specific to only the Admin interface are explicitly noted as such below.

The following screenshot shows the syntax for setting several attributes for a brand: dark mode, a 3-column display of applications on the **Application Dashboard** page of the User interface, and hiding the API and Notifications drawers from the Admin interface toolbar.

![](./admin-interface-attributes.png)

## Custom settings

The following settings for attributes are grouped by:

- `enabledFeatures` settings
- General settings (used on both the Admin interface and the User interface)
- Admin interface only

### Enable or disable features

The features listed below can be enabled or disabled through attributes set on the Brand. By default, all of the listed features are enabled. To disable a specific feature, set its value to `false`.

#### `settings.enabledFeatures.apiDrawer`

Display the API Request drawer in the upper toolbar.

#### `settings.enabledFeatures.notificationDrawer`

Display the Notification drawer in the upper toolbar.

#### `settings.enabledFeatures.settings`

Display the Settings link in the upper toolbar.

#### `settings.enabledFeatures.search`

Display the Search bar in the upper toolbar.

### General settings (both Admin and User interfaces)

#### `settings.navbar.userDisplay`

Configure what is shown in the top-right corner. Defaults to `username`. Available options: `username`, `name`, `email`

#### `settings.theme.base`

Configure the base color scheme or toggle between dark and light modes. The default setting is `automatic`, which adapts based on the user’s browser preference. Available options: `automatic`, `dark`, `light`.

**Example**:

```
settings:
  theme:
    base: dark
```

#### `settings.theme.background`

Optional CSS that is applied to the background of the User interface, for example to set a custom background color, gradient, or image.

```yaml
settings:
    theme:
        background: >
            background: url('https://picsum.photos/1920/1080');
            filter: blur(8px);
            background-position: center;
            background-repeat: no-repeat;
            background-size: cover;
```

#### `settings.locale`

The locale used by the interface. Set this on the default brand to configure the language instance-wide, or on user and group attributes to configure defaults for specific users or group memberships. Users can still choose their own preferred locale in user settings.

**Example**:

```yaml
settings:
    locale: en
```

### Settings for the Admin interface only

The following settings can only be used to customize the Admin interface, not the User interface.

#### `settings.pagination.perPage`

How many items should be retrieved per page. Defaults to 20.

#### `settings.defaults.userPath`

Default user path which is used when opening the user list. Defaults to `users`.

## Global customization

To customize the following brand settings, log in to the Admin interface and navigate to **System > Brands > Brand settings**.

- Title
- Logo
- Favicon
- Default flow background image
- Custom CSS

For more details, see the [Brand settings](../../../customize/branding/index.mdx#branding-settings) documentation.

---

## Customize a flow

Typically, settings for flows are defined as defaults in the [Brand settings](../../../customize/branding/index.mdx). However, it’s important to note that some flows are executed before the specific user is authenticated and thus before authentik can determine which user is viewing the flow (for example, the `default-authentication-flow`!). Consequently, using default settings for all flows ensures a more consistent user experience.

Two settings that you can configure per flow are the *background image* for the flow, and the *layout*.

## Customize a flow's background image

You can define a:

- Default background image for all flows, set in the instance's [brand](../../../customize/branding/index.mdx)
- A background image for [one or more specific flows](../../../add-secure-apps/flows-stages/flow/index.mdx#flow-configuration-options) (overrides the default)

## Set the layout for a flow

To define the layout for a flow, edit the flow and, under **Appearance settings > Layout**, select how the UI displays the flow when it is executed: with stacked elements, content on the left or right, and the sidebar on the left or right.

---

## Customize the User interface

The User interface can be customized using attributes configured in [Brands](../../../customize/branding/index.mdx).

To add, remove, or modify attributes for a brand, log in as an administrator and navigate to **System > Brands > Other global settings > Attributes**.

Most attributes defined in a brand apply to *both* the User and Admin interfaces. However, any settings that are specific to only one interface are explicitly noted as such below.

The following screenshot shows the syntax for setting several attributes for a brand: light mode, a 3-column display of applications on the **Application Dashboard** page, hiding the API drawer and the Notification drawer from the toolbar, and disallowing users to edit applications on the **Application Dashboard** page.

![](./user-interface-attributes.png)

## Custom settings

The following settings for attributes are grouped by:

- `enabledFeatures` settings
- General attributes (used on both the Admin interface and the User interface)
- User interface only

### Enable or disable features

The features listed below can be enabled or disabled through attributes set on the Brand. By default, all of the listed features are enabled. To disable a specific feature, set its value to `false`.

#### `settings.enabledFeatures.apiDrawer`

Display the API Request drawer in the upper toolbar.

#### `settings.enabledFeatures.notificationDrawer`

Display the Notification drawer in the upper toolbar.

#### `settings.enabledFeatures.settings`

Display the Settings link in the upper toolbar.

#### `settings.enabledFeatures.search`

Display the Search bar in the upper toolbar.

#### `settings.enabledFeatures.applicationEdit` (User interface only)

Display the Edit option for each application on the **Application Dashboard** page (only shown when the user is a superuser).

#### `settings.enabledFeatures.requests`  (User interface only)

When configured, show the requests tab on the user interface to allow users to request access to applications.

### General settings (both Admin and User interfaces)

#### `settings.navbar.userDisplay`

Configure what is shown in the top-right corner. Defaults to `username`. Available options: `username`, `name`, `email`

#### `settings.theme.base`

Configure the base color scheme or toggle between dark and light modes. The default setting is `automatic`, which adapts based on the user’s browser preference. Available options: `automatic`, `dark`, `light`.

**Example**:

```
settings:
  theme:
    base: dark
```

#### `settings.theme.background`

Optional CSS that is applied to the background of the User interface, for example to set a custom background color, gradient, or image.

```yaml
settings:
    theme:
        background: >
            background: url('https://picsum.photos/1920/1080');
            filter: blur(8px);
            background-position: center;
            background-repeat: no-repeat;
            background-size: cover;
```

#### `settings.locale`

The locale used by the interface. Set this on the default brand to configure the language instance-wide, or on user and group attributes to configure defaults for specific users or group memberships. Users can still choose their own preferred locale in user settings.

**Example**:

```yaml
settings:
    locale: en
```

### Settings for the User interface only

#### `settings.layout.type`

Which layout to use for the **Application Dashboard** page. Defaults to `row`. Choices: `row`, `2-column`, `3-column`

## Global customization

To customize the following brand settings, log in to the Admin interface and navigate to **System > Brands > Brand settings**.

- Title
- Logo
- Favicon
- Default flow background image
- Custom CSS

For more details, see the [Brand settings](../../../customize/branding/index.mdx#branding-settings) documentation.

---

## Event Matcher Policy

Use an Event Matcher policy when you want to match authentik events with built-in fields or an [AKQL query](../../../sys-mgmt/akql.mdx#use-akql-in-an-event-matcher-policy).

This policy is most commonly used with [Notification Rules](../../../sys-mgmt/events/notifications.mdx).

## When to use it

Use an Event Matcher policy when you want to match against events such as:

- a failed login
- a model being created, updated, or deleted
- activity from a specific authentik app
- activity from a specific client IP

For complex Python logic or network range matching, use an [Expression policy](./expression/index.mdx) instead.

## What it matches

An Event Matcher policy can match on these built-in fields:

- action
- app
- model
- exact client IP

It can also match on the **Query** field, which uses AKQL. For the available event fields, operators, and examples, see the [AKQL reference](../../../sys-mgmt/akql.mdx).

Any field you leave empty is treated as a wildcard. Any field you configure must match for the policy to pass.

This policy is useful only when an event object is present in the policy context, such as when a notification rule evaluates an event.

## Create an Event Matcher policy

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Click **New Policy** and select **Event Matcher Policy**.
4. Configure the fields you want to match.
5. Click **Create Policy**.

## Send notifications about an event match

To send notifications for a subset of authentik events:

1. Create an Event Matcher policy.
2. Create or edit a [Notification Rule](../../../sys-mgmt/events/notifications.mdx).
3. Bind the policy to that notification rule.

Be aware that an event has to match all configured fields in the policy, otherwise the notification rule will not trigger.

---

## GeoIP Policy

Use a GeoIP policy when you want to make access decisions based on where a request appears to come from.

For simple country or ASN matching, a GeoIP policy is usually easier to maintain than an [Expression policy](./expression/index.mdx).

## What it can do

A GeoIP policy can:

- allow or deny requests by country
- allow or deny requests by ASN
- compare the current login location to recent login events
- detect impossible travel patterns

GeoIP support is included in authentik. For advanced setup and database management, see [GeoIP operations](../../../sys-mgmt/ops/geoip.mdx).

## Country and ASN matching

Use the country and ASN fields when you want straightforward allow or deny logic based on:

- the client's country
- the client's autonomous system number

If either country or ASN matching is configured, the static part of the policy passes when any configured country or ASN match succeeds.

## Distance settings

GeoIP policies can also compare the current login against recent login history.

When distance checks are enabled, authentik evaluates the current login against the configured number of historical login events. If any comparison exceeds the allowed distance or fails the impossible-travel check, the policy fails.

- **Maximum distance**: the maximum allowed distance between a previous login location and the current login location.
- **Distance tolerance**: an additional tolerance, in kilometers, added to the maximum distance before the policy fails.
- **Historical Login Count**: how many recent login events authentik should compare against.
- **Check impossible travel**: enables an additional check based on travel speed between recent login events.
- **Impossible travel tolerance**: an additional tolerance, in kilometers, added to the built-in impossible-travel allowance.

## Create a GeoIP policy

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Click **New Policy** and select **GeoIP Policy**.
4. Configure the country, ASN, and optional distance settings you need.
5. Click **Create Policy**.

## Common use

GeoIP policies are often bound to:

- applications, to restrict access by network geography
- stage bindings, to trigger additional checks only for risky requests
- flows, when access to the whole flow should depend on request origin

---

## Types of policies in authentik

These pages describe the built-in policy objects you can create in authentik.

Use this section to browse the dedicated reference page for each policy type.

---

## Password Expiry Policy

Use a Password Expiry policy when passwords should expire after a fixed number of days.

## How it works

This policy checks how many days have passed since the user's password was last changed.

When the configured limit is exceeded, the policy fails. Depending on the policy settings, authentik can either:

- deny access with an expiry message
- mark the password unusable so the user must set a new one

## Key setting

- **Days**: how old a password may be before the policy fails
- **Deny only**: if enabled, the policy only fails; if disabled, authentik can also mark the password unusable

## Create a Password Expiry policy

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Click **New Policy** and select **Password Expiry Policy**.
4. Configure the allowed password age and whether the policy should run in deny-only mode.
5. Click **Create Policy**.

## Common use

Password Expiry policies are usually used together with a password change or recovery flow so users have a clear path to set a new password after expiry.

If you also need password-history enforcement, combine this policy with [Password Uniqueness Policy](./password-uniqueness.mdx).

---

## Password Uniqueness Policy

The Password Uniqueness policy is an enterprise policy that prevents users from reusing previously used passwords.

In most deployments, you attach it to a [Prompt stage](../../../add-secure-apps/flows-stages/stages/prompt/index.mdx) through that stage's **Validation Policies** so authentik can validate the new password at the moment it is entered.

## How it works

This policy stores a history of previous password hashes for each user. When a new password is submitted, authentik compares it against the most recent password-history entries configured in the policy.

If the new password matches one of those historical entries, the policy fails and the user must choose a different password.

Password history is maintained automatically while the policy is in use.

This policy starts building password history after you enable it. The first subsequent password change seeds the history; there is no older password history to compare against before that point.

## When to use it

Use Password Uniqueness when you need password-history enforcement, such as:

- security baselines that forbid password reuse
- password rotation requirements
- compliance frameworks that require password history checks

For broader password controls, combine it with:

- [Password Policy](./password.mdx) for complexity, HIBP, and zxcvbn checks
- [Password Expiry Policy](./password-expiry.mdx) if you also require password rotation

## Create the policy

To create a Password Uniqueness policy:

1. In the Admin interface, navigate to **Customization** > **Policies**.
2. Click **New Policy** to define a new Password Uniqueness Policy.
3. Configure the policy:
   - **Name**: use a descriptive name.
   - **Password field**: enter the field key that contains the new password. In the default flows this is usually `password`.
   - **Number of previous passwords to check**: choose how many previous passwords authentik should compare against and retain for future checks.
4. Click **Create Policy**.

## Attach the policy to password entry

In most cases, bind the policy to the prompt stage where the user enters the new password.

For example, if you use the `default-password-change` flow:

1. Open the `default-password-change-prompt` stage.
2. In **Validation Policies**, add your Password Uniqueness policy.
3. Save the stage.

This is the recommended placement because the policy needs access to the password field in prompt data. If you bind the policy somewhere else, that password field must still be present in the policy context.

Password history records are stored securely and cannot be used to reconstruct original passwords.

## Configuration tips

- The **Password field** must match the prompt field's **Field Key** exactly.
- If you have multiple password-entry prompts, point the policy at the field that represents the new password.
- Increase the history count only as far as your requirements need. Higher values mean more password history is retained per user.

---

## Password Policy

Use a Password policy when you want to validate a password entered in a prompt stage.

This policy is most often attached to a [Prompt stage](../../../add-secure-apps/flows-stages/stages/prompt/index.mdx) through that stage's **Validation Policies**.

## What it can enforce

A Password policy can enforce:

- minimum length
- minimum counts for uppercase, lowercase, digits, and symbols
- a custom symbol set
- [Have I Been Pwned](https://haveibeenpwned.com/) exposure checks
- [zxcvbn](https://github.com/dropbox/zxcvbn) strength checks

The policy reads the configured password field from prompt data, so the field key in the policy must match the password field used by your prompt stage.

By default, authentik's Password policy aligns with [NIST password guidance](https://pages.nist.gov/800-63-4/sp800-63b.html#password). Be careful when tightening or weakening those defaults. For broader guidance, see [Hardening authentik](../../../security/security-hardening.mdx#password-policy).

## Have I Been Pwned checks

When the HIBP check is enabled, authentik compares the password hash against the Have I Been Pwned password database.

Only the first 5 characters of the SHA-1 hash are sent to the API. The remaining comparison is done in authentik.

## zxcvbn checks

When the zxcvbn check is enabled, authentik evaluates password strength and can reject passwords that are still weak even if they satisfy simple character-count rules.

## Create a Password policy

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Click **New Policy** and select **Password Policy**.
4. Configure the password field and validation rules you want to enforce.
5. Click **Create Policy**.

## Attach it to password entry

In most cases, bind the policy to the prompt stage where the user enters a new password.

This is commonly used in:

- enrollment flows
- password reset flows
- password change flows

If you also want to prevent password reuse, combine this policy with [Password Uniqueness Policy](./password-uniqueness.mdx).

---

## Reputation Policy

Use a Reputation policy when you want authentik to react to repeated failed authentication attempts from a username, a client IP, or both.

## How reputation works

authentik tracks a reputation score over time:

- failed logins decrease the score
- successful logins increase the score

The policy passes when the score is at or below the configured threshold.

In practice, this is usually used to show an extra challenge only when a request looks risky. For example, you can bind a CAPTCHA stage so it runs only for low-reputation requests.

## What it can check

A Reputation policy can evaluate:

- the client IP
- the username
- both together

The threshold defaults to a low score, so the policy is naturally suited to "trigger extra verification when trust is low" scenarios.

## Create a Reputation policy

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Click **New Policy** and select **Reputation Policy**.
4. Choose whether to check IP, username, or both, and set the threshold.
5. Click **Create Policy**.

## Use it on stage bindings

When you use a Reputation policy on a flow stage binding, configure the stage binding to **Evaluate when stage is run** so authentik can use the latest request context. For more information, see [Planning and stage policies](../../../add-secure-apps/flows-stages/flow/planner.mdx#planning-and-stage-policies).

This is especially important when the policy should react to the current login attempt rather than only to the initial planned flow state.

## Related settings

System-wide reputation limits and expiry are documented in [Settings](../../../sys-mgmt/settings.mdx).

---

## Combination topic (most common)

Start with the MDX template, either by copying the [`combo.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command:

```shell
wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/combo.tmpl.mdx
```

Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules.

For a combo topic, the title is typically the name of the feature ("Branding" or "Remote Access Control").

In this first section, right after the title but with no header, write one or two sentences about the task. Keep it brief, just an overview.

## About feature XYZ

In this section, go into a deeper explanation of the feature, provide typical use cases, etc.

### More info about the feature, a sub-category of info

Use this section if there are several big topics or categories of info that the reader needs to know about the feature or task. Add as many of these sections as needed.

## Prerequisites (optional section)

In this section, inform the reader of anything they need to do, or have configured or installed, before they start following the procedural instructions below.

## About the workflow (optional section)

For a long or complex task, add a bullet list of the main steps or a workflow diagram before the detailed procedure.

## First several group steps

If the task involves a lot of steps, try to group them into similar steps and have a Head3 or Head4 title for each group.

In this section, help the reader get oriented... where do they need to be (i.e. in the GUI, on a CLI, etc).

Have a separate paragraph for each step.

*Start instructions with the desired goal*, followed by the instructions. For example, in this sentence: "To define a new port number, navigate to the Admin interface, and then to the **Settings** tab." we first read the goal (to define a new port) and then we see the instructions.

## Next step of grouped steps (if a second group is needed)

Continue with the steps...

Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words.

Provide as many code snippets and examples as needed.

## Verify the steps

Use a heading such as "Verify your installation" or "Verify successful configuration". Whenever possible, it is useful to add verification steps at the end of a procedural topic. For example, if the procedural was about installing a product, use this section to tell them how they can verify that the install was successful.

---

## MDX template: combo

Add a brief description of the feature or functionality.

## About `<feature>`

In this section, go into a deeper explanation of the feature, provide typical use cases, etc.

If needed, use this syntax to add a note (info) or warning (warning) anywhere in the document that is appropriate.

### More info about the feature, a sub-category of info

Use this section if there are several big topics or categories of info that the reader needs to know about the feature or task. Add as many of these sections as needed.

## Prerequisites

Add a bullet list of prerequisites.

## About the workflow (optional; use only for a long procedure)

Summarize the workflow before the detailed steps, using a bullet list of the main steps or a diagram.

## Complete the first group of steps

1. First step.

2. Second step.

3. Third step.

If you need tabs for different processes or installation environments, convert the file to MDX and use the tabs component.

## Complete the next group of steps

Continue with the steps...

## Verify the result

Add verification steps.

---

## Conceptual topic

Start with the MDX template, either by copying the [`conceptual.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command:

```shell
wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/conceptual.tmpl.mdx
```

Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules.

Use a title that focuses on the feature, component, or technology you are writing about... for example, "About authentik policies" or "Understanding outposts". For conceptual docs, the verb in the title should indicate a concept, such as "About" or "Overview" or "Understanding", followed by the noun (the component or object you are writing about).

In this first section, immediately after the title, write one or two sentences about the feature, component, or technology. The following sections can help break up the content.

## Common use cases (optional section)

In this optional section, provide some example use cases for the feature. Who would use it, WHY? If you mention HOW to use the feature, be sure to link off to the related procedural doc. Also share situations where users might NOT want to use the feature; for example, if the feature is intended for a specific environment.

## About the feature or component

Dive deeper into explaining the concepts behind the feature/component.

Write about the feature/functionality from the user's perspective. What is this feature used for, why should they use it, are there situations where they should ***not*** use it?

> Pro Tip: If you were writing the related procedural topic, and you found that you had a lot to say about the topic, this is exactly where that info would go (not crowded up at the top of the procedural topic!).

Cover anything the user needs to know about the feature. If there are Reference docs or a related procedural doc for this feature or component, be sure to link to them from this page.

## Important considerations

List anything that might be critical for the user to know, such as situations where this feature might not be ideal, or pre-configs that need to be set, etc.

---

## MDX template: conceptual

Write a few sentences introducing the feature/component/technology.

If needed, use this syntax to add a note (info) or warning (warning) anywhere in the document that is appropriate.

## Common use cases

Provide a few use cases, with examples/scenarios when possible.

## About `<feature>`

Provide more conceptual details.

## Important considerations

List anything users should know before implementing the feature/technology.

---

## Templates

In technical documentation, there are document "types" (similar to how there are data types). We have templates for the different types, to make it super-easy to divide longer topics into separate pages (one for each content type) if needed. And templates in general make it easy for whomever wants to contribute some documentation!

The most common types are:

- [**Combo**](./combo.mdx): For most topics (unless they are very large and complex), we can combine the procedural and conceptual information into a single document. A handy guideline to follow is: "If the actual 1., 2., 3. steps are buried at the bottom, and a reader has to scroll multiple times to find them, then the combo approach is *not* the right one. Use separate topics.".

- [**Procedural**](./procedural.mdx): these are How To docs, the HOW information, with step-by-step instructions for accomplishing a task. This is what most people are looking for when they open the docs... and best practice is to separate the procedural docs from long, lengthy conceptual or reference docs.

- [**Conceptual**](./conceptual.mdx): these docs provide the WHY information, and explain when to use a feature (or when not to!), and general concepts behind the feature or functionality.

- [**Reference**](./reference.mdx): this is typically tables or lists of reference information, such as configuration values, or functions, or most commonly APIs.

### Add a new integration

To add documentation for a new integration (with support level Community or Vendor), please use the integration templates [`service.mdx`](https://github.com/goauthentik/authentik/blob/main/website/integrations/template/service.mdx) from our GitHub repo. You can download the template using the following command:

```shell
wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/integrations/template/service.mdx
```

---

## Procedural topic

Start with the MDX template, either by copying the [`procedural.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command:

```shell
wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/procedural.tmpl.mdx
```

Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules.

For a procedural topic, use a title that focuses on the task, such as "Add a new group" or "Edit user profiles." Include an imperative verb and the object being changed. Use the imperative form (`Add`), not a gerund (`Adding`).

In this first section, right after the title, write one or two sentences about the task. Keep it brief; if it goes on too long, then create a separate conceptual topic, in a separate `.mdx` file. We don't want readers to have to scroll through paragraphs of conceptual info before they get to Step 1.

## Prerequisites (optional section)

In this section, inform the reader of anything they need to do, or have configured or installed, before they start following the procedural instructions below.

## About the workflow (optional section)

For a long or complex task, add a bullet list of the main steps or a workflow diagram before the detailed procedure.

## First several group steps

If the task involves a lot of steps, try to group them into similar steps and have a Head3 or Head4 title for each group.

In this section, help the reader get oriented... where do they need to be (i.e. in the GUI, on a CLI, etc).

Have a separate paragraph for each step.

Start instructions with the desired goal, followed by the instructions. For example, in this sentence we first read the goal (to define a new port) and then we see the instructions: "To define a new port number, navigate to the Admin interface, and then to the **Settings** tab."

## Next step of grouped steps (if a second group is needed)

Continue with the steps...

Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words.

Provide as many code snippets and examples as needed.

## Verify the steps

Use a heading such as "Verify your installation" or "Verify successful configuration". Whenever possible, it is useful to add verification steps at the end of a procedural topic. For example, if the procedural was about installing a product, use this section to tell them how they can verify that the install was successful.

---

## MDX template: procedural

Add a brief description of the feature or functionality.

If needed, use this syntax to add a note (info) or warning (warning) anywhere in the document that is appropriate.

## Prerequisites

Add a bullet list of prerequisites.

## About the workflow

Summarize the workflow before the detailed steps, using a bullet list of the main steps or a diagram.

## Complete the first group of steps

1. First step.

2. Second step.

3. Third step.

If you need tabs for different processes or installation environments, convert the file to MDX and use the tabs component.

## Complete the next group of steps

Continue with the steps...

## Verify the result

Add verification steps.

---

## Reference topic

Start with the MDX template, either by copying the [`reference.tmpl.mdx`](https://github.com/goauthentik/authentik/tree/main/website/docs/developer-docs/docs/templates) file from our GitHub repo or downloading the template file using the following command:

```shell
wget https://raw.githubusercontent.com/goauthentik/authentik/main/website/docs/developer-docs/docs/templates/reference.tmpl.mdx
```

Edit your `.mdx` file as you work, reading this page for the descriptions of each section. You can build out a "stub file" with just headers, then gradually add content to each section. Use screenshots sparingly, only for complex UIs where it is difficult to describe a UI element with words. Refer to our [Style Guide](../style-guide.mdx) for writing tips and authentik-specific rules.

Create a title that specifies the component you are documenting. For example, "Group attributes".

Provide a sentence or two about the topic.

Reference documentation provides details, values, syntax, etc., about specific programming elements.

The most common type of reference documentation is for REST APIs; the request syntax, a successful response, any parameters such as query, header, or request body parameters, and possible http status codes.

Other types of reference content include lists of functions, parameters, object properties, event actions, and attributes.

## Head 2

Use a title that is descriptive, such as "User object attributes" or "Expression policy functions".

Use tables, bullet lists, Head3s... whatever you need to clearly present the values.

Be sure to use a sentence after every heading, to explain what the section is about, how the values are used, etc.

### Head 3 (optional, if needed)

Add a sentence explaining the following grouping.

### Head 3 (optional, if needed)

Add a sentence explaining the following grouping.

---

## MDX template: reference

Write a few sentences introducing the feature/component/technology, and state that this page contains reference materials.

If needed, use this syntax to add an info, warning, or danger box to the document.

## `<reference_category>`

After a brief description of this section, list the reference values.

Consider using a table if that is cleaner looking.

### `<reference_subcategory>`

After a brief description of this section, list the reference values.

---

## Documentation Theming

This section is intended for developers of authentik's documentation site. If you are looking to customize the theming of your own authentik instance, please refer to the [branding](../../../customize/branding/index.mdx) documentation.

The authentik documentation site is built using Meta's [Docusaurus](https://docusaurus.io/), which uses their internal [Infima CSS framework](https://infima.dev/) for its styling and theming capabilities. Infima's own documentation is limited, possibly due to it's internal nature and Docusaurus being the primary consumer. This document aims to provide an overview of how theming is handled in the authentik documentation site, and how you can customize it.

## Infima Color Palette

With the exception of a few customizations, our color palette is managed through Infima's theming system.

### Primary

### Secondary

### Success

### Info

### Warning

### Danger

## Utility & UI Colors

## Dispositions

### Info

### Success

### Warning

### Danger

---

## Automated authentik Agent deployment

The authentik Agent can be deployed at scale to multiple devices via Mobile Device Management (MDM) and automation tools.

## Prerequisites

You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent.

## Create an enrollment token

If you have already created an enrollment token, skip to the next section.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik Agent.
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
   - **Token name**: provide a descriptive name for the token
   - **Device group *(optional)***: select a device access group for the device to be added to after completing enrollment
   - **Expiring *(optional)***: set whether the enrollment token expires.
5. Click **Create**.

## Windows

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik Agent.
4. Under **Setup**, select the enrollment token that you wish to use for enrolling devices.
5. Click **Windows** and then click either **Download** or **Copy** to obtain your SyncML MDM configuration snippet.

This SyncML snippet can be used by Microsoft Intune, Microsoft Endpoint Manager, and other MDM tools to deploy the changes required to support the authentik Agent.

The following two registry keys (`REG_SZ`) are added by the configuration snippet:

- `HKLM/SOFTWARE/authentik Security Inc./Platform/ManagedConfig/RegistrationToken`
- `HKLM/SOFTWARE/authentik Security Inc./Platform/ManagedConfig/URL`

## macOS

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik Agent.
4. Under **Setup**, select the enrollment token that you wish to use for enrolling devices.
5. Click **macOS** and then click either **Download** or **Copy** to obtain your MDM policy.

This policy can be used by Apple Business Manager, Fleet, and other MDM tools to deploy the changes required to support the authentik Agent.

Apple requires an MDM tool to apply this policy to a device. The policy does not work when applied manually.

### User registration

After the authentik Agent is deployed to a device, the user receives a notification asking them to register with authentik. The registration flow prompts the user to authenticate with authentik. After authentication, authentik enrolls the device and associates it with the user.

---

## Deployment

You can deploy the authentik Agent on [Linux](./linux.mdx), [macOS](./macos.mdx), and [Windows](./windows.mdx) devices.

Documentation for large-scale deployments using [Mobile Device Management (MDM) and automated](./automated.mdx) tools is also available.

Select a topic below to continue:

---

## Deploy authentik Agent on Linux

## What it can do

- Retrieve host information and report it to authentik for [device compliance](../../device-compliance/index.mdx).
- Connect to Linux hosts with authentik credentials through [SSH authentication](../../authentik-agent/device-authentication/ssh-authentication.mdx).
- Authenticate to CLI applications with authentik credentials through [CLI application authentication](../../authentik-agent/device-authentication/cli-app-authentication/index.mdx).

## Prerequisites

You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent.

## Create an enrollment token

If you already have an enrollment token, skip to [Install the authentik Agent on Linux](#install-the-authentik-agent-on-linux).

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent.
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
   - **Token name**: Provide a descriptive name for the token.
   - **Device group *(optional)***: Select a device access group to add the device to after enrollment.
   - **Expiring *(optional)***: Set whether the enrollment token expires.
5. Click **Create**.
6. *(Optional)* Click the **Copy** icon in the **Actions** column. You need this value to [join the device to an authentik domain](#join-the-device-to-an-authentik-domain).

## Install the authentik Agent on Linux

Follow these steps to install the authentik Agent on your Linux device:

1. Open a Terminal session and install the required GPG key:

```sh
curl -fsSL https://pkg.goauthentik.io/keys/gpg-key.asc | sudo gpg --dearmor -o /usr/share/keyrings/authentik-keyring.gpg
```

2. Add the repository:

```sh
echo "deb [signed-by=/usr/share/keyrings/authentik-keyring.gpg] https://pkg.goauthentik.io stable main" | sudo tee /etc/apt/sources.list.d/authentik.list
```

3. Update your repositories and install the authentik Agent packages:

```sh
sudo apt update
sudo apt install authentik-cli authentik-agent authentik-sysd
```

4. *(Optional)* To enable [SSH server authentication and local device login](#join-the-device-to-an-authentik-domain), install two additional packages:

```sh
sudo apt install libnss-authentik libpam-authentik
```

5. Confirm that the authentik Agent is installed by opening a terminal window and entering the following command: `ak`

   You should see a response that starts with: `authentik CLI v<version_number>`

On a headless server, the system agent (sysd) does not start the user agent (ak-agent). Start the user agent manually:

```bash
systemctl start --user ak-agent
```

1. Open a Terminal session and run the following command to add the authentik repo and associated GPG key:

```bash
# This overwrites any existing configuration in /etc/yum.repos.d/authentik.repo
cat <<EOF | sudo tee /etc/yum.repos.d/authentik.repo
[authentik]
name=authentik
baseurl=https://pkg.goauthentik.io
enabled=1
gpgcheck=1
gpgkey=https://pkg.goauthentik.io/keys/gpg-key.asc
EOF
```

2. Run the following commands to refresh metadata and install the authentik Agent packages:

```bash
sudo yum install -y authentik-cli authentik-agent authentik-sysd
```

3. *(Optional)* To enable [SSH server authentication and local device login](#join-the-device-to-an-authentik-domain), install two additional packages:

```sh
sudo yum install -y libnss-authentik libpam-authentik
```

4. Confirm that the authentik Agent is installed by opening a terminal window and entering the following command: `ak`

   You should see a response that starts with: `authentik CLI v<version_number>`

On a headless server, the system agent (sysd) does not start the user agent (ak-agent). Start the user agent manually:

```bash
systemctl start --user ak-agent
```

## Join the device to an authentik domain

Joining the device to an authentik domain is what enrolls it with your authentik deployment and issues it a device token. This step is required for [device compliance features](../../device-compliance/index.mdx), for the device [accepting SSH connections](../../authentik-agent/device-authentication/ssh-authentication.mdx), and for local device login.

1. Open a Terminal session and run the following command:

```sh
sudo ak-sysd domains join <deployment_name> --authentik-url https://authentik.company
```

- `deployment_name` identifies the authentik deployment on the device.
- `https://authentik.company` is the fully qualified domain name of the authentik deployment.

2. Enter your [enrollment token](#create-an-enrollment-token) when prompted.
3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.mdx).

### Configure device login on non-Debian systems

On non-Debian Linux distributions, you currently need to manually configure NSS and PAM:

1. Edit `/etc/nsswitch.conf` to include `authentik` for `passwd`, `group`, and `shadow`:

```bash title="/etc/nsswitch.conf"
...
passwd:         files systemd authentik
group:          files systemd authentik
shadow:         files systemd authentik
gshadow:        files systemd
...
```

2. Edit the following two files in the `/etc/pam.d/` directory. The order matters, both of these lines should be located above `pam_unix` in the respective files.

```bash title="/etc/pam.d/common-auth"
...
auth    [success=2 default=ignore]      pam_authentik.so
...
```

```bash title="/etc/pam.d/common-session"
...
session required                        pam_authentik.so
...
```

## Enable SSH client authentication and CLI application authentication

To enable [initiating SSH connections](../../authentik-agent/device-authentication/ssh-authentication.mdx) and [CLI application authentication](../../authentik-agent/device-authentication/cli-app-authentication/index.mdx), the device must be connected to an authentik deployment. To do so, follow these steps:

1. Open a Terminal session and run the following command:

```sh
ak config setup --authentik-url https://authentik.company
```

2. Your default browser opens the authentik login page. After you authenticate, the authentik Agent is configured.

## Check version of installed components

You can check the version of all installed authentik components by running the following command:

```bash
ak version
```

## View logs

authentik Agent logs are available via the systemd journal (`journalctl`) or `syslog`, depending on the distribution.

## Report issues

Please report issues and bugs via the [authentik Platform GitHub repository](https://github.com/goauthentik/platform).

---

## Deploy authentik Agent on macOS

## What it can do

- Retrieve host information and report it to authentik for [device compliance](../../device-compliance/index.mdx).
- Connect to Linux hosts with authentik credentials through [SSH authentication](../../authentik-agent/device-authentication/ssh-authentication.mdx).
- Authenticate to CLI applications with authentik credentials through [CLI application authentication](../../authentik-agent/device-authentication/cli-app-authentication/index.mdx).

## Prerequisites

You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent.

## Create an enrollment token

If you already have an enrollment token, skip to the [next section](#install-the-authentik-agent-on-macos).

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent.
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
   - **Token name**: Provide a descriptive name for the token.
   - **Device group *(optional)***: Select a device access group to add the device to after enrollment.
   - **Expiring *(optional)***: Set whether the enrollment token expires.
5. Click **Create**.
6. *(Optional)* Click the **Copy** icon in the **Actions** column. You need this value to [join the device to an authentik domain](#join-the-device-to-an-authentik-domain).

## Install the authentik Agent on macOS

It's recommended to deploy the Agent via [MDM or automation tools](./automated.mdx) instead of manually configuring it.

The Agent requires a serial number be presented by macOS. Some hypervisors don't set serial numbers. When deploying on a virtual machine, ensure that it has a serial number set.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent.
4. Under **Setup**, click **macOS** to download the authentik Agent installer.
5. After the download completes, attempt to install the package. Default Apple security settings should block the installation.
   - This can be avoided by Option + Right Clicking the package and clicking **Open**.
   - Alternatively use the following command to remove the package from quarantine: `xattr -r -d com.apple.quarantine "$HOME/Downloads/authentik agent installer.pkg"`
6. Confirm that the authentik Agent is installed by opening a Terminal window and running: `ak --version`

   You should see output that starts with: `authentik Agent CLI: <version_number>`

## Join the device to an authentik domain

Joining the device to an authentik domain is what enrolls it with your authentik deployment and issues it a device token. This step is required for [device compliance features](../../device-compliance/index.mdx) and for every other feature that authenticates as the device, including Platform SSO.

1. Open a Terminal session and run the following command:

```sh
sudo "/Applications/authentik Agent.app/Contents/MacOS/ak-sysd" domains join <deployment_name> --authentik-url https://authentik.company
```

- `deployment_name` identifies the authentik deployment on the device.
- `https://authentik.company` is the fully qualified domain name of the authentik deployment.

2. Enter your [enrollment token](#create-an-enrollment-token) when prompted.
3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.mdx).

## Enable SSH client authentication and CLI application authentication

To enable [initiating SSH connections](../../authentik-agent/device-authentication/ssh-authentication.mdx) and [CLI application authentication](../../authentik-agent/device-authentication/cli-app-authentication/index.mdx), the device must be connected to an authentik deployment. To do so, follow these steps:

1. Open a Terminal session and run the following command:

```sh
ak config setup --authentik-url https://authentik.company
```

2. Your default browser opens the authentik login page. After you authenticate, the authentik Agent is configured.

## Check version of installed components

You can check the version of all installed authentik components by running the following command:

```bash
ak version
```

## View logs

Both the system agent and the user agent use macOS's native logging abilities. To retrieve their logs, open the Console application and filter for the process you're interested in, or run one of the following commands.

For the system agent:

```sh
log show --predicate 'process == "ak-sysd"'
```

For the user agent:

```sh
log show --predicate 'process == "ak-agent-desktop"'
```

## Troubleshooting

### The Agent shows "disconnected" or lists no profiles

Joining the device to a domain enrolls the *device*, but the desktop Agent stays disconnected until a *user profile* exists. If the Agent app shows **disconnected** with no profiles, or `ak whoami` returns `profile not found`, you haven't yet completed [SSH client authentication and CLI application authentication](#enable-ssh-client-authentication-and-cli-application-authentication):

1. Run `ak config setup --authentik-url https://authentik.company` and complete the browser sign-in.
2. Confirm that a profile now exists with `ak config list-profiles`, then verify with `ak whoami`.

If `ak config setup` doesn't open a login page, or reports an unknown client or a missing device code flow, your deployment is missing the OAuth prerequisites. Return to [configuring your authentik deployment](../configuration.mdx) and confirm that a **Device code flow** is set on the brand, that the `authentik-cli` OAuth application and provider exist, and that the Agent connector federates the `authentik-cli` provider under **Federated OIDC Providers**.

## Report issues

Please report issues and bugs via the [authentik Platform GitHub repository](https://github.com/goauthentik/platform).

---

## Deploy authentik Agent on Windows

## What it can do

- Retrieve host information and report it to authentik for [device compliance](../../device-compliance/index.mdx).
- Connect to Linux hosts with authentik credentials through [SSH authentication](../../authentik-agent/device-authentication/ssh-authentication.mdx).
- Authenticate to CLI applications with authentik credentials through [CLI application authentication](../../authentik-agent/device-authentication/cli-app-authentication/index.mdx).

The authentik Agent is currently only tested on Windows 11 and Windows Server 2022. Other versions may work but are untested.

## Windows Credential Provider

Windows Credential Provider (WCP) is a component of the authentik Agent that allows logging in to Windows workstations using authentik credentials.

It currently only supports local login; RDP login is not supported.

- When WCP is enabled, the password of the Windows user account that's used to log in is set to a random string.
- WCP can cause issues with user encrypted directories.
- Support with Active Directory has not been confirmed yet.
- Offline login is currently not supported.

## Prerequisites

You must [configure your authentik deployment](../configuration.mdx) to support the authentik Agent.

## Create an enrollment token

If you already have an enrollment token, skip to the [next section](#install-the-authentik-agent-on-windows).

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent.
4. Under **Enrollment Tokens**, click **New Enrollment Token**, and configure the following settings:
   - **Token name**: Provide a descriptive name for the token.
   - **Device group *(optional)***: Select a device access group to add the device to after enrollment.
   - **Expiring *(optional)***: Set whether the enrollment token expires.
5. Click **Create**.
6. *(Optional)* Click the **Copy** icon in the **Actions** column. You need this value to [join the device to an authentik domain](#join-the-device-to-an-authentik-domain).

## Install the authentik Agent on Windows

It's recommended to deploy the Agent via [MDM or automation tools](./automated.mdx) instead of manually configuring it.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the authentik Agent connector that you created when [configuring your authentik deployment](../configuration.mdx) to support the authentik agent.
4. Under **Setup**, click **Windows** to download the authentik Agent installer.
5. After the download completes, install the MSI file.
6. *(Optional)* During installation, select [Windows Credential Provider](#windows-credential-provider) if you want to log in to the Windows device using authentik credentials.
7. Confirm that the authentik Agent is installed by opening a PowerShell or Terminal window and entering the following command: `ak`

   You should see a response that starts with: `authentik CLI v<version_number>`

## Join the device to an authentik domain

Joining the device to an authentik domain is what enrolls it with your authentik deployment and issues it a device token. This step is required for [device compliance features](../../device-compliance/index.mdx) and for local device login.

1. Open a Terminal session as Administrator and run the following command:

```sh
"C:\Program Files\Authentik Security Inc\sysd\ak-sysd.exe" domains join <deployment_name> --authentik-url https://authentik.company
```

- `deployment_name` identifies the authentik deployment on the device.
- `https://authentik.company` is the fully qualified domain name of the authentik deployment.

2. Enter your [enrollment token](#create-an-enrollment-token) when prompted.
3. After you enter the token, authentik enrolls the device. The device appears on the [Devices page](../../manage-devices.mdx) after it [checks in](../../device-compliance/device-reporting.mdx).

## Enable SSH client authentication and CLI application authentication

To enable [initiating SSH connections](../../authentik-agent/device-authentication/ssh-authentication.mdx) and [CLI application authentication](../../authentik-agent/device-authentication/cli-app-authentication/index.mdx), the device must be connected to an authentik deployment. To do so, follow these steps:

1. Open a Terminal session and run the following command:

```sh
ak config setup --authentik-url https://authentik.company
```

2. Your default browser opens the authentik login page. After you authenticate, the authentik Agent is configured.

## Check version of installed components

You can check the version of all installed authentik components by running the following command:

```bash
ak version
```

## View logs

All components of the authentik Agent output logs to the "authentik" log in the Windows Event Viewer.

## Report issues

Please report issues and bugs via the [authentik Platform GitHub repository](https://github.com/goauthentik/platform).

---

## Device access groups

Device access groups control access to endpoint devices. You can organize devices into groups and bind users, user groups, and policies to determine which users can access the device.

Device access groups are **required** for [local device login](./local-device-login/index.mdx) to work. If a device is not assigned to an access group with the appropriate bindings, all login attempts to that device will be denied.

## Create a device access group

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Device Access Groups** and click **Create**.
3. Provide a **Group Name** and click **Create**.
4. Expand the newly created device access group.
5. Click either **Create and bind Policy** or **Bind existing Policy / Group / User**.
6. After you configure the desired access, click **Finish**.

## Assign devices to an access group

Assign devices during or after enrollment:

- **During enrollment**: When creating an enrollment token, select the device access group in the **Device Group** field. Any device that enrolls with this token is automatically added to the group.
- **After enrollment**: Navigate to **Endpoint Devices** > **Devices**, edit the device, and set the **Access group** field to the desired device access group.

---

## Device authentication

The [authentik Agent](../index.mdx) supports multiple types of authentication and authorization using authentik credentials:

- [Local device login](./local-device-login/index.mdx) - Log in to Windows endpoint devices.
- [SSH authentication](./ssh-authentication.mdx) - Connect from one endpoint device to another via SSH.
- [Authenticate CLI applications](./cli-app-authentication/index.mdx) - Authenticate CLI based applications like `aws` and `kubectl`.

[Device access groups](./device-access-groups.mdx) allow you to control which users have access to a device.

For more information, pick a topic below:

---

## SSH authentication

You can use the [authentik Agent](../index.mdx) to authenticate SSH connections between endpoint devices using authentik credentials.

Currently, only [Linux](../agent-deployment/linux.mdx) devices can serve as SSH endpoints. See [Configure SSH authentication on an endpoint device](#configure-ssh-authentication-on-an-endpoint-device) section for more details.

When connected to an endpoint device in this way, sudo authorization can be handled by the authentik agent.

## Prerequisites

- The [authentik Agent must be deployed](../agent-deployment/index.mdx) on both the source and SSH target devices.
- The target device needs to be configured, see the [Configure SSH authentication on an endpoint device](#configure-ssh-authentication-on-an-endpoint-device) section below.

## How to SSH to an endpoint device

To SSH to a configured [Linux host](../agent-deployment/linux.mdx) using the authentik Agent:

1. Configure your SSH config to use the authentik Agent's SSH Identity Agent:

Edit `~/.ssh/config` and add the following:

```shell
Host *
    IdentityAgent "~/Library/Application Support/authentik/agent-ssh.sock"
```

Edit `~/.ssh/config` and add the following:

```shell
Host *
    ForwardAgent yes
    IdentityAgent "~/.local/share/authentik/agent-ssh.sock"
```

2. Open a Terminal session and run the following command:

```shell
ssh <hostname>
```

2. If you are not already authenticated, enter your authentik credentials when prompted.
3. After authentication, the SSH session connects.

## Configure SSH authentication on an endpoint device

Authentication is only possible if the Linux device is aware of the authentik user which is attempting to authenticate. This can be achieved in one of two ways:

1. **Provision user accounts** - Create users on the Linux device with usernames that match authentik users that need to authenticate to the device. This can be done manually or via automation tools like Ansible.
2. **`libnss-authentik`** - This is a package that can be installed on the Linux device. It is an NSS module that makes the Linux device aware of authentik users. Similar to adding a Linux device to an Active Directory or LDAP domain.

---

## authentik Agent Releases

Release notes for recent authentik Agent versions

---

## x.x.x

## Highlights

<!-- Highlights, new features across all components/platforms -->

## Breaking changes

<!-- Breaking changes -->

## Known issues

<!-- Known issues -->

## Component changes

### authentik Agent

### authentik System Agent

### ak CLI

### libpam-authentik

### libnss-authentik

### Browser extension

---

## Release 0.35

## Highlights

Initial release

## Known issues

- [Device compliance is not possible with Safari on macOS yet.](https://github.com/goauthentik/platform/issues/358)
- [.rpm packages for Linux are in preview and untested](https://github.com/goauthentik/platform/issues/427)

## Component changes

### authentik Agent

- Authenticate via OAuth device flow

### authentik System Agent

- Initial base facts reporting
- Device authentication

### ak CLI

- Support for `aws` and `kubectl` CLI for authentication
- Support for `ssh` to access remote hosts via authentik token.
- Forward agent connection for authentication on remote systems.

### libpam-authentik

- Authenticate via authentik token

### libnss-authentik

- Expose authentik users as unix users

### Browser extension

- Device compliance through the system agent
- Available for Chrome, Firefox and Microsoft Edge

---

## Release 0.40

## Highlights

- **FIDO2 support for Linux local authentication**:  Users can now use WebAuthn authenticators registered in authentik to log in to Linux machines.

## Known issues

- [Device compliance is not possible with Safari on macOS yet.](https://github.com/goauthentik/platform/issues/358)

## Component changes

### authentik Agent

- Fix cached token exchange when keyring is not supported ([https://github.com/goauthentik/platform/commit/5878200a11b9a9d03a33878d4b6a9ab53cdd6918](https://github.com/goauthentik/platform/commit/5878200a11b9a9d03a33878d4b6a9ab53cdd6918))
- Fix macOS package post-install script not running ([https://github.com/goauthentik/platform/pull/669](https://github.com/goauthentik/platform/pull/669))

### authentik System Agent

- Fix interactive authentication failing on platforms without session manager ([https://github.com/goauthentik/platform/pull/694](https://github.com/goauthentik/platform/pull/694))
- Fix enrollment failing on Windows machines without serial number ([https://github.com/goauthentik/platform/pull/693](https://github.com/goauthentik/platform/pull/693))

### libpam-authentik

- Authenticate via authentik token

---

## authentik Agent connector

The authentik Agent connector allows device information to be reported by the [authentik Agent](../../authentik-agent/index.mdx).

Unlike other connectors, the agent connector is used directly by the agent itself, rather than communicating with external systems or APIs. As a result, its behavior and functionality differ from those of other connectors.

The agent connector mainly holds configuration for the agent itself, as well as implementing certain platform-specific protocols like Apple's Platform SSO.

## Configure the authentik Agent connector

Follow these instructions to configure the authentik Agent connector:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Agent Connector** as the connector type, click **Next**, and configure the following required settings:
   - **Connector name**: provide a descriptive name for the connector.
   - **Refresh interval**: select how often the agent updates its configuration.
   - **Enabled**: enable or disable the connector.
4. Click **Finish**.

## Configure Challenge Key

The Agent connector requires a **Challenge Key** (certificate keypair) to be configured when using the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). This keypair is used to sign challenges sent to the [browser extension](../browser-extension.mdx) for device verification.

Without a **Challenge Key** configured, the Endpoint Stage will silently skip device verification.

To configure a **Challenge Key**:

1. Navigate to **System** > **Certificates** and create a new certificate keypair, or select an existing one.
2. Navigate to **Endpoint Devices** > **Connectors** and edit your Agent connector.
3. Set the **Challenge Key** field to your certificate keypair.
4. Click **Update**.

After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). Refer to [Device compliance policy](../device-compliance-policy.mdx) for more information on using device facts from the connector in a flow.

---

## Fleet connector

[Fleet](https://fleetdm.com/) is an open-source device management platform designed to monitor, manage, and secure large fleets of devices.

The Fleet connector reports device information from your Fleet deployment, and optionally auto-assigns users to devices.

## Preparation

- Take note of your Fleet Server URL, which is typically the URL used to access your Fleet instance. Alternatively, you can find the URL by logging in to the Fleet admin panel and navigating to **Settings** > **Organization settings** > **Fleet web address**.
- Follow the [Fleet documentation for creating an API-only user](https://fleetdm.com/guides/fleetctl#using-fleetctl-with-an-api-only-user) and take note of its API key.

Do not use an API key from a normal user because these keys expire.

## Configure the Fleet connector

Follow these instructions to configure the Fleet connector in authentik:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.
3. Select **Fleet Connector** as the connector type, click **Next**, and configure the following settings:
   - **Connector name**: provide a descriptive name for the connector.
   - **Fleet Server URL**: enter your **Fleet web address** URL.
   - **Fleet API Token**: enter the API key of an API-only user.
   - **Map users**: enable if you want users associated with the device in Fleet to be automatically [given access to the device via the authentik Agent](../../authentik-agent/device-authentication/index.mdx).
   - **Map teams to device access group**: enable if you want groups associated with the device in Fleet to be automatically mapped to a [device access group](../../authentik-agent/device-authentication/device-access-groups.mdx) and [given access to the device via the authentik Agent](../../authentik-agent/device-authentication/index.mdx).
4. Click **Finish**.

The **Map teams to device access group** setting does not detect changes to a device's group membership in Fleet. If the device's groups change, manually configure a [device access group](../../authentik-agent/device-authentication/device-access-groups.mdx).

After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). Refer to [Fleet conditional access](../fleet-conditional-access.mdx) and [Device compliance policy](../device-compliance-policy.mdx) for more information on using device facts from the connector in a flow.

---

## Google Chrome connector

With this connector, authentik can validate users' Chrome browsers and ensure that users' devices are compliant and up-to-date.

Support for the Chrome Enterprise Device Trust connector allows organizations to integrate Chrome browsers and ChromeOS devices with authentik as the Identity Provider (IdP), to strengthen their overall security posture.

Device Trust is particularly important in environments with many different device types that are used by a large, remote workforce that might have a BYOD (Bring Your Own Device) policy, or have large teams of contractors, temporary workers, or volunteers.

With Device Trust you can enable "context-aware" access policies; for example a policy might require that a device have all security patches installed.

This connector only works with Google Chrome, as it relies on the [Chrome Verified Access API](https://developers.google.com/chrome/verified-access).

## Configuration

The main steps to set up your Google workspace are as follows:

- [Create a Google cloud project](#create-a-google-cloud-project)
- [Create a service account](#create-a-service-account)
- [Set credentials for the service account](#set-credentials-for-the-service-account)
- [Create the connector](#create-the-connector)

For detailed instructions, refer to Google documentation.

### Create a Google cloud project

1. Log in to the [Google Cloud Console](https://cloud.google.com/cloud-console) as an administrator.
2. In the upper left, click the drop-down box to open the **Select a project** box, and then select **New Project**.
3. Create a new project and give it a name like "authentik Chrome Device Trust".
4. Use the search bar at the top of your new project page to search for "API Library".
5. On the **API Library** page, use the search bar again to find "Chrome Verified Access API".
6. On the **Chrome Verified Access API** page, click **Enable**.

### Create a service account

1. After the new Chrome Verified Access API is enabled (it might take a few minutes), return to the Google Cloud console home page (click on **Google Cloud** in the upper left).
2. Use the search bar to find and navigate to the **IAM** page.
3. On the **IAM** page, click **Service Accounts** in the left navigation pane.
4. At the top of the **Service Accounts** page, click **Create Service Account**.

- Under **Service account details** page, define the **Name** and **Description** for the new service account, and then click **Create and Continue**.
- Under **Grant this service account access to project** you do not need to define a role, so click **Continue**.
- Under **Grant users access to project** you do not need to define a role, so click **Done** to complete the creation of the service account.

### Set credentials for the service account

1. On the **Service Accounts** page, click the account that you just created.
2. Click the **Keys** tab at top of the page, then click **Add Key** > **Create new key**.
3. In the Create box, select JSON as the key type, and then click **Create**.
   A pop-up displays with the private key, and the key is saved to your computer as a JSON file.
   Later, when you create the connector in authentik, you will add this key in the **Credentials** field.
4. On the service account page, click the **Details** tab, and expand the **Advanced settings** area.
5. Log in to the Admin Console, and then navigate to **Chrome browser** > **Connectors**.
6. Click on **New Provider Configuration**.
7. Under **Universal Device Trust**, click **Set up**.
8. Provide a name and set the URL to `https://authentik.company/endpoint/gdtc/chrome/`.
9. Under **Service Accounts**, enter the full name of the service account created above, for example `authentik-gdtc@authentik-enterprise-dev.iam.gserviceaccount.com`.

### Create the connector

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Endpoint Devices** > **Connectors** and click **New Endpoint Connector**.

3. Select **Google Device Trust Connector** as the connector type, click **Next**, and configure the following settings:
   - **Name**: define a descriptive name, such as "chrome-device-trust".
   - **Google Verified Access API**
     - **Credentials**: paste the contents of the JSON file (the key) that you downloaded earlier.

4. Click **Finish**.

After creating the connector, it can be used in the [Endpoint Stage](../../../add-secure-apps/flows-stages/stages/endpoint/index.mdx). Refer to [Device compliance policy](../device-compliance-policy.mdx) for more information on using device facts from the connector in a flow.

---

## Connectors

Connectors allow device information to be reported to authentik. Connectors for third-party services like Fleet can be used standalone or alongside the [authentik Agent](../../authentik-agent/index.mdx) connector.

## Available connectors

The following connectors are currently available:

- [authentik Agent connector](./authentik-agent.mdx): Integrates with the [authentik Agent](../../authentik-agent/index.mdx)
- [Fleet connector](./fleetdm.mdx): Integrates with [Fleet](https://fleetdm.com/) device management

Connectors are in development for Entra, Intune, Cloudflare WARP and other services.

## Manage connectors

Use the following instructions to manage your connectors:

### Add a connector

For more specific instructions on adding a connector refer to the [authentik Agent connector](./authentik-agent.mdx) or [Fleet connector](./fleetdm.mdx) documentation.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors** and click **Create**.
3. Select the connector type, click **Next**, and configure the following required settings:
   - **Connector name**: Provide a descriptive name for the connector.
   - **Refresh interval**: Select how often the agent updates its configuration.
   - **Enabled**: Enable or disable the connector.
4. Click **Finish**.

### Edit a connector

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Click on the connector that you wish to edit.
4. Update any settings that you want to change.
5. Click **Update**.

### Delete a connector

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Endpoint Devices** > **Connectors**.
3. Select the connector that you wish to delete.
4. Click **Delete**.

---

## Autoscaling with the Helm chart HPA

The authentik [Helm chart](../../../install-config/install/kubernetes.mdx) can create a Horizontal Pod Autoscaler (HPA) for either the server or worker Deployment. This guide configures server scaling based on average CPU utilization. For queue-based worker scaling, see [KEDA](./keda.mdx).

## Prerequisites

- An existing authentik Helm chart installation and its `values.yaml` file.
- A working [resource-metrics API](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-metrics-apis) (`metrics.k8s.io`), usually provided by [Metrics Server](https://kubernetes-sigs.github.io/metrics-server/). Every container in the server pods needs a CPU request for pod CPU utilization to be defined.

## Configure the Helm chart

Add the following settings to the `server` section of your existing `values.yaml`. Preserve your other settings.

```yaml title="values.yaml (excerpt)"
server:
    autoscaling:
        enabled: true
        minReplicas: 2
        maxReplicas: 5
        targetCPUUtilizationPercentage: 75
        behavior:
            scaleDown:
                stabilizationWindowSeconds: 300
    resources:
        requests:
            cpu: 500m
```

The HPA targets an average CPU utilization of 75% across server pods, measured against their CPU requests. With the single-container pods shown here, each requesting 500m CPU, that is an average of 375m per pod. Adjust the CPU request, replica limits, and target for your workload.

With chart autoscaling enabled, the server Deployment omits `spec.replicas`. When switching from a fixed replica count, [this can briefly reduce the Deployment to one replica](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#migrating-deployments-and-statefulsets-to-horizontal-autoscaling) before the HPA reconciles it. Account for this temporary capacity reduction when planning the upgrade.

## Deploy and verify

If switching from KEDA, remove the server ScaledObject before enabling the chart's HPA. Make the change during a quiet period and check the replica count afterward.

These commands assume a Helm release named `authentik` and a server Deployment and HPA named `authentik-server`, all in the current namespace. Adjust the names and namespace to match your installation.

Upgrade the release with your updated `values.yaml`, then inspect the HPA:

```shell
helm upgrade authentik authentik/authentik -f values.yaml
kubectl get hpa authentik-server
kubectl describe hpa authentik-server
kubectl get deployment authentik-server --watch
```

## Capacity and tuning

- Run server replicas on different nodes to maintain [availability](../../../install-config/high-availability.mdx) if a node fails.
- Additional replicas increase PostgreSQL connection demand. They do not resolve bottlenecks in the database or external services. Server capacity also depends on [`AUTHENTIK_WEB__WORKERS`](../../../install-config/configuration/configuration.mdx#authentik_web__workers) and [`AUTHENTIK_WEB__THREADS`](../../../install-config/configuration/configuration.mdx#authentik_web__threads).
- Tune `behavior.scaleDown.stabilizationWindowSeconds` to avoid frequent changes in replica count. The chart also supports a worker HPA with `worker.autoscaling.enabled: true`, but CPU usage alone can miss a task backlog when workers wait on external services.
- To scale on other signals, set `server.autoscaling.metrics` or `worker.autoscaling.metrics` and provide the corresponding Kubernetes metrics API. A nonempty `metrics` list replaces the chart-generated CPU and memory metrics, so include a CPU resource metric if you also want CPU-based scaling.

---

## Autoscaling on Kubernetes

On Kubernetes, you can automatically adjust the number of authentik server and worker replicas independently:

- [Scale servers on CPU usage with the Helm chart's Horizontal Pod Autoscaler (HPA)](./hpa.mdx). This requires Kubernetes resource metrics, but does not require KEDA or Prometheus.
- [Scale workers on queued tasks with KEDA](./keda.mdx). Queue length can reveal a backlog even when workers use little CPU, such as when they wait for external services. The metric includes delayed tasks and excludes tasks already running.

Keep at least one worker running to handle scheduled tasks and file changes. For the number of tasks each replica can run concurrently, see [Worker scaling](../worker.mdx#scaling).

---

## Autoscaling with KEDA

[KEDA](https://keda.sh/docs/) can scale authentik servers on CPU usage and workers on queued tasks.

A KEDA [ScaledObject](https://keda.sh/docs/latest/reference/scaledobject-spec/) defines which Deployment to scale and which metrics to use. KEDA creates a Horizontal Pod Autoscaler (HPA) for that Deployment. Disable the chart's HPA for any Deployment managed by KEDA so that two HPAs do not compete. If you only need CPU-based server scaling, the [chart HPA](./hpa.mdx) requires fewer components.

## Prerequisites

- An existing authentik [Helm chart installation](../../../install-config/install/kubernetes.mdx) and its `values.yaml` file.
- [KEDA installed](https://keda.sh/docs/latest/deploy/) at a version compatible with your Kubernetes cluster. Installing the Helm chart without `--version` selects the latest chart version from the repository. The KEDA links in this guide refer to the latest version; use the documentation for your installed version if it differs.
- For server CPU scaling, a working resource-metrics API, usually provided by [Metrics Server](https://kubernetes-sigs.github.io/metrics-server/). Every container in the server pods needs a CPU request for [pod CPU utilization](https://keda.sh/docs/latest/scalers/cpu/#prerequisites) to be defined.
- For worker queue scaling, a Prometheus query endpoint that KEDA can reach and that contains authentik's [worker metrics](../monitoring.mdx#metrics). This example assumes that you have Prometheus managed by the [Prometheus Operator](https://prometheus-operator.dev/docs/getting-started/installation/). The Operator uses the chart's `ServiceMonitor` to configure Prometheus to scrape worker metrics. KEDA queries Prometheus, not authentik's metrics endpoint.

## Configure the Helm chart

Add the following settings to the `server` and `worker` sections of your existing `values.yaml`. If KEDA will manage only one Deployment, update only that section. Preserve your other settings.

```yaml title="values.yaml (excerpt)"
server:
    replicas: 2
    autoscaling:
        enabled: false
    resources:
        requests:
            cpu: 500m
worker:
    replicas: 1
    autoscaling:
        enabled: false
    metrics:
        enabled: true
        serviceMonitor:
            enabled: true
```

With the chart defaults and release name `authentik`, `worker.metrics.enabled: true` creates a `ClusterIP` Service named `authentik-worker-metrics` on port 9300. The ServiceMonitor specifies `/metrics` as the scrape path. Keep the unauthenticated metrics Service internal.

The Prometheus resource must select both the ServiceMonitor's namespace and its labels:

- `serviceMonitorNamespaceSelector` must include the namespace containing the ServiceMonitor, which defaults to authentik's namespace. An omitted or null selector searches only the Prometheus resource's own namespace.
- `serviceMonitorSelector` must match the ServiceMonitor's labels. Set `worker.metrics.serviceMonitor.labels` in your Helm values to add any labels that Prometheus requires.

When switching from the chart HPA, disable it before applying the ScaledObjects. Without the chart HPA, Helm writes `spec.replicas` from `server.replicas` and `worker.replicas`. Switching autoscalers and later Helm upgrades can temporarily reset the replica counts until the HPA reconciles them. Choose replica values that provide enough capacity during that interval, and check the counts after upgrades.

## Configure the ScaledObjects

Create ScaledObject in the same namespace as its target Deployment. These examples use `authentik-server` and `authentik-worker` in the current namespace. Adjust the names and namespaces (including the worker query's `namespace` selector) to match your installation. Tune replica limits and thresholds for your workload.

### Server CPU usage

This trigger targets an average CPU utilization of 75% across server pods, measured against their CPU requests. For single-container pods requesting 500m CPU each, the target is an average of 375m per pod. The example keeps at least two server replicas running.

```yaml title="server-scaledobject.yaml"
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
    name: authentik-server
spec:
    scaleTargetRef:
        name: authentik-server
    minReplicaCount: 2
    maxReplicaCount: 5
    advanced:
        horizontalPodAutoscalerConfig:
            behavior:
                scaleDown:
                    stabilizationWindowSeconds: 300
    triggers:
        - type: cpu
          metricType: Utilization
          metadata:
              value: "75"
```

### Worker queue length

`authentik_tasks_queued` counts tasks in the `QUEUED` state by queue and actor. It includes delayed tasks that are not yet due to run (`eta`). It excludes tasks in progress, tasks waiting for dependencies, and future recurring runs that have not been enqueued. A large number of delayed tasks can therefore cause workers to scale up even when there is little work ready to run.

Each worker exports the queue length from the shared database. The query below takes the maximum per queue and actor before summing, so it does not count the same tasks once for every worker. Because workers are scraped at different times, the result can temporarily reflect an older, higher count.

This example queries a Prometheus Service named `prometheus` in the `monitoring` namespace. Set `serverAddress` to your Prometheus endpoint.

```yaml title="worker-scaledobject.yaml"
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
    name: authentik-worker
spec:
    scaleTargetRef:
        name: authentik-worker
    minReplicaCount: 1
    maxReplicaCount: 5
    advanced:
        horizontalPodAutoscalerConfig:
            behavior:
                scaleDown:
                    stabilizationWindowSeconds: 300
    triggers:
        - type: prometheus
          metricType: AverageValue
          metadata:
              serverAddress: http://prometheus.monitoring.svc:9090
              query: 'sum(max by (queue_name, actor_name) (authentik_tasks_queued{service="authentik-worker-metrics"}))'
              threshold: "20"
              ignoreNullValues: "false"
```

Adjust the `service` selector (and potentially add a `namespace` selector if running multiple authentik instances) if your Prometheus series use different labels. Workers publish zero for registered actors when their queues are empty.

If the query returns no series, `ignoreNullValues: "false"` makes KEDA report an error. This does not detect every scrape failure: another worker can still provide matching series. Monitor Prometheus target health as well. If Prometheus requires authentication, configure a KEDA [TriggerAuthentication](https://keda.sh/docs/latest/concepts/authentication/).

With `metricType: AverageValue`, `threshold: "20"` sets a target of 20 queued tasks per worker replica. A total queue length of 100 produces a desired count of five replicas, subject to HPA tolerance, stabilization, and replica limits. Adjust the threshold based on how quickly one replica processes tasks and how long tasks can wait.

## Deploy and verify

Upgrade your Helm release with the updated `values.yaml`. This command assumes a release named `authentik` in the current namespace; adjust both to match your installation:

```shell
helm upgrade authentik authentik/authentik -f values.yaml
```

If scaling workers, check that the `ServiceMonitor` exists:

```shell
kubectl get servicemonitor authentik-worker
```

Before applying the worker ScaledObject, check in Prometheus that the worker targets are UP and the query above returns one value. A ServiceMonitor alone does not confirm that Prometheus scraped the metrics.

Apply the ScaledObjects and inspect the HPAs that KEDA creates. If scaling only one Deployment, omit the other file and its HPA inspection command:

```shell
kubectl apply -f server-scaledobject.yaml -f worker-scaledobject.yaml
kubectl get scaledobject,hpa,deployment
kubectl describe hpa keda-hpa-authentik-server
kubectl describe hpa keda-hpa-authentik-worker
```

For worker scaling, watch `kubectl get deployment authentik-worker --watch` as tasks enter and leave the queue. For CPU scaling, watch `kubectl get deployment authentik-server --watch` under server load.

## Capacity and tuning

- Keep at least one worker for scheduled tasks and file monitoring. For [high availability](../../../install-config/high-availability.mdx), run at least two replicas of each component and schedule them on different nodes.
- Worker concurrency also depends on [`AUTHENTIK_WORKER__PROCESSES`](../../../install-config/configuration/configuration.mdx#authentik_worker__processes) and [`AUTHENTIK_WORKER__THREADS`](../../../install-config/configuration/configuration.mdx#authentik_worker__threads). Additional replicas increase PostgreSQL connection demand. They do not resolve bottlenecks in the database or external services.
- Tune `scaleDown.stabilizationWindowSeconds` to avoid frequent changes in replica count. KEDA's `cooldownPeriod` applies only when scaling to zero, so it has no effect with the minimum replica counts shown here.
- The queue metric excludes tasks in progress. Scaling down can interrupt active work, and the stabilization window does not guarantee that tasks finish. Review [task time limits](../worker.mdx#time-limits) and `worker.terminationGracePeriodSeconds` (30 seconds by default) for your workload.
- Each worker metrics scrape refreshes the shared queued-task count from PostgreSQL. More worker replicas mean more database queries during scraping. Monitor database load when scaling on this metric.

---

## S3-compatible storage

authentik can store uploaded files in Amazon S3 or an S3-compatible object storage service instead of storing them on the local filesystem in `/data`.

This guide covers the settings, permissions, and migration steps that are common to S3 storage. For service-specific endpoints and authentication details, see [S3-compatible storage providers](./providers.mdx).

For the full list of storage configuration options, see the [configuration reference](../../../install-config/configuration/configuration.mdx#s3-storage-backend-settings).

## Prepare storage

Before you configure authentik, create or identify the following values:

- An S3 bucket for authentik files, for example `<bucket_name>`.
- S3 access credentials, unless you use AWS SDK authentication such as an instance role or profile.
- The S3 endpoint URL for your storage service, unless you use Amazon S3.
- The public origin that users use to access authentik, for example `https://authentik.company`.

The examples on this page use the AWS CLI. For S3-compatible services, add the service endpoint with `--endpoint-url=<s3_endpoint>`.

## Configure bucket permissions

authentik needs permission to list bucket contents and to read, write, and delete objects in the bucket. For Amazon S3, the following IAM policy grants those permissions:

```json title="authentik-s3-policy.json"
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": ["s3:ListBucket"],
            "Resource": "arn:aws:s3:::<bucket_name>"
        },
        {
            "Sid": "ManageObjects",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": "arn:aws:s3:::<bucket_name>/*"
        }
    ]
}
```

For other S3-compatible services, create an equivalent policy in the service's access-control system.

## Configure CORS

Apply a cross-origin resource sharing (CORS) policy to the bucket so that the authentik web interface can load files directly from generated S3 URLs.

Save the following policy as `cors.json`. Replace `https://authentik.company` with your authentik origin, including the scheme and port if you use a non-standard port.

```json title="cors.json"
{
    "CORSRules": [
        {
            "AllowedOrigins": ["https://authentik.company"],
            "AllowedHeaders": ["Authorization"],
            "AllowedMethods": ["GET"],
            "MaxAgeSeconds": 3000
        }
    ]
}
```

If users access authentik from more than one domain, include each origin in `AllowedOrigins`.

Apply the policy:

```bash
AWS_ACCESS_KEY_ID=<access_key> AWS_SECRET_ACCESS_KEY=<secret_key> aws s3api \
  --endpoint-url=<s3_endpoint> \
  put-bucket-cors \
  --bucket=<bucket_name> \
  --cors-configuration=file://cors.json
```

For Amazon S3, omit `--endpoint-url`.

## Configure authentik

Add the following settings to your `.env` file:

```env
AUTHENTIK_STORAGE__BACKEND=s3
AUTHENTIK_STORAGE__S3__ACCESS_KEY=<access_key>
AUTHENTIK_STORAGE__S3__SECRET_KEY=<secret_key>
AUTHENTIK_STORAGE__S3__BUCKET_NAME=<bucket_name>
```

If you use AWS SDK authentication, such as an instance role or profile, omit `AUTHENTIK_STORAGE__S3__ACCESS_KEY` and `AUTHENTIK_STORAGE__S3__SECRET_KEY`. See `AUTHENTIK_STORAGE__S3__SESSION_PROFILE` and related options in the [configuration reference](../../../install-config/configuration/configuration.mdx#s3-storage-backend-settings).

For other S3-compatible services, also configure the service endpoint:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=<s3_endpoint>
```

The [provider reference](./providers.mdx) lists service-specific endpoint and region values.

### Configure a public S3 hostname

Set `AUTHENTIK_STORAGE__S3__CUSTOM_DOMAIN` only when the hostname that authentik uses to reach S3 is different from the hostname that browsers use to retrieve files.

```env
AUTHENTIK_STORAGE__S3__CUSTOM_DOMAIN=<public_s3_domain>/<bucket_name>
```

The custom domain must include the bucket name and must not include a scheme. For example, if users retrieve objects from `https://s3.company/authentik-data/`, set:

```env
AUTHENTIK_STORAGE__S3__CUSTOM_DOMAIN=s3.company/authentik-data
```

`AUTHENTIK_STORAGE__S3__SECURE_URLS` controls whether generated file URLs use HTTPS and defaults to `true`.

### Configure compatibility options

If your storage service requires path-style bucket addressing, set:

```env
AUTHENTIK_STORAGE__S3__ADDRESSING_STYLE=path
```

If your storage service supports only legacy S3 signatures, set:

```env
AUTHENTIK_STORAGE__S3__SIGNATURE_VERSION=s3
```

The default signature version is `s3v4`.

For local HTTP testing, set `AUTHENTIK_STORAGE__S3__SECURE_URLS=false`. Use HTTPS for production deployments.

## Check file content types

Browsers rely on the HTTP `Content-Type` header to decide whether to render a file as an image, HTML, or another format. authentik sets the content type when it uploads files. If you upload files to the bucket with another tool, ensure that the tool also writes the correct `Content-Type` metadata.

The following command updates the `Content-Type` metadata for PNG files in a bucket:

```bash
aws s3 cp \
  s3://<bucket_name>/ s3://<bucket_name>/ \
  --exclude "*" --include "*.png" \
  --no-guess-mime-type \
  --content-type "image/png" \
  --metadata-directive "REPLACE" \
  --recursive
```

Terraform uploads to S3 do not set the `Content-Type` header unless you configure the metadata explicitly.

## Migrate between storage backends

The following examples assume that the local storage path is `/data` and the bucket is `<bucket_name>`. Ensure that your AWS CLI configuration can reach your storage service. For services other than Amazon S3, include `--endpoint-url=<s3_endpoint>`.

### Migrate from file storage to S3

Follow the setup steps above, then sync files from the local directory to the bucket root:

```bash
aws s3 sync /data s3://<bucket_name>/
```

For services other than Amazon S3:

```bash
aws --endpoint-url=<s3_endpoint> s3 sync /data s3://<bucket_name>/
```

### Migrate from S3 to file storage

```bash
aws s3 sync s3://<bucket_name>/ /data
```

For services other than Amazon S3:

```bash
aws --endpoint-url=<s3_endpoint> s3 sync s3://<bucket_name>/ /data
```

---

## S3-compatible storage providers

Configure the shared settings in [S3-compatible storage](./index.mdx), then use the section for your storage service to set its endpoint and authentication options.

The authentik project does not test releases against every service listed on this page. S3 implementations differ, so verify uploads, downloads, deletes, and generated file URLs with your selected service before using it in production.

## Amazon S3

Use Amazon S3 as the storage backend for authentik files without configuring a custom endpoint.

Set the bucket's region and do not set `AUTHENTIK_STORAGE__S3__ENDPOINT`:

```env
AUTHENTIK_STORAGE__S3__REGION=<region>
```

If authentik runs on AWS with an instance role, task role, web identity, or AWS profile, you can omit `AUTHENTIK_STORAGE__S3__ACCESS_KEY` and `AUTHENTIK_STORAGE__S3__SECRET_KEY`.

For details about creating a bucket and credentials, see the [Amazon S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html).

## Cloudflare R2

Use Cloudflare R2 as an S3 storage backend for authentik by connecting to R2's S3-compatible API.

Set the endpoint for your Cloudflare account and use the `auto` region:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=https://<account_id>.r2.cloudflarestorage.com
AUTHENTIK_STORAGE__S3__REGION=auto
```

For details about API credentials and jurisdiction-specific endpoints, see the [Cloudflare R2 S3 API documentation](https://developers.cloudflare.com/r2/api/s3/api/).

## Backblaze B2

Use Backblaze B2 as an S3 storage backend for authentik by connecting to the Backblaze S3-compatible API.

Set the endpoint and region that Backblaze displays for your bucket:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=https://s3.<region>.backblazeb2.com
AUTHENTIK_STORAGE__S3__REGION=<region>
```

Use the application key ID as `AUTHENTIK_STORAGE__S3__ACCESS_KEY` and the application key as `AUTHENTIK_STORAGE__S3__SECRET_KEY`. Backblaze supports signature version 4, which is the authentik default.

For details about supported operations and credentials, see the [Backblaze B2 S3-compatible API documentation](https://www.backblaze.com/docs/cloud-storage-s3-compatible-api).

## Wasabi

Use Wasabi as an S3 storage backend for authentik by connecting to Wasabi's S3-compatible API.

Set the endpoint and region that match the bucket's location:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=https://s3.<region>.wasabisys.com
AUTHENTIK_STORAGE__S3__REGION=<region>
```

For the current list of service URLs, see [Wasabi storage region endpoints](https://docs.wasabi.com/v1/docs/service-urls-for-wasabis-storage-regions).

## Google Cloud Storage

Use Google Cloud Storage as an S3 storage backend for authentik by connecting to its XML API interoperability layer.

Create a hash-based message authentication code (HMAC) key for a service account, then configure the XML API endpoint:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=https://storage.googleapis.com
```

Use the HMAC access ID as `AUTHENTIK_STORAGE__S3__ACCESS_KEY` and the HMAC secret as `AUTHENTIK_STORAGE__S3__SECRET_KEY`.

For details about creating and managing keys, see the [Google Cloud Storage HMAC key documentation](https://cloud.google.com/storage/docs/authentication/managing-hmackeys).

## Garage

Use Garage as a self-hosted S3 storage backend for authentik by connecting to its S3-compatible API.

Set the endpoint and region from the Garage `s3_api` configuration:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=https://<garage_s3_endpoint>
AUTHENTIK_STORAGE__S3__REGION=<garage_s3_region>
```

For details about creating a bucket and key, see the [Garage documentation](https://garagehq.deuxfleurs.fr/documentation/).

## SeaweedFS

Use SeaweedFS as a self-hosted S3 storage backend for authentik by connecting to the SeaweedFS S3 API.

Set the public endpoint for your SeaweedFS S3 service:

```env
AUTHENTIK_STORAGE__S3__ENDPOINT=https://<seaweedfs_s3_endpoint>
```

For details about configuring the S3 service and credentials, see the [SeaweedFS S3 API documentation](https://github.com/seaweedfs/seaweedfs/wiki/Amazon-S3-API).

---

## Sources expression property mappings

The property mapping should return a value that is expected by the source. Returning `None` is always accepted and skips the mapping that returned `None`.

## Variables

- Arbitrary arguments given by the source (this is documented by the source).

- `properties`: A Python dictionary containing the result of the previously run property mappings, plus the initial data computed by the source.

- `request`: The current request. This can be `None` if there is no contextual request. See the [Django documentation](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects).

- `ak_logger`: structlog BoundLogger. See [structlog documentation](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger)

  Example:

  ```python
  ak_logger.debug("This is a test message")
  ak_logger.warning("This will be logged with a warning level")
  ak_logger.info("Passing structured data", request=request)
  ```

- `requests`: requests Session object. See [requests documentation](https://requests.readthedocs.io/en/master/user/advanced/)

## Available functions

### `regex_match(value: Any, regex: str) -> bool`

Check if `value` matches Regular Expression `regex`.

Example:

```python
return regex_match(request.user.username, '.*admin.*')
```

### `regex_replace(value: Any, regex: str, repl: str) -> str`

Replace anything matching `regex` within `value` with `repl` and return it.

Example:

```python
user_email_local = regex_replace(request.user.email, '(.+)@.+', '')
```

### `list_flatten(value: list[Any] | Any) -> Optional[Any]`

Flatten a list by either returning its first element, None if the list is empty, or the passed in object if it's not a list.

Example:

```python
user = list_flatten(["foo"])
# user = "foo"
```

### `ak_call_policy(name: str, **kwargs) -> PolicyResult`

Call another policy with the name *name*. The current request is passed to the policy. Keyword arguments
can be used to modify the request's context.

Example:

```python
result = ak_call_policy("test-policy")
# result is a PolicyResult object, so you can access `.passing` and `.messages`.
# Starting with authentik 2023.4, you can also access `.raw_result`, which is the raw value returned from the called policy
# `result.passing` will always be a boolean if the policy is passing or not.
return result.passing

result = ak_call_policy("test-policy-2", foo="bar")
# Inside the `test-policy-2` you can then use `request.context["foo"]`
return result.passing
```

If the called policy raises an exception, `ak_call_policy` does not propagate it. A failing `PolicyResult`
is returned (`.passing` will be `False`), with the error message available in `.messages`.

If no policy matches *name*, a `ValueError` is raised and the **calling** policy fails.

### `ak_is_group_member(user: User, **group_filters) -> bool`

Check if `user` is member of a group matching `**group_filters`.

Example:

```python
return ak_is_group_member(request.user, name="test_group")
```

### `ak_user_by(**filters) -> Optional[User]`

Fetch a user matching `**filters`.

Returns `None` if no user was found; otherwise, returns the [User](../../users-sources/user/index.mdx) object.

Example:

```python
# Find user by username
other_user = ak_user_by(username="other_user")

# Find user by custom attribute
other_user = ak_user_by(attributes__<custom_attribute_name>="<value>")
```

### `ak_user_has_authenticator(user: User, device_type: Optional[str] = None) -> bool`

Check if a user has any authenticator devices. Only fully validated devices are counted.

Optionally, you can filter by a specific device type. The following options are valid:

- `totp`
- `duo`
- `static`
- `webauthn`

Example:

```python
return ak_user_has_authenticator(request.user)
```

### `ak_create_event(action: str, **kwargs) -> None`

Create a new event with the action set to `action`. Any additional keyword parameters will be saved in the event context. Additionally, `context` will be set to the context in which this function is called.

Before saving, any data structures which are not representable in JSON are flattened, and credentials are removed.

The event is saved automatically.

Example:

```python
ak_create_event("my_custom_event", foo=request.user)
```

### `ak_create_jwt(user: User, provider: OAuth2Provider | str, scopes: list[str], validity = "seconds=60") -> str | None`2025.2

This function will only work when there is an HTTP request in the current context.

Create a new JWT signed by the given `provider` for `user`.

The `provider` parameter can either be an instance of `OAuth2Provider` or the name of a provider instance as a string. Scopes are an array of all scopes that the JWT should have.

The JWT is valid for 60 seconds by default, and this can be customized using the `validity` parameter. The syntax of the parameter is `hours=1,minutes=2,seconds=3`. The following keys are allowed:

- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks

All values accept floating-point values.

Example:

```python
jwt = ak_create_jwt(request.user, "my-oauth2-provider-name", ["openid", "profile", "email"])
```

### `ak_create_jwt_raw(provider: OAuth2Provider | str, validity = "seconds=60", **kwargs) -> str | None`2025.12

Similar to [`ak_create_jwt`](#ak_create_jwtuser-user-provider-oauth2provider--str-scopes-liststr-validity--seconds60---str--none), however this function does *not* require an HTTP request and allows for setting custom claims via `**kwargs`.

The `provider` parameter can either be an instance of `OAuth2Provider` or the name of a provider instance as a string. Scopes are an array of all scopes that the JWT should have.

The JWT is valid for 60 seconds by default, and this can be customized using the `validity` parameter. The syntax of the parameter is `hours=1,minutes=2,seconds=3`. The following keys are allowed:

- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks

All values accept floating-point values.

Example:

```python
jwt = ak_create_jwt_raw("my-oauth2-provider-name", my_claim="my_value")
```

### `ak_send_email(address: str | list[str], subject: str, body: str = None, stage: EmailStage = None, template: str = None, context: dict = None, cc: str | list[str] = None, bcc: str | list[str] = None) -> bool`2025.10

Send an email using authentik's email system.

The `address` parameter specifies the recipient email address(es). It can be:

- A single email address as a string: `"user@example.com"`
- A list of email addresses: `["user1@example.com", "user2@example.com"]`

When using multiple recipients in the `address` or `cc` fields, all email addresses will be visible to all recipients. Use `bcc` to send to multiple recipients without revealing addresses to each other.

The `subject` parameter sets the email subject line.

You must provide either `body` (for plain text/HTML content) or `template` (for template rendering), but not both.

The `stage` parameter can be an `EmailStage` instance for custom email settings. If `None`, global email settings are used.

The `template` parameter specifies a template name to render. When using templates, you can pass additional context variables via the `context` parameter.

The `cc` parameter specifies email address(es) to carbon copy. Same format as `address`.

The `bcc` parameter specifies email address(es) to blind carbon copy. Same format as `address`. Recipients in `bcc` will not be visible to other recipients.

If the email is queued successfully, the function returns `True`; otherwise, it returns `False`.

Examples:

```python
# Send email with plain body to single recipient
ak_send_email("user@example.com", "Welcome!", body="Welcome to our platform!")

# Send email to multiple recipients
ak_send_email(
    ["user1@example.com", "user2@example.com", "admin@example.com"],
    "System Maintenance",
    body="Scheduled maintenance will occur tonight."
)

# Send email using a template
ak_send_email("user@example.com", "Password Reset", template="email/password_reset.html")

# Send email with custom context for template to multiple recipients
ak_send_email(
    ["user@example.com", "admin@example.com"],
    "Account Update",
    template="email/event_notification.html",
    context={
        "title": "Profile Updated",
        "body": "Your account profile has been successfully updated.",
        "key_value": {"Updated Field": "Email Address", "Date": "2025-01-01"}
    }
)

# Send email with custom email stage
ak_send_email("admin@example.com", "Report", body="Daily report", stage=my_custom_stage)

# Send email with CC
ak_send_email(
    "user@example.com",
    "Important Update",
    body="Please review this update.",
    cc="manager@example.com"
)

# Send email with multiple CC and BCC recipients
ak_send_email(
    "user@example.com",
    "Confidential Report",
    body="Attached is the quarterly report.",
    cc=["manager@example.com", "lead@example.com"],
    bcc=["audit@example.com", "compliance@example.com"]
)
```

## Comparing IP Addresses

To compare IP addresses or check if an IP address is within a given subnet, you can use the functions `ip_address('192.0.2.1')` and `ip_network('192.0.2.0/24')`. With these objects you can do [arithmetic operations](https://docs.python.org/3/library/ipaddress.html#operators).

You can also check if an IP Address is within a subnet by writing the following:

```python
ip_address('192.0.2.1') in ip_network('192.0.2.0/24')
# evaluates to True
```

## DNS resolution and reverse DNS lookups

To resolve a hostname to a list of IP addresses, use the functions `resolve_dns(hostname)` and `resolve_dns(hostname, ip_version)`.

```python
resolve_dns("google.com")  # returns a list of all IPv4 and IPv6 addresses
resolve_dns("google.com", 4)  # returns a list of only IPv4 addresses
resolve_dns("google.com", 6)  # returns a list of only IPv6 addresses
```

You can also perform reverse DNS lookups.

Reverse DNS lookups may not return the expected host if the IP address is part of a shared hosting environment.
See: [https://stackoverflow.com/a/19867936](https://stackoverflow.com/a/19867936)

To perform a reverse DNS lookup use `reverse_dns("192.0.2.0")`. If no DNS records are found the original IP address is returned.

DNS resolving results are cached in memory. The last 32 unique queries are cached for up to 3 minutes.

---

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources.

This page is an overview of how property mappings work. For information about a specific protocol, refer to the protocol page:

- [Kerberos](../protocols/kerberos/#kerberos-source-property-mappings)
- [LDAP](../protocols/ldap/index.mdx#ldap-source-property-mappings)
- [OAuth](../protocols/oauth/index.mdx#oauth-source-property-mappings)
- [SAML](../protocols/saml/index.mdx#saml-source-property-mappings)
- [SCIM](../protocols/scim/index.mdx#scim-source-property-mappings)

## Create a custom source property mapping

If the default source mappings are not enough, or if you need to get additional data from the source, you can create your own custom source property mappings.

Here are the steps:

1. In authentik, open the Admin interface, and then navigate to **Customization** > **Property Mappings**.
2. Click **Create**, select the property mapping type for your source, and then click **Next**.
3. Type a unique and meaningful **Name**, such as `ldap-displayName-mapping:name`.
4. In the **Expression** field, enter Python expressions to retrieve the value from the source. See [Expression semantics](#expression-semantics) below for details.
5. In the source configuration, select the newly created property mapping as a **User property mapping** if it applies to users, or **Group property mapping** if it applies to groups.

## How it works

### Expression semantics

Each source provides the Python expression with additional data. You can import parts of that data into authentik users and groups. Assuming the source provides us with a `data` Python dictionary, you can write the following:

```python
return {
    "name": data.get("displayName"),
}
```

You can see that the expression returns a Python dictionary. The dictionary keys must match [User properties](../../user/user_ref.mdx#object-properties) or [Group properties](../../groups/group_ref.mdx#object-properties). Note that for users, `groups` and `group_attributes` cannot be set.

See each source documentation for a reference of the available data. See the authentik [expressions documentation](./expressions.mdx) for available data and functions.

Note that the [`list_flatten`](./expressions.mdx#list_flattenvalue-listany--any---optionalany) method is applied for all top-level properties, but not for attributes:

```python
return {
    "username": data.get("username"), # list_flatten is automatically applied to top-level attributes
    "attributes": {
        "phone": list_flatten(data.get("phoneNumber")), # but not for attributes!
    },
}
```

### Object construction process

A user or group object is constructed as follows:

1. The source provides initial properties based on commonly used data.
2. Each property mapping associated with the source is run and results are merged into the previous properties.
   - If a property mapping throws an error, the process is aborted. If that happens inside a synchronization process, the object is skipped. If it happens during an enrollment or authentication flow, the flow is canceled.
   - If a property mapping sets one attribute to `None`, that attribute is then discarded.
3. If the `username` field is not set for user objects, or the `name` field is not set for group objects, the process is aborted.
4. The object is created or updated. The `attributes` property is merged with existing data if the object already exists.

### Group synchronization

LDAP and SCIM sources have built-in mechanisms to get groups. This section does not apply to them.

You can write a custom property mapping to set the user's groups:

```python
return {
    "groups": data.get("groups", []),
}
```

The `groups` attribute is a special attribute that must contain group identifiers. By default, those identifiers are also used as the group name. Each identifier is then given to group property mappings as the `group_id` variable, if extra processing needs to happen.

An identifier has to be a simple value such as a string. Entries that are not, such as the objects some identity providers return in an OpenID Connect `groups` claim, are skipped, and a **Configuration error** event records how many were dropped.

#### Disabling group synchronization

The source collects its groups before any property mapping runs, and mapping results are merged into them as described in [Object construction process](#object-construction-process). To prevent the collected groups from being imported, return `None` for the `groups` attribute:

```python
return {"groups": None}
```

This stops groups from being imported. However, authentik reconciles source-linked memberships on every login, so users are still removed from groups that were created by or linked through the source.

---

## Federated identity providers

Configuring authentik with a federated identity provider allows users to authenticate with their existing credentials, such as social logins or enterprise identity providers.

Typically, identity providers use protocols such as [OAuth 2.0](https://en.wikipedia.org/wiki/OAuth) or [Security Assertion Markup Language](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) (SAML). These protocols allow authentik to act as a service provider (SP), delegating the authentication process to the identity provider (IdP). The choice of protocol depends on the provider and the level of integration desired.

## IdP-initiated single sign-on

In this scenario, a user is logged in to the IdP and attempts to access a resource on a remote SP server. In this example, the IdP is Google, Facebook, or another social login provider. The SP is authentik, acting as a service provider.

```mermaid
sequenceDiagram
    autonumber
    participant User
    participant IdP as Identity Provider
    participant SP as authentik
    participant Browser

    User->>IdP: Log in
    User->>SP: Access resource
    SP->>IdP: Request SAML assertion
    IdP->>IdP: Authenticate user
    IdP->>SP: Return SAML assertion
    SP->>Browser: Redirect to resource
```

In short, the user logs in to the IdP, requests access to a resource on the SP, and is redirected to the SP with a SAML assertion. The SP validates the assertion and establishes a session for the user.

## SP-initiated single sign-on

In this scenario, a user attempts to access a protected resource directly on an SP website without being logged in. The user does not have an account on the SP site, but does have a federated account managed by a third-party IdP. The SP sends an authentication request to the IdP. Both the request and the returned SAML assertion are sent through the user's browser via HTTP POST.

```mermaid
sequenceDiagram
    autonumber
    participant User
    participant IdP as Identity Provider
    participant SP as authentik
    participant Browser

    User->>SP: Access resource
    SP->>IdP: Request SAML assertion
    IdP->>IdP: Authenticate user
    IdP->>SP: Return SAML assertion
    SP->>Browser: Redirect to resource
```

In short, the user requests access to a resource on the SP, the SP requests a SAML assertion from the IdP, the IdP authenticates the user and returns a SAML assertion, and the SP establishes a session for the user.

## Configure authentik

While we provide detailed guides for popular services such as Google, GitHub, and Microsoft Entra ID, you can configure any standards-compliant provider using the same basic process.

authentik supports most identity providers that implement standard OAuth 2.0 or SAML 2.0 protocols. While each provider may have its own administrative interface, the core information needed is consistent, typically OAuth client credentials or SAML metadata.

Our provider-specific guides walk you through any unique steps needed for each service.

## See also

- [Google identity providers](./google/index.mdx)
- [Application Providers](./../../../add-secure-apps/providers/index.mdx)

## External references

- [Federated Identity](https://en.wikipedia.org/wiki/Federated_identity)
- [Social Login](https://en.wikipedia.org/wiki/Social_login)
- [OAuth](https://en.wikipedia.org/wiki/OAuth)
- [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language)

---

## Agent accounts

Agent accounts are service accounts that act on behalf of a parent user when calling the authentik API. Use them for automation, integrations, and other machine identities that need delegated access.

For an overview of all account types, see [Account types](./index.mdx). For general information about service accounts, see [Service accounts](./service-accounts.mdx).

Agent accounts are separate from the authentik Agent. The authentik Agent is a deployable component on Windows, Linux, and macOS devices for device integration with authentik. For more information, see [authentik Agent](../../../endpoint-devices/authentik-agent/index.mdx).

## About agent accounts

An agent account is a non-human identity with:

- A generated username.
- A parent user.
- No usable password.
- An API token for Bearer authentication.
- A configurable policy inheritance behavior.
- Audit events that identify the parent user.

For authorization, authentik treats an agent like any other service account. You can grant them access through groups, roles, object permissions, application bindings, and policies.

## Permissions for managing agent accounts

The following permissions control a user's ability to create, view, change, and delete agent accounts:

- Can add Agent
- Can change Agent
- Can delete Agent
- Can view Agent
- Add an agent user (self-service)

When an agent is created, authentik automatically grants the parent user permission to view, change, and delete it.

Users who are not the parent can manage an agent only if they have the required object or global permissions.

The add agent permission disables access to self-service, even if the user also has the self-service permission.

## Create an agent account

You can create an agent account in two ways:

- [**User interface (Self-service)**](#create-an-agent-via-the-user-interface-self-service): Internal users with the required permissions can create their own agents in the User interface.
- [**authentik API**](#create-an-agent-via-the-authentik-api): Agents can be created programmatically via the authentik API.

### Create an agent via the user interface (self-service)

An authenticated user with the required roles can create an agent for themselves. Self-service agents have the following properties:

- The parent is always the authenticated user. A user cannot create an agent for another user through self-service creation.
- The agent always expires.
- The agent uses the default token duration of the authentik deployment.
- The agent always uses [`NONE` policy behavior](#policy-behavior) and copies no access from its parent.
- Request values for `expiring`, `expires`, and `policy_behavior` are ignored.

To create an agent:

1. Log in to authentik as a user with the required roles and open the user interface.
2. Open the **Agents** page and click **Create Agent**.
3. Optionally enter a **Label** for the agent and click **Create**.
4. The token for the agent is displayed. Securely store this token because it will not be displayed again.

This token can now be used to authenticate as the agent.

### Create an agent via the authentik API

Create an agent account with the authentik API:

```http
POST /api/v3/agents/agents/
```

The request body can contain the following fields:

| Field             | Required | Description                                                                                                            |
| ----------------- | -------- | ---------------------------------------------------------------------------------------------------------------------- |
| `parent`          | No       | The ID of the user for whom the agent acts. If omitted, the authenticated user is used.                                |
| `label`           | No       | A display name for the agent.                                                                                          |
| `expiring`        | No       | Whether the agent account expires. The default is `false` for administrator-provisioned agents.                        |
| `expires`         | No       | The expiration date and time for the agent account.                                                                    |
| `policy_behavior` | No       | How the agent inherits policy access from its parent. The default is `MIRROR`. See [Policy behavior](#policy-behavior) |

The `parent` field is optional when an authenticated user creates an agent for themselves. An administrator or a user with the `Can add Agent` role can specify another user as the parent.

Here is an example of an API request to create an agent account:

```bash
curl \
  --request POST \
  --header "Authorization: Bearer <administrator-token>" \
  --header "Content-Type: application/json" \
  --data '{
    "parent": 123,
    "label": "automation-agent",
    "expiring": true,
    "expires": "2027-01-01T00:00:00Z",
    "policy_behavior": "MIRROR"
  }' \
  https://authentik.company/api/v3/agents/agents/
```

The response contains the agent and the generated API token:

```json
{
    "agent": {
        "pk": 456,
        "username": "<parent-username>-agent-<generated-id>",
        "name": "automation-agent",
        "expiring": true,
        "expires": "2027-01-01T00:00:00Z",
        "parent": {
            "pk": 123
        },
        "policy_behavior": "MIRROR",
        "token_identifier": "<parent-username>-agent-<generated-id>"
    },
    "token": "<agent-token>"
}
```

The token value is returned when the agent is created. Store it securely before closing or discarding the response. The `token_identifier` identifies the token but cannot be used to authenticate.

## Policy behavior

An agent can inherit policy access from its parent in one of three ways. You select the policy behavior when you create the agent; you cannot change it afterwards. For [self-service agents](#create-an-agent-via-the-user-interface-self-service), policy behavior is not configurable and defaults to `NONE`.

### Mirror the parent (`MIRROR`)

`MIRROR` evaluates the agent as its parent user.

- The agent follows the parent's current policy access.

Use `MIRROR` when an agent must follow the parent's current access.

### Copy the parent's policy bindings (`COPY`)

`COPY` copies the parent's policy bindings when the agent is created. Only bindings referencing the parent as a user are copied. Access the parent derives from group membership is not copied.

- The agent receives a snapshot of the parent's policy bindings.
- Later changes to the parent's policy bindings do not update the copied bindings.
- The copied bindings are assigned to the agent independently of the parent.

Use `COPY` when an agent needs a stable snapshot of the parent's policy bindings.

### Do not inherit policies (`NONE`)

`NONE` does not copy or mirror the parent's policy bindings.

- The agent is evaluated independently of its parent for policy bindings.
- Grant access to the agent through its own groups, roles, object permissions, application bindings, or policies.

Use `NONE` when an agent must have independent policy access.

Use `MIRROR` unless you specifically need a policy snapshot or independent policy access. `COPY` does not automatically update subsequent changes to the parent user's policy bindings.

## Grant access for an agent

Agent accounts start with no special access beyond their ability to authenticate. Grant access through the same mechanisms used for other service accounts and users:

- Add the agent to a group.
- Add the agent to a role.
- Grant object permissions directly to the agent.
- Configure application bindings.
- Configure policies.
- Use the agent's policy behavior to inherit access from its parent.

For more information, see [Manage permissions](../../access-control/manage_permissions.mdx).

## Authenticate with an agent token

Use the generated token as a Bearer token when calling the authentik API:

```http
Authorization: Bearer <agent-token>
```

For example:

```bash
curl \
  --header "Authorization: Bearer <agent-token>" \
  https://authentik.company/api/v3/core/users/me/
```

The request is authenticated as the agent. authentik authorizes the request using the agent's assigned permissions and any endpoint-specific or object-level access checks. The agent’s policy behavior does not apply to direct API endpoint access.

Treat an agent token as a credential. Store it in a secret manager or another protected secret store. Do not commit it to source control or include it in logs.

## Manage agent tokens

An API token is created automatically for every agent. The token has the following properties:

- It is associated with the agent user.
- It always expires.
- It uses the default token duration.
- Its identifier is the generated agent username.

The agent's expiration and the token's expiration are separate:

- A self-service agent always expires using the default token duration.
- An administrator-provisioned agent can be configured to expire or not expire.
- The API token created for an agent always expires using the default token duration.
- On expiry the token is deleted and not rotated unlike the other service account tokens.

Agent tokens are managed in the same token system as other authentik tokens. See [Service accounts](./service-accounts.mdx) for general token-management information.

Users with the `Can view token` permission can retrieve their agents' tokens from the **Agents** page by clicking the **Copy token** icon next to the agent.

## Agent API operations

The agent API supports the following operations:

| Operation                 | Method   | Endpoint                      |
| ------------------------- | -------- | ----------------------------- |
| List agents               | `GET`    | `/api/v3/agents/agents/`      |
| Create an agent           | `POST`   | `/api/v3/agents/agents/`      |
| Retrieve an agent         | `GET`    | `/api/v3/agents/agents/<id>/` |
| Update an agent           | `PUT`    | `/api/v3/agents/agents/<id>/` |
| Partially update an agent | `PATCH`  | `/api/v3/agents/agents/<id>/` |
| Delete an agent           | `DELETE` | `/api/v3/agents/agents/<id>/` |

See the [API reference](https://api.goauthentik.io/) for the complete request and response schemas.

### Update an agent

You can update the agent's standard user fields, such as its name, email address, attributes, and active status.

The following fields are read-only after creation so a PUT must omit them:

- `parent`
- `policy_behavior`
- `token_identifier`

### Delete an agent

Deleting an agent deletes its associated API token. Requests authenticated with that token fail after the agent is deleted.

Deleting the parent user does not delete the agent. The agent remains as a parentless service account.

## Audit events

Actions performed by an agent are attributed to the agent's parent user in audit events.

Agent audit data identifies:

- The actor as an agent.
- The user on whose behalf the agent acted.

Service accounts without a parent user are attributed to themselves.

Review [Events](../../../sys-mgmt/events/index.mdx) when investigating agent activity or validating that an integration has the expected access.

## Troubleshooting

### Self-service creation is denied

Check the following:

- The request creates the agent for the authenticated user.
- The authenticated user is not attempting to set another user as the parent.
- The add agent permission disables access to self-service, even if the user also has the self-service permission.

### An agent cannot access an application

Check the following:

- The agent's `policy_behavior`.
- The parent's current policy access when using `MIRROR`.
- The copied policy bindings when using `COPY`.
- The agent's own groups, roles, permissions, application bindings, and policies when using `NONE`.
- The agent's active status and expiration.
- The token's active status and expiration.
- The request's `Authorization` header.

### An agent token no longer works

Check the following:

- The token has not expired.
- The token has not been revoked or deleted.
- The agent has not expired or been disabled.
- The token value is complete.
- The integration sends the token as a Bearer token.

---

## External users

External users are accounts for people who need access to an application but not to the authentik application dashboard.

External users cannot access the application dashboard. They therefore do not have access to the user settings page via the user interface. They can however change their password and perform other changes via direct links to the appropriate flow.

For an overview of all account types, see [Account types](./index.mdx).

For information on creating and managing external users, see [Managing users](../user_basic_operations.mdx).

## Application access

External users typically authenticate to a single default application. After successful authentication, authentik redirects them to the application configured for the authentication request or to the brand's default application.

Configure a default application for [brands](../../../customize/branding/index.mdx#external-user-settings) used by external users. Without a default application, an external user who signs in without requesting a specific application receives an access-denied page.

## Access user settings

External users cannot access the user settings menu through the application dashboard because they do not have access to the dashboard.

To allow an external user to change their password, enroll an MFA device, or perform other changes that are usually accessed via user settings, you must direct them to the appropriate flow.

## When to use external users

Use an external user account for:

- Customers or other users in a business-to-consumer (B2C) deployment.
- External consultants, contractors, or volunteers.
- Users who need access to a single application.
- Users who should not see the application dashboard or other available applications.

Use an [internal user](./internal-users.mdx) when someone needs access to the application dashboard to launch multiple applications or manage their user settings from the user interface.

---

## Account types

authentik supports several account types that represent people and machine identities. The account type determines how an account is created, how it authenticates, and how it is used.

The available account types are:

- [**Internal users**](./internal-users.mdx): human users whose accounts are created and managed in authentik.
- [**External users**](./external-users.mdx): human users who typically authenticate to a single application and cannot access the authentik application dashboard.
- [**Service accounts**](./service-accounts.mdx): non-human identities created by an administrator for integrations and automation.
- [**Internal service accounts**](./service-accounts.mdx): non-human identities created and managed by authentik for internal components. They can not be created by administrators.
- [**Agent accounts**](./agent-accounts.mdx): non-human identities that act on behalf of a parent user.

## Choose an account type

Use the following table to choose an account type:

| Requirement                                                                | Account type                              |
| -------------------------------------------------------------------------- | ----------------------------------------- |
| A user that needs access to the application dashboard                      | [Internal user](./internal-users.mdx)     |
| A user that does not need access to the application dashboard              | [External user](./external-users.mdx)     |
| An administrator needs a machine identity for an integration or automation | [Service account](./service-accounts.mdx) |
| An integration needs to act on behalf of a specific user                   | [Agent account](./agent-accounts.mdx)     |

---

## Internal users

Internal users are accounts for people who need the authentik application dashboard and their own user settings.

An internal user can sign in to the authentik application dashboard and launch any application available to them. They can also open their user settings from the authentik

For an overview of all account types, see [Account types](./index.mdx). For information on creating and managing internal users, see [Managing users](../user_basic_operations.mdx).

## Application dashboard

After logging in, internal users are redirected to the application dashboard. They can also access the application dashboard directly at:

```text
https://authentik.company/if/user/
```

The application dashboard displays the applications available to the user. Selecting an application authenticates the user and redirects them to it, so they can reach several applications without a separate link for each one.

## Access user settings

Internal users do not need to be directed to the settings page through a separate link. They can navigate to it from the application dashboard.

Internal users can also access the user settings page directly at:

```text
https://authentik.company/if/user/#/settings
```

## When to use internal users

Use an internal user account for:

- Users who need the full authentik user experience.
- Users who need access to the application dashboard.
- Users who need to access user settings through the authentik user interface.
- Administrators and other users who need to manage authentik, subject to their permissions.

Use an [external user](./external-users.mdx) when the user typically authenticates to a single application and does not need the application dashboard.

---

## Service accounts

Service accounts are specialized user accounts for machine-to-machine authentication and automation. Use them when an external service, script, integration, or protocol client needs to authenticate to authentik without representing a human user.

Common examples include LDAP bind users, automation that calls the authentik API, SCIM or outpost-related integrations, and third-party applications that need a stable credential.

For an overview of all account types, see [Account types](./index.mdx).

## Types of service accounts

authentik has three service account types:

- **User-created service accounts**: accounts created by administrators for external systems or automation. These accounts appear under **Directory** > **Users** with the `Service account` user type.
- **Internal service accounts**: accounts created and managed by authentik for internal components, such as outpost communication. These accounts cannot be created manually, converted to another user type, or edited like regular users.
- **Agent accounts**: accounts that act on behalf of a parent user. See [Agent accounts](./agent-accounts.mdx).

## How service accounts work

A user-created service account is an authentik user of type `Service account` that authenticates using:

- **App passwords**: Authenticate to flows and protocol clients that accept a username and password, such as LDAP bind clients. When you create a service account from **Directory** > **Users**, authentik creates an app password for the account and shows it once in the confirmation screen.
- **API tokens**: Authenticate to the authentik API with HTTP Bearer authentication. Use API tokens for scripts, CI/CD jobs, and other automation that calls `/api/v3/` endpoints.

A service account is still a user object for authorization purposes. You can add it to groups, add it to roles, assign object permissions, and include or exclude it from application access through bindings and policies.

## Limitations

Service accounts differ from regular users in the following ways:

- They are intended for non-interactive use and cannot access the authentik user or Admin interfaces. If a service account authenticates in a browser, authentik redirects it to the brand's default application when configured; otherwise, access to the interface is denied.
- They do not have a usable account password. They instead use app passwords or API tokens.
- They cannot complete interactive MFA setup or other human-driven account settings flows.
- They should not be used to represent a person. Create a regular internal or external user for human access.
- Internal service accounts are managed by authentik and cannot be modified directly.

## Create a service account

To create a service account:

1. In the authentik **Admin interface**, navigate to **Directory** > **Users**.
2. Click **New User**, and then select **Service Account**.
3. Configure the following settings:
   - **Username**: the primary identifier for the service account. This value is used as the username for app-password authentication.
   - **Create group** (*optional*): creates a group with the same name as the service account and adds the service account to it. This can be useful when you want to grant access through group membership.
   - **Expiring**: controls whether the generated app password expires.
   - **Expires on**: sets the expiration date for the generated app password. If no date is provided, the default is 360 days.
4. Click **Next**.
   View the confirmation screen that shows the username and generated password. Copy this information and store the password in a secure secret store.
5. Click **Close**.

The generated password is the service account's initial app password. Treat it like any other secret. Anyone with this value can authenticate as the service account anywhere that app passwords are accepted.

## Token properties

Service account tokens have the following properties:

- **Expiration**: by default, tokens expire after 360 days but can be configured to be non-expiring.
- **Custom expiration date**: you can set a specific expiration date when creating the service account.
- **Revocation**: tokens can be revoked at any time by deleting them or generating new ones. OAuth2 access tokens associated with service accounts can also be introspected or revoked through the OAuth2 provider endpoints when the authenticating provider is the issuing provider or is configured for [cross-provider token introspection and revocation](../../../add-secure-apps/providers/oauth2/index.mdx#cross-provider-token-introspection-and-revocation).
- **Automatic rotation**: when a token expires, authentik automatically rotates API tokens to maintain security.

## Manage service account tokens

Service account tokens are managed from **Directory** > **Tokens and App passwords**.

### Create another app password

Create an app password when an integration needs username/password-style authentication, for example an LDAP bind password.

1. Navigate to **Directory** > **Tokens and App passwords**.
2. Click **Create**.
3. Enter a unique **Identifier**.
4. Select the service account in the **User** field.
5. Set **Intent** to **App password**.
6. Configure whether the token expires and, if needed, set **Expires on**.
7. Click **Create** and copy the generated value.

### Create an API token

Create an API token when automation needs to call the authentik API.

1. Navigate to **Directory** > **Tokens and App passwords**.
2. Click **Create**.
3. Enter a unique **Identifier**.
4. Select the service account in the **User** field.
5. Set **Intent** to **API Token**.
6. Click **Create** and copy the generated value.

Use the token as a Bearer token in the `Authorization` header when calling the authentik API:

```http
Authorization: Bearer <token>
```

### Rotate or revoke tokens

- To view a token value, use the copy action in **Directory** > **Tokens and App passwords**. Access to token values is controlled by the `View token's key` permission.
- To revoke a token, delete it.
- To rotate an app password, create a replacement token, update the external system, and then delete the old token.
- Expiring app passwords become invalid when they expire. Expiring API tokens are rotated by authentik.

## Permissions and access control

Service accounts start with no special access beyond normal authentication. Grant only the permissions required for the integration.

You can grant access in the same ways as regular users:

- Add the service account to a group and grant permissions to that group.
- Add the service account to a role and grant global or object permissions to that role.
- Grant object permissions directly to the service account when access should not be shared with other accounts.
- Use application [bindings](../../../add-secure-apps/applications/manage_apps.mdx#use-bindings-to-control-access) or policies to restrict which applications the service account can access.

For more information about assigning permissions, see [Manage permissions](../../access-control/manage_permissions.mdx).

### Example: LDAP search account

LDAP clients often need a bind account that can search the LDAP directory. In this case:

1. Create a service account, such as `ldapservice`.
2. Store the generated app password in the LDAP client configuration.
3. Create a role for LDAP search access.
4. Add the service account to that role.
5. On the LDAP provider, assign the role the **Search full LDAP directory** object permission.

For the full LDAP setup, see [Create an LDAP provider](../../../add-secure-apps/providers/ldap/create-ldap-provider.mdx#create-a-service-account).

### Example: API automation account

Automation that manages authentik objects should use an API token for a dedicated service account.

1. Create a service account for the automation, such as `ci-authentik-admin`.
2. Create an API token for that service account.
3. Grant the service account only the permissions required by the automation. For example, a script that rotates application certificates should receive certificate-related permissions, not full administrator access.
4. Store the API token in your CI/CD or secret management system and send it as `Authorization: Bearer <token>`.

## Security best practices

When using service accounts, follow these security practices:

- **Use one service account per integration**. Avoid sharing one account across unrelated systems so audit events and token rotation remain clear.
- **Grant least privilege**. Assign only the global permissions, object permissions, groups, roles, or application access that the integration needs.
- **Prefer expiring tokens** for credentials stored outside authentik, and rotate long-lived secrets on a regular schedule.
- **Store tokens securely** in a secret manager, encrypted environment variable store, or equivalent system.
- **Disable or delete unused accounts**. If an integration is retired, delete its tokens and deactivate or remove the service account.
- **Audit usage** by reviewing events for unexpected logins, API calls, or token access.

---

## Flow Context

Each flow execution has an independent *context*. This context holds all of the arbitrary data about that specific flow, data which can then be used and transformed by stages and policies.

## Manage data in a flow context

You create and manage the data for a context by configuring policies, stages, and bindings. As you plan your flow, and set up the required stages, etc. you are creating the context data for that flow.

For example, in the Identification Stage (part of the default login flow), you can define whether users will be prompted to enter an email address, a username, or both. All such information about the flow's configuration makes up the context.

Any data can be stored in the flow context, however there are some reserved keys in the context dictionary that are used by authentik stages.

To manage flow context on a more granular level, see [Setting flow context keys](../../../../customize/policies/types/expression/managing_flow_context_keys.mdx).

## Context dictionary and reserved keys

This section describes the data (the context) that are used in authentik, and provides a list of keys, what they are used for and when they are set.

Keys prefixed with `goauthentik.io` are used internally by authentik and are subject to change without notice, and should not be modified in policies in most cases.

### Common keys

#### `pending_user` ([User object](../../../../users-sources/user/user_ref.mdx#object-properties))

`pending_user` is used by multiple stages. In the context of most flow executions, it represents the data of the user that is executing the flow. This value is not set automatically, it is set via the [Identification stage](../../stages/identification/index.mdx).

Stages that require a user, such as the [Password stage](../../stages/password/index.mdx), the [Authenticator validation stage](../../stages/authenticator_validate/index.mdx), and others will use this value if it is set, and fall back to the request's user when possible.

#### `prompt_data` (Dictionary)

`prompt_data` is primarily used by the [Prompt stage](../../stages/prompt/index.mdx). The value of any field within a prompt stage is written to the `prompt_data` dictionary. For example, given a field with the *Field key* `email` that was submitted with the value `foo@bar.baz` will result in the following context:

```json
{
    "prompt_data": {
        "email": "foo@bar.baz"
    }
}
```

Policies can change this data. Stages such as [User Write](../../stages/user_write/index.mdx) can then store values from `prompt_data` on `pending_user`.

For more information, see [Collect custom user attributes during enrollment](../collect-user-attributes.mdx).

#### `redirect` (string)

Stores the final redirect URL that the user's browser will be sent to after the flow is finished executing successfully. This is set when an un-authenticated user attempts to access a secured application, and when a user authenticates/enrolls with an external source.

#### `pending_user_identifier` (string)

If *Show matched user* is disabled, this key will hold the user identifier entered by the user in the identification stage.

#### `application` (Application object)

When an unauthenticated user attempts to access a secured resource, they are redirected to an authentication flow. The application they attempted to access will be stored in the key attached to this object. For example: `application.github`, with `application` being the key and `github` the value.

#### `source` (Source object)

When a user authenticates/enrolls via an external source, this will be set to the source they are using.

#### `outpost` (dictionary)

When a flow is executed by an Outpost (for example the [LDAP](../../../providers/ldap/index.mdx) or [RADIUS](../../../providers/radius/index.mdx)), this will be set to a dictionary containing the Outpost instance under the key `"instance"`.

### Scenario-specific keys

#### `is_sso` (boolean)

This key is set to `True` when the flow is executed from an "SSO" context. For example, this is set when a flow is used during the authentication or enrollment via an external source, and if a flow is executed to authorize access to an application.

#### `is_restored` (Token object)

This key is set when a flow execution is continued from a token. This happens for example when an [Email stage](../../stages/email/index.mdx) is used and the user clicks on the link within the email. The token object contains the key that was used to restore the flow execution. This field is also used by the [Source stage](../../stages/source/index.mdx) when returning back to the initial flow the Source stage was run on.

#### `is_redirected` (Flow object)

This key is set when the current flow was reached through a [Redirect stage](../../stages/redirect/index.mdx) in Flow mode.

### Stage-specific keys

#### Autosubmit stage

The autosubmit stage is an internal stage type that is not configurable via the API/Web interface. It is used in certain situations, where a POST request is sent from the browser, such as with SAML POST bindings. This works by using an HTML form that is submitted automatically.

##### `title` (string)

Optional title of the form shown to the user. Automatically set when this stage is used by the backend.

##### `url` (string)

URL that the form will be submitted to.

##### `attrs` (dictionary)

Key-value pairs of the data that is included in the form and will be submitted to `url`.

#### Captcha stage

##### `captcha` (dictionary)

When *Error on invalid score* is set to false on a captcha stage, after the execution of the captcha stage, this object will be set in the flow context.

It contains two keys, `response` which is the raw response from the specified captcha verification URL, and `stage`, which is a reference to the captcha stage that executed the test.

#### `goauthentik.io/stages/captcha/site_key` (string)2025.12

#### `goauthentik.io/stages/captcha/private_key` (string)2025.12

Optionally set captcha site and private keys dynamically through a policy, for example when using E2E testing with a captcha stage bound.

#### Consent stage

##### `consent_header` (string)

The title of the consent prompt shown. Set automatically when the consent stage is used with an OAuth2, Proxy or SAML provider.

##### `consent_permissions` (List of PermissionDict)

An optional list of all permissions that will be given to the application by granting consent. Not supported with SAML. When used with an OAuth2 or Proxy provider, this will be set based on the configured scopes.

#### Deny stage

##### `deny_message` (string)

Optionally overwrite the deny message shown, has a higher priority than the message configured in the stage.

#### User write stage

##### `groups` (List of [Group objects](../../../../users-sources/groups/index.mdx))

See [Group](../../../../users-sources/groups/index.mdx). If set in the flow context, the `pending_user` will be added to all the groups in this list.

If set, this must be a list of group objects and not group names.

##### `user_path` (string)

Path the `pending_user` will be written to. If not set in the flow, falls back to the value set in the user\_write stage, and otherwise to the `users` path.

##### `user_type` (string)

Type the `pending_user` will be created as. Must be one of `internal`, `external` or `service_account`.

#### Password stage

##### `user_backend` (string)

Set by the [Password stage](../../stages/password/index.mdx) after successfully authenticating the user. Contains a dot-notation to the authentication backend that was used to successfully authenticate the user.

##### `auth_method` (string)

Set by the [Password stage](../../stages/password/index.mdx), the [Authenticator validation stage](../../stages/authenticator_validate/index.mdx), the [OAuth2 Provider](../../../providers/oauth2/index.mdx), and the API authentication depending on which method was used to authenticate.

Possible options:

- `password` (Authenticated via the password in authentik's database)
- `token` (Authenticated via API token)
- `ldap` (Authenticated via LDAP bind from an LDAP source)
- `auth_mfa` (Authentication via MFA device without password)
- `auth_webauthn_pwl` (Passwordless authentication via WebAuthn with Passkeys)
- `jwt` ([M2M](../../../providers/oauth2/machine_to_machine.mdx) authentication via an existing JWT)
- `mtls` (Authentication via Certificate, see [Mutual TLS Stage](../../stages/mtls/index.mdx))

##### `auth_method_args` (dictionary)

Additional arguments used during the authentication. Value varies depending on `auth_method`.

Example:

```json
{
    // List of the MFA device objects used during authentication
    // applies for `auth_method` `auth_mfa`
    "mfa_devices": [],
    // MFA device used for passwordless authentication, applies to
    // `auth_method` `auth_webauthn_pwl`
    "device": null,
    // the token identifier when `auth_method` `token` was used
    "identifier": "",
    // JWT information when `auth_method` `jwt` was used
    "jwt": {},
    "source": null,
    "provider": null,
    // Certificate used for authentication
    // applies for `auth_method` `mtls`
    "certificate": {}
}
```

#### Email stage

##### `email_sent` (boolean)

Boolean set to true after the email from the email stage has been sent.

##### `email` (string)

Optionally override the email address that the email will be sent to. If not set, defaults to the email of `pending_user`.

#### Identification stage

##### `pending_user_identifier` (string)

If *Show matched user* is disabled, this key will be set to the user identifier entered by the user in the identification stage.

#### Invitation stage

##### `invitation` (Invitation object)

The invitation used with the invitation stage. When **Continue flow without invitation** is enabled, this may be unset.

If the invitation was single-use, this object may hold a reference to an invitation that no longer exists in the database.

##### `invitation_in_effect` (boolean)

A boolean value that is `True` when an invitation has been used.

##### `token` (string)

This value can be set either via [Prompt data](#prompt_data-dictionary) or via policy to interactively/programmatically choose an invitation.

#### Redirect stage

##### `redirect_stage_target` (string)

[Set this key](../../../../customize/policies/types/expression/managing_flow_context_keys.mdx) in an Expression Policy to override [Redirect stage](../../stages/redirect/index.mdx) to force it to redirect to a certain URL or flow. This is useful when a flow requires that the redirection target be decided dynamically.

Use the format `ak-flow://{slug}` to use the Redirect stage in Flow mode. Any other format will result in the Redirect stage running in Static mode.

#### Mutual TLS Stage

##### `certificate` (dictionary)2025.6

This key is set by the Mutual TLS Stage during enrollment and contains data about the certificate supplied by the browser.

Example:

```json
{
    "serial_number": "1234",
    "subject": "CN=client",
    "issuer": "CN=authentik Test CA, O=authentik, OU=Self-signed",
    "fingerprint_sha256": "08:D4:A4:79:25:CA:C3:51:28:88:BB:30:C2:96:C3:44:5A:EB:18:07:84:CA:B4:75:27:74:61:19:8A:6A:AF:FC",
    "fingerprint_sha1": "5D:14:0D:5F:A2:7E:14:B0:F1:1D:6F:CD:E3:4B:81:68:71:24:1A:70",
    "raw": "-----BEGIN CERTIFICATE-----...."
}
```

---

## Headless

The headless flow executor is used by clients that don't have access to the web interface. It is currently used by the LDAP and Radius outposts to authenticate users.

The following stages are supported:

- [**Identification stage**](../../stages/identification/index.mdx)
- [**Password stage**](../../stages/password/index.mdx)
- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.mdx)

---

## Default

This is the default, web-based environment that flows are executed in. All stages are compatible with this environment and no limitations are imposed.

All flow executors use the same [API](/api/flow-executor/), which allows for the implementation of custom flow executors.

## Layouts

Starting with authentik 2022.5, the layout of the default flow executor can be changed. Below are examples for the available options:

### Stacked (default)

![](../layouts/stacked.png)

### Content besides logo (left)

![](../layouts/content_left.png)

### Content besides logo (right)

![](../layouts/content_right.png)

### Sidebar (left)

![](../layouts/sidebar_left.png)

### Sidebar (right)

![](../layouts/sidebar_right.png)

---

## Simplified flow executor

A simplified web-based flow executor that authentik automatically uses for older browsers that do not support modern web technologies.

Currently this flow executor is automatically used for the following browsers:

- Internet Explorer
- Microsoft Edge (up to and including version 18)

The following stages are supported:

- [**Identification stage**](../../stages/identification/index.mdx)

  Only user identifier and user identifier + password stage configurations are supported; sources and passwordless configurations are not supported.

- [**Password stage**](../../stages/password/index.mdx)

- [**Authenticator Validation Stage**](../../stages/authenticator_validate/index.mdx)

Compared to the [default flow executor](./if-flow.mdx), this flow executor does *not* support the following features:

- Localization
- Theming (Dark / light themes)
- Theming (Custom CSS)
- Stages not listed above
- Flow inspector

---

## User settings

The user interface (/if/user/) uses a specialized flow executor to allow individual users to customize their profile. A user's profile consists of key/value fields, so this executor only supports Prompt or User Write stages. If the configured flow contains another stage, a button will be shown to open the default executor.

Because the stages in a flow can change during its execution, be aware that configuring this executor to use any stage type other than Prompt or User Write will automatically trigger a redirect to the standard executor.

An admin can customize which fields can be changed by the user by updating the default-user-settings-flow, or copying it to create a new flow with a Prompt Stage and a User Write Stage. Different variants of your flow can be applied to different [Brands](../../../../customize/branding/index.mdx) on the same authentik instance.

---

## Account Lockdown stage

This stage performs destructive actions on a user account. Ensure the flow includes appropriate warnings and confirmation steps before this stage executes.

The Account Lockdown stage executes security lockdown actions on a target user account. For the feature overview and usage instructions, see [Account Lockdown](../../../../security/account-lockdown.mdx).

## Stage behavior

1. **Resolves the target account** from the flow query parameters (see [Target user resolution](#target-user-resolution))
2. **Applies the configured actions** to that account
3. **Creates an event** for the locked account
4. **For self-service**: if sessions are deleted, redirects to the completion flow

## Stage settings

| Setting                   | Description                                                                         | Default |
| ------------------------- | ----------------------------------------------------------------------------------- | ------- |
| **Deactivate user**       | Set `is_active` to False                                                            | Enabled |
| **Set unusable password** | Invalidate the local authentik password. External source passwords are not changed. | Enabled |
| **Delete sessions**       | Terminate all active sessions                                                       | Enabled |
| **Revoke tokens**         | Delete all tokens and grants (API, app password, recovery, verification, OAuth)     | Enabled |
| **Completion flow**       | Flow for self-service completion (must not require auth)                            | None    |

Disabling **Delete sessions** is not recommended as it would allow an attacker with an active session to continue using the account.

## Target user resolution

The account lockdown API pre-plans the flow with the selected user as the flow's `pending_user`. The stage uses that `pending_user` as the account to lock.

The resolved target must be:

- a real user account
- not the anonymous user
- not an internal service account

If no valid target user can be resolved, the stage returns an invalid response.

## Reason input

The stage reads the lockdown reason from:

1. `prompt_data.lockdown_reason`
2. `lockdown_reason` in the flow plan context
3. an empty string if neither is set

## Self-service behavior

When the resolved target user is the same user who is currently authenticated and **Delete sessions** is enabled, the user's session is deleted during lockdown. The stage cannot continue to the next stage, so it redirects to the **Completion flow**.

If **Delete sessions** is disabled, the flow continues normally and can show its own completion stages.

The completion flow must have **Authentication** set to **No authentication required**.

## Events

Creates a **User Write** event with an account-lockdown action ID. Use [Notification Rules](../../../../sys-mgmt/events/index.mdx) to send alerts. To match account-lockdown events, use action `user_write` and query `context.action_id = "account_lockdown"`.

```json
{
    "action": "user_write",
    "context": {
        "action_id": "account_lockdown",
        "reason": "User-provided reason",
        "affected_user": "username"
    }
}
```

## Usage examples

### Policy to show a completion stage only for administrator-triggered lockdowns

```python
target_user = request.context.get("pending_user")
current_user = request.http_request.user

return bool(target_user and current_user and target_user.pk != current_user.pk)
```

### Dynamic warning message

Prompt field with **Initial value expression** enabled:

```python
target = user
current_user = http_request.user
is_self_service = bool(target and current_user and target.pk == current_user.pk)
from django.utils.html import escape

if is_self_service:
    return """<p><strong>This will immediately:</strong></p>
    <ul>
        <li>Invalidate your local authentik password</li>
        <li>Deactivate your account</li>
        <li>Terminate all sessions</li>
        <li>Revoke all tokens</li>
    </ul>"""
else:
    if target:
        return f"<p><strong>Locking down:</strong></p><p><code>{escape(target.username)}</code></p>"
    return "<p><strong>Locking down the selected account.</strong></p>"
```

## Error handling

| Error                      | Cause                                   |
| -------------------------- | --------------------------------------- |
| "No target user specified" | No valid pending user found in the flow |
| Failure                    | The stage returns an invalid response   |

---

## Duo authenticator setup stage

The Duo Authenticator Setup stage enrolls a Duo authenticator for the current user.

## About the Duo authenticator setup stage

This stage connects authentik to Duo and stores a Duo-backed authenticator for the user. Duo can then be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx).

## Configuration options

- **API Hostname**: the Duo API hostname for your tenant.

Under **Duo Auth API**:

- **Integration key**: Duo Auth API integration key.
- **Secret key**: Duo Auth API secret.

Under **Duo Admin API (optional)**:

- **Integration key**: optional Duo Admin API integration key, used for importing existing Duo users and authenticators.
- **Secret key**: optional Duo Admin API secret, used together with the Admin API integration key.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that lets users enroll this authenticator from user settings.

## Flow integration

Use this stage in an enrollment or user-settings flow where the user should enroll Duo.

To require Duo during authentication, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the login flow and allow the **Duo** device class.

## Notes

- Duo authenticators created through this stage are tied to the stage because authentik needs that stage's API credentials during authentication.
- Because of that link, the stage cannot be deleted while authenticators created through it still exist. Delete those authenticators first, then delete the stage.

### Import existing Duo authenticators

Due to the way the Duo API works, authentik can only automatically import existing Duo users when a Duo MFA or higher license is active.

The Duo Auth API enrollment flow creates a new Duo user. If a Duo user already exists with the same username, Duo rejects the enrollment request. To use that existing Duo user in authentik, configure the optional Duo Admin API credentials on the stage and import the authenticator instead of using the enrollment flow. If the Admin API is not available, delete or rename the existing Duo user before enrolling the authenticator.

If you already have Duo users, you can import their authenticators into authentik from the Admin interface. The Duo username can be found in the Duo Admin dashboard under **Users**. If needed, you can also use the Duo user ID shown in the Duo Admin URL for that user.

For direct API use, the import endpoint accepts:

- `duo_user_id`: the Duo user's ID from the Duo admin portal
- `username`: the authentik username to assign the imported authenticator to

The `stage_uuid` in the request must be the Duo stage whose API credentials should be used.

---

## Email authenticator setup stage

The Email Authenticator Setup stage registers an email-based authenticator for the current user, enabling one-time codes to be sent via email during subsequent authentications.

## About the email authenticator setup stage

During enrollment, the user supplies an email address if one is not already known, then confirms ownership by entering a one-time code.

The enrolled email address can later be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx).

## Configuration options

- **Use global connection settings**: use authentik's global email configuration instead of stage-specific SMTP settings.
- **SMTP Host**: SMTP server hostname for stage-specific email delivery.
- **SMTP Port**: SMTP server port.
- **SMTP Username**: optional SMTP username.
- **SMTP Password**: optional SMTP password.
- **Use TLS**: enable STARTTLS for the SMTP connection.
- **Use SSL**: enable SMTPS for the SMTP connection.
- **Timeout**: SMTP connection timeout in seconds.
- **From address**: sender address used for enrollment emails.
- **Token expiry**: how long the one-time code stays valid.
- **Subject**: subject line for the enrollment email.
- **Template**: email template used for the one-time code email. See [Custom templates](#custom-templates) below.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that lets users enroll this authenticator from user settings.

For SMTP requirements and global email delivery settings, see [Email configuration](../../../../install-config/email.mdx).

## Custom templates

This stage supports custom email templates in the same way as the [Email stage](../email/index.mdx#custom-templates). Mount your custom templates into authentik's template directory, and they will appear in the stage's **Template** dropdown.

For the full mounting instructions (Docker Compose and Kubernetes), a list of available template variables, and an example template, see [Custom templates](../email/index.mdx#custom-templates) in the Email stage documentation.

If a custom template does not appear in the **Template** selector, check the worker container logs. Templates are discovered when the stage configuration form loads.

## Flow integration

Use this stage in an enrollment or user-settings flow where the user should add an email authenticator.

To use the enrolled address during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **Email** device class.

## Notes

- Email authenticators created through this stage are tied to it, so the stage cannot be deleted while any of those authenticators still exist. Delete the authenticators first, then delete the stage.
- If **Use global connection settings** is enabled, configure the global email settings first. See the installation docs for [Docker Compose](../../../../install-config/install/docker-compose#email-configuration-optional-but-recommended) and [Kubernetes](../../../../install-config/install/kubernetes#email-configuration-optional-but-recommended).
- This stage is separate from the general-purpose [Email stage](../email/index.mdx), which is used for email verification and recovery.
- If the user already has an email address on their account, authentik can use that address during enrollment instead of prompting for a new address.

---

## Google Chrome Device Trust authenticator stage

This stage is deprecated in favor of the [Google Chrome connector](../../../../endpoint-devices/device-compliance/connectors/google-chrome.mdx) used with the [Endpoint Devices](../../../../endpoint-devices/index.mdx) feature set.

The Google Chrome Device Trust Authenticator Stage verifies a Chrome browser by using the Chrome Verified Access API.

## About the Google Chrome Device Trust authenticator stage

This stage validates Chrome Enterprise Device Trust signals from the user's browser. Unlike other authenticator setup stages, it does not enroll a reusable MFA device for later validation through the [Authenticator Validation stage](../authenticator_validate/index.mdx).

It was designed to integrate Chrome browsers and ChromeOS devices with authentik as the identity provider so access decisions could take device posture into account.

Typical use cases included remote-work, contractor, and BYOD environments where access should depend on the state of the browser or device in addition to the user's identity.

## Configuration options

- **Credentials**: Google service-account JSON used to access the Chrome Verified Access API.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that exposes the stage in user settings.

## Flow integration

Bind this stage directly into a flow where Chrome browser verification should happen.

Compared to the newer [Endpoint stage](../endpoint/index.mdx), this stage is Chrome-specific and relies on the legacy Device Trust integration path.

## Notes

### Requirements

- Google Chrome is required.
- A Google Cloud project with the Chrome Verified Access API enabled is required.
- A service account with exported JSON credentials is required.
- Chrome Enterprise Device Trust must be configured in the Google admin side to call back into authentik.

This integration was commonly paired with context-aware access policies, for example only allowing access from devices that meet patching or compliance requirements.

### Google setup outline

The original Chrome Device Trust setup has four main steps:

1. Create a Google Cloud project and enable the **Chrome Verified Access API**.
2. Create a service account.
3. Export a JSON key for that service account.
4. Configure Chrome Enterprise Device Trust to call authentik at `/endpoint/gdtc/chrome/`.

More concretely:

1. Open the Google Cloud Console and create a new project.
2. Enable the **Chrome Verified Access API** in that project.
3. In **IAM** > **Service Accounts**, create a service account.
4. Generate a JSON key from the service account's **Keys** tab.
5. In the Google admin side, configure a new provider under **Chrome browser > Connectors** and point it at your authentik URL, for example `https://authentik.company/endpoint/gdtc/chrome/`.
6. Paste the exported JSON key into the stage's **Credentials** field in authentik.

### Why this stage is different

This stage verifies the current Chrome browser directly and does not create a reusable MFA enrollment that is later selected by the Authenticator Validation stage. That difference is why the newer [Endpoint stage](../endpoint/index.mdx) is a better long-term replacement for most deployments.

---

## SMS authenticator setup stage

The SMS Authenticator Setup stage enrolls an SMS-based authenticator for the current user by using either Twilio or a generic HTTP endpoint.

## About the SMS authenticator setup stage

This stage stores a phone number, enabling one-time codes to be sent via SMS.

In normal mode, the enrolled phone number can later be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx). In **verify only** mode, the stage only verifies ownership of a phone number during enrollment and stores a hash instead of the number itself.

## Configuration options

- **Provider**: choose either **Twilio** or **Generic**.
- **From number**: sender number or identifier used for outbound SMS.
- **Account SID / External API URL**: for Twilio this is the account SID; for the generic provider this is the target API URL.
- **Auth / token**: for Twilio this is the auth token; for the generic provider this is the bearer token or basic-auth username.
- **Auth password**: optional password for generic basic authentication.
- **Auth type**: choose **Basic** or **Bearer** authentication for the generic provider.
- **Verify only**: verify phone ownership during enrollment without storing the plain phone number for later MFA use.
- **Mapping**: optional webhook mapping used to customize the payload sent to custom providers.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that lets users enroll this authenticator from user settings.

## Flow integration

Use this stage in an enrollment or user-settings flow where the user should add an SMS authenticator.

To require SMS during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **SMS** device class.

If you enable **Verify only**, phone numbers enrolled through this stage cannot be used by the [Authenticator Validation stage](../authenticator_validate/index.mdx).

## Notes

SMS authenticators created through this stage are tied to it, so the stage cannot be deleted while any of those authenticators still exist. Delete the authenticators first, then delete the stage.

### Twilio

For the Twilio provider, create a messaging service and collect the **Account SID**, **Auth token**, and a usable sender number from the Twilio console.

A typical Twilio setup looks like this:

1. Log in to the Twilio console.
2. Go to **Explore Products** > **Messaging** > **Services**.
3. Create a new messaging service and choose a verification-oriented use case.
4. Add a sender from the service's sender pool.
5. Copy the **Account SID** and **Auth token** into the stage configuration.

Using a property mapping, you can customize the message sent via Twilio. The mapping should return a dictionary with a `message` key. For example:

```python
return {
    "message": f"This is a custom message for {request.http_request.brand.branding_title} SMS authentication. The code is {token}."
}
```

Useful variables in that mapping include:

- `device.phone_number`
- `stage.from_number`
- `request.http_request.brand`

### Generic provider

For the generic provider, authentik sends an HTTP `POST` request to the configured API URL. The default payload contains:

```json
{
    "From": "<value of the From number field>",
    "To": "<the phone number of the user's device>",
    "Body": "<the token that the user needs to authenticate>",
    "Message": "<the full SMS message>"
}
```

Any response with status `400` or higher is treated as a failed send and blocks the user from proceeding.

You can also customize the generic-provider payload with a webhook mapping. For example:

```python
return {
    "from": stage.from_number,
    "to": device.phone_number,
    "body": f"foo bar baz {token}",
}
```

### Limiting phone numbers

To control which phone numbers are accepted, collect the number in a [Prompt stage](../prompt/index.mdx) and validate it with an expression policy before this stage runs. If a prompt field uses the key `phone`, the SMS setup stage will read that value from `prompt_data` instead of prompting the user again.

Example expression policy:

```python
phone_number = regex_replace(request.context["prompt_data"]["phone"], r"\s+", "")

if phone_number.startswith("+1234"):
    return True
ak_message("Invalid phone number or missing region code")
return False
```

A typical flow for this looks like:

1. Create a required text prompt field with the key `phone`.
2. Create a Prompt stage that contains that field.
3. Bind the validation policy to the Prompt stage.
4. Bind the Prompt stage before the SMS setup stage in the enrollment flow.

---

## Static authenticator setup stage

The Static Authenticator Setup stage creates one-time backup codes for a user. These codes are typically used as a fallback when the user's primary authenticator is unavailable.

## About the static authenticator setup stage

This stage enrolls static backup codes for the current user and generates a set of recovery codes. Each code can be used once.

Because static codes are a device class supported by the [Authenticator Validation stage](../authenticator_validate/index.mdx), they are usually added as a backup factor rather than the primary factor.

## Configuration options

- **Token count**: how many backup codes to generate for the user.
- **Token length**: how long each generated code should be.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that lets users enroll this authenticator from user settings.

## Flow integration

Use this stage in an enrollment or user-settings flow where the user is already authenticated or otherwise identified.

To use the generated backup codes during authentication, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the login flow and allow the **Static** device class.

## Notes

- Static codes are intended as emergency or backup credentials.
- Each code is consumed after a successful use.

---

## TOTP authenticator setup stage

The TOTP Authenticator Setup stage enrolls a time-based one-time password authenticator for the user, such as Google Authenticator, Authy, 1Password, or similar authenticator apps.

## About the TOTP authenticator setup stage

This stage creates a TOTP authenticator for the current user and presents a standard OTP configuration URL that authenticator apps can scan or import.

The enrolled TOTP authenticator can then be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx).

## Configuration options

- **Digits**: choose whether generated codes use 6 or 8 digits.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that lets users enroll this authenticator from user settings.

## Flow integration

Use this stage in an enrollment or user-settings flow where the user can add a TOTP authenticator.

To require that authenticator during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **TOTP** device class.

## Notes

- Six-digit TOTP codes are the most widely compatible option.
- During enrollment, authentik uses the active brand's title as the issuer shown in the TOTP app. If you operate multiple authentik instances with the same usernames, distinct brand titles help avoid confusion in authenticator apps.

---

## Authenticator validation stage

The Authenticator Validation stage validates an already enrolled authenticator.

## About the authenticator validation stage

This stage is used during authentication after a user has already enrolled one or more authenticators with a setup stage, such as:

- [Duo Authenticator Setup stage](../authenticator_duo/index.mdx)
- [Email Authenticator Setup stage](../authenticator_email/index.mdx)
- [SMS Authenticator Setup stage](../authenticator_sms/index.mdx)
- [Static Authenticator Setup stage](../authenticator_static/index.mdx)
- [TOTP Authenticator Setup stage](../authenticator_totp/index.mdx)
- [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.mdx)

## Configuration options

- **Not configured action**: control what happens when the user has no compatible authenticator.
  - **Skip**: continue the flow without MFA.
  - **Deny**: deny access and end the flow.
  - **Configure**: inject one of the configured enrollment stages and continue after that stage succeeds.
- **Configuration stages**: stages that can be injected when **Not configured action** is set to **Configure**.
- **Device Classes**: which enrolled authenticator types can be used at this step.
- **Last validation threshold**: skip validation if the user has successfully used a compatible device within the configured time window.
- **WebAuthn User verification**: user-verification requirement for WebAuthn authentication.
- **WebAuthn Hints**: browser hints that influence which WebAuthn authenticator is preferred.
- **WebAuthn Device type restrictions**: optionally limit which WebAuthn device types are allowed.
- **Email OTP throttling factor**: exponential back-off factor for Email devices after failed verification attempts.
- **SMS OTP throttling factor**: exponential back-off factor for SMS devices after failed verification attempts.
- **TOTP throttling factor**: exponential back-off factor for TOTP devices after failed verification attempts.
- **Static OTP throttling factor**: exponential back-off factor for static recovery codes after failed verification attempts.

## Flow integration

This stage normally appears in authentication flows after [Identification](../identification/index.mdx) and [Password](../password/index.mdx), and before [User Login](../user_login/index.mdx).

If **Not configured action** is set to **Configure**, the stage can bootstrap enrollment by injecting one or more authenticator setup stages into the running flow.

## Notes

### Require more than one MFA method

To require users to enroll more than one MFA method and validate with each method on every login, add multiple Authenticator Validation stages to the same authentication flow.

Configure each validation stage with a different set of allowed **Device Classes**, and set **Not configured action** to **Configure**.

For example, to require both TOTP and WebAuthn:

1. Create a TOTP setup stage and a WebAuthn setup stage if you do not already have them.
2. Create an Authenticator Validation stage for TOTP:
   - Set **Device Classes** to `totp`.
   - Set **Not configured action** to **Configure**.
   - Set **Configuration stages** to your TOTP setup stage.
3. Create a second Authenticator Validation stage for WebAuthn:
   - Set **Device Classes** to `webauthn`.
   - Set **Not configured action** to **Configure**.
   - Set **Configuration stages** to your WebAuthn setup stage.
4. Bind both validation stages to your authentication flow in the order that users should enroll and validate them.

On first sign-in, users who do not yet have one of the required methods are prompted to configure it before the flow continues. On later sign-ins, each validation stage checks only the device classes configured on that stage.

### Require at least two enrolled MFA methods of any type

If you want to require users to enroll at least two different MFA methods, regardless of which types they choose, use an [Expression Policy](../../../../customize/policies/types/expression/index.mdx) to count the enrolled device classes for the user.

```python
from authentik.stages.authenticator import devices_for_user

pending_user = request.context.get("pending_user")
if not pending_user or not pending_user.pk:
    return False

device_types = {
    device.__class__.__name__.lower().replace("device", "")
    for device in devices_for_user(pending_user, confirmed=True)
}

return len(device_types) >= 2
```

Bind the policy to the flow or stage binding that controls whether the user can continue without enrolling another authenticator.

If you select multiple **Configuration stages** on a single validation stage, users can choose which authenticator to enroll for that requirement.

### Less-frequent validation

Set **Last validation threshold** to a non-zero value to avoid prompting on every login. Any compatible authenticator within the allowed classes can satisfy that threshold.

For code-based authenticators such as TOTP, Static, and SMS, values below `seconds=30` are not useful because those authenticators do not store exact validation timestamps at sub-window precision.

### Passwordless authentication

Firefox has known issues with some Touch ID and platform-authenticator flows. See Mozilla bug `1536482` for one longstanding example.

Passwordless authentication in this stage currently relies on **WebAuthn** authenticators.

To build a dedicated passwordless flow:

1. Create an **Authentication** flow.
2. Add an Authenticator Validation stage that allows the **WebAuthn** device class.
3. Add any extra verification stages you still require.
4. End the flow with a [User Login stage](../user_login/index.mdx).

If you want users to choose a passkey directly from the browser's autofill UI on the identification screen, configure **Passkey autofill** in the [Identification stage](../identification/index.mdx#passkey-autofill-webauthn-conditional-ui). This requires a discoverable credential, also known as a resident key.

Users can either access the passwordless flow directly or reach it through an Identification stage's **Passwordless flow** link.

### WebAuthn hints

Hints are advisory and browsers can ignore them based on available authenticators or platform capabilities.

Optional hints can guide the browser toward a preferred authenticator type during WebAuthn authentication:

- **Security key**: prefer a portable FIDO2 device such as a YubiKey.
- **Client device**: prefer a built-in platform authenticator such as Touch ID or Windows Hello.
- **Hybrid**: prefer a platform authenticator on a nearby mobile device, typically through a QR code.

The order of selected hints matters. For example, selecting **Security key** before **Hybrid** asks the browser to prefer security keys before hybrid authentication.

### Automatic authenticator selection

If the user has multiple compatible authenticators, authentik lets them choose one. After a successful validation, the last-used authenticator is automatically preferred the next time this stage runs.

### WebAuthn authenticator type restrictions

**WebAuthn Device type restrictions** are an allowlist for already-enrolled WebAuthn authenticators. When no device types are selected, any enrolled WebAuthn authenticator that matches the stage's **Device Classes** can be used. When one or more device types are selected, authentik only allows WebAuthn authentication from enrolled devices whose recorded device type matches one of the selected entries.

The available device-type entries are populated from the [FIDO Alliance Metadata Service](https://fidoalliance.org/metadata/) data and additional AAGUID metadata bundled with the authentik release. This is useful when you need to limit authentication to specific hardware families or compliance profiles.

These restrictions only apply to WebAuthn devices that have a stored device type. Devices enrolled in authentik 2024.4 or later store this information when the authenticator returns a known AAGUID. Older WebAuthn enrollments or devices without a stored type cannot be matched by this filter. To enforce a device-type policy for enrollment and later authentication, configure the same allowlist on the [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.mdx) and have users re-enroll devices that predate stored device types.

### Throttling

To slow down brute-force attacks against code-based authentication methods, the stage applies an exponential back-off to each device after a failed verification attempt. The delay required between verification attempts grows with each successive failure:

```text
delay_seconds = factor * 2^(n - 1)
```

In this formula, `factor` is the per-device-class throttling factor configured on the stage and `n` is the number of successive failures on that device.

For example, with the default factor of `1`, the required delay between attempts is `1, 2, 4, 8, 16, ...` seconds. With a factor of `0.5`, it is `0.5, 1, 2, 4, ...` seconds. A successful verification resets the counter.

A factor of `0` disables throttling for that device class.

WebAuthn and Duo devices are not throttled.

### Authentication logging

When passwordless authentication succeeds through this stage, authentik records the method as `auth_webauthn_pwl` in flow context and related events.

Example event context:

```json
{
    "auth_method": "auth_webauthn_pwl",
    "auth_method_args": {
        "device": {
            "pk": 1,
            "app": "authentik_stages_authenticator_webauthn",
            "name": "test device",
            "model_name": "webauthndevice"
        }
    }
}
```

---

## WebAuthn / FIDO2 / Passkeys authenticator setup stage

The WebAuthn / FIDO2 / Passkeys Authenticator setup stage enrolls a WebAuthn authenticator for the current user.

## About the WebAuthn authenticator setup stage

This stage supports common WebAuthn authenticator types, including:

- security keys such as YubiKey or Google Titan
- platform authenticators such as Windows Hello, Touch ID, or Face ID
- passkeys stored by operating systems or password managers

Enrolled authenticators can later be used with the [Authenticator Validation stage](../authenticator_validate/index.mdx).

## Configuration options

- **User verification**: require, prefer, or discourage built-in user verification during registration.
- **Resident key requirement**: control whether the authenticator should create a discoverable credential.
- **Authenticator Attachment**: restrict enrollment to platform authenticators, cross-platform authenticators, or leave it unrestricted.
- **Hints**: browser hints that influence which authenticator is preferred during enrollment.
- **Device type restrictions**: limit enrollment to specific WebAuthn device types.
- **Maximum registration attempts**: maximum number of failed registration attempts before the stage denies access. A value of `0` disables the limit.
- **Authenticator type name**: optional friendly name shown to the user in self-service settings.
- **Configuration flow**: optional authenticated flow that lets users enroll this authenticator from user settings.

## Flow integration

Use this stage in an enrollment or user-settings flow where the user should register a passkey or hardware key.

To require those devices during login, add an [Authenticator Validation stage](../authenticator_validate/index.mdx) to the authentication flow and allow the **WebAuthn** device class.

If you want passkey autofill on the login form itself, configure the [Identification stage](../identification/index.mdx#passkey-autofill-webauthn-conditional-ui) to reference a WebAuthn-capable Authenticator Validation stage.

## Notes

### User verification

**User verification** controls whether authentik requires, prefers, or discourages user verification on the authenticator itself. On platform authenticators such as Windows Hello, that can determine whether a PIN or biometric check is required.

### Resident key requirement

For passkey-based passwordless login, set **Resident key requirement** to **Preferred** or **Required** so the created credential is discoverable.

### Authenticator attachment

Use **Authenticator Attachment** when the flow should prefer either removable authenticators such as YubiKeys or built-in authenticators such as Touch ID, Windows Hello, or password-manager passkeys.

This controls the `authenticatorAttachment` parameter sent to the browser during WebAuthn registration:

- **No preference is sent**: the browser can offer any available authenticator.
- **Platform**: prefer a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello.
- **Cross-platform**: prefer a roaming authenticator, such as a YubiKey or Google Titan.

If [WebAuthn hints](#webauthn-hints) are configured and this option is left unset, authentik infers an attachment value from the selected hints for backward compatibility with older browsers.

### WebAuthn hints

Hints are advisory and browsers can ignore them based on available authenticators or platform capabilities.

Optional hints can guide the browser toward a preferred authenticator type during registration:

- **Security key**: prefer registering a credential with a portable FIDO2 device such as a YubiKey.
- **Client device**: prefer registering a credential with a built-in platform authenticator such as Touch ID or Windows Hello.
- **Hybrid**: prefer registering a credential using a platform authenticator on a nearby mobile device, typically through a QR code.

The order of selected hints matters. For example, selecting **Security key** before **Hybrid** asks the browser to prefer security keys before hybrid registration.

For backward compatibility with older browsers that do not support hints, authentik automatically infers the `authenticatorAttachment` parameter from the selected hints when **Authenticator Attachment** is not explicitly set:

- Only **Security key** and/or **Hybrid** hints: `cross-platform`
- Only **Client device** hints: `platform`
- If both client-device and cross-platform hints are selected, no value is inferred

### Duplicate devices

The **Prevent duplicate devices** option was removed in 2026.8. It compared attestation certificates, which manufacturers share across entire production batches, so it rejected legitimate enrollments of a second security key. No configuration replaces it, and no action is needed when upgrading.

### Device type restrictions

**Device type restrictions** are an allowlist for WebAuthn registration. When no device types are selected, authentik allows any WebAuthn authenticator that the browser and authenticator can register. When one or more device types are selected, authentik only allows registration when the authenticator returns an AAGUID that matches one of the selected entries.

The available device-type entries are populated from the [FIDO Alliance Metadata Service](https://fidoalliance.org/metadata/) data and additional AAGUID metadata bundled with the authentik release. This lets you restrict enrollment to specific hardware families or passkey providers listed in that metadata.

If you select specific device types, newly added metadata entries are not allowed automatically. Review this allowlist after authentik upgrades if your compliance policy should include newly recognized authenticators.

authentik also includes the special device-type `authentik: Unknown devices`. Select it only when you want to allow authenticators that return an AAGUID that is not present in authentik's device-type metadata. Authenticators that do not return an AAGUID cannot satisfy a device-type restriction.

---

## Captcha stage

The Captcha stage adds CAPTCHA verification to a flow by using Google reCAPTCHA or compatible alternatives like hCaptcha, Cloudflare Turnstile, and Cap.

## About the Captcha stage

This stage verifies that the current interaction appears human before the flow continues.

It can either be bound to a flow or embedded inside the [Identification stage](../identification/index.mdx) by setting the Identification stage's **Captcha stage** option.

## Configuration options

- **Public Key**: CAPTCHA site key.
- **Private Key**: CAPTCHA secret key.
- **Interactive**: enable an interactive CAPTCHA widget instead of score-based verification.
- **Score Minimum Threshold**: minimum accepted score for score-based providers.
- **Score Maximum Threshold**: maximum accepted score for score-based providers.
- **Error on Invalid Score**: show an error immediately when the score is outside the configured threshold. If disabled, the flow continues and policies can inspect the result from context.
- **JavaScript URL**: JavaScript loader URL for the provider.
- **API Verification URL**: verification endpoint URL for the provider.
- **Request Content Type**: content type used when authentik verifies the CAPTCHA token with the provider.

## Flow integration

Use this stage anywhere a flow should require a CAPTCHA check, especially in enrollment, recovery, or other public-facing flows.

If you embed it in an [Identification stage](../identification/index.mdx), configure the CAPTCHA provider for invisible or background use.

The CAPTCHA stage does not run when the user completes an Identification stage with a passkey, because authentik completes identification immediately after a successful WebAuthn check. For more information about this behavior and its security rationale, see [CAPTCHA and passkey authentication](../identification/index.mdx#captcha-and-passkey-authentication).

## Notes

### Google reCAPTCHA

Google reCAPTCHA Enterprise, reCAPTCHA v2, and reCAPTCHA v3 are all supported.

Use the keys from [https://www.google.com/recaptcha/admin](https://www.google.com/recaptcha/admin).

Recommended defaults for reCAPTCHA:

- **Interactive**: disabled for score-based reCAPTCHA
- **Score Minimum Threshold**: `0.5`
- **Score Maximum Threshold**: `1.0`
- **JavaScript URL**: `https://www.recaptcha.net/recaptcha/api.js`
- **API Verification URL**: `https://www.recaptcha.net/recaptcha/api/siteverify`

![](./captcha-admin.png)

### hCaptcha

See [https://docs.hcaptcha.com/switch](https://docs.hcaptcha.com/switch).

Recommended values:

- **Interactive**: enabled
- **JavaScript URL**: `https://js.hcaptcha.com/1/api.js`
- **API Verification URL**: `https://api.hcaptcha.com/siteverify`

Score thresholds only apply to hCaptcha Enterprise.

### Cap

Cap is a self-hostable CAPTCHA server that uses proof-of-work challenges.

See [https://trycap.dev/guide/](https://trycap.dev/guide/).

authentik supports Cap's default widget. The floating widget is not supported.

Recommended values:

- **Public Key**: public Cap endpoint for the site key path, for example `https://cap.example.com/site-key/`
- **Private Key**: Cap secret key
- **Interactive**: enabled
- **JavaScript URL**: self-hosted Cap widget asset, for example `https://cap.example.com/assets/widget.js`. If you use a CDN, pin a reviewed release such as `https://cdn.jsdelivr.net/npm/cap-widget@<version>` instead of the unversioned package URL. See [Cap releases](https://github.com/tiagozip/cap/releases).
- **API Verification URL**: Cap verification endpoint, for example `https://cap.example.com/site-key/siteverify`
- **Request Content Type**: JSON

Cap does not use score thresholds.

### Cloudflare Turnstile

See [https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha](https://developers.cloudflare.com/turnstile/get-started/migrating-from-recaptcha).

Recommended values:

- **Public Key**: Turnstile site key
- **Private Key**: Turnstile secret key
- **Interactive**: enable when using invisible or managed Turnstile modes
- **JavaScript URL**: `https://challenges.cloudflare.com/turnstile/v0/api.js`
- **API Verification URL**: `https://challenges.cloudflare.com/turnstile/v0/siteverify`

Turnstile does not use score thresholds.

### Cloudflare Turnstile setup flow

If you are configuring Turnstile from scratch:

1. Create the Turnstile widget in Cloudflare.
2. Copy the **Site Key** into **Public Key**.
3. Copy the **Secret Key** into **Private Key**.
4. Enable **Interactive** if the Turnstile widget is configured as **Invisible** or **Managed**.
5. Leave score thresholds at their defaults because Turnstile does not use them.

---

## Consent stage

The Consent stage asks the user to approve sharing data with an application or relying party.

## About the consent stage

This stage is commonly used in authorization flows, where a user should explicitly consent before authentik shares profile data or other claims with an application.

The default `default-provider-authorization-explicit-consent` flow already includes a Consent stage.

A typical use case is prompting the user to allow authentik to share profile data such as name, email address, or avatar with the application they are signing in to.

## Configuration options

- **Mode**: control how long a granted consent remains valid.
  - **Always require consent**: prompt every time.
  - **Consent given lasts indefinitely**: store consent without expiration.
  - **Consent expires**: store consent until the configured expiry time.
- **Consent expires in**: expiration offset used when the mode is set to expiring consent.

## Flow integration

Bind this stage into an authorization flow anywhere the user should see the consent prompt.

If you use the default explicit-consent authorization flow, the stage is already present and usually does not need to be added manually.

## Notes

### Default flow

If you are using the default `default-provider-authorization-explicit-consent` flow, you usually do not need to add a Consent stage manually because it is already present.

If you are building a custom authorization flow, the usual sequence is:

1. Create the Consent stage.
2. Bind it into the authorization flow.
3. Optionally bind an expression policy to the stage binding if the consent text should be customized.

If you are adding the stage from scratch in the Admin interface, the typical workflow is:

1. Go to **Flows and Stages** > **Stages** and create a **Consent Stage**.
2. Set the **Mode** and, if needed, the expiry duration.
3. Open the target authorization flow.
4. Add the Consent stage to that flow's stage bindings.

### Custom consent text

You can customize the text shown on the consent screen by setting the `consent_header` key in flow context before the stage runs, for example from an expression policy:

```python
request.context["flow_plan"].context["consent_header"] = (
    "Are you OK with your IdP provider sharing your user identification data "
    "with the application?"
)
return True
```

Bind that policy to the Consent stage binding inside the authorization flow where you want the wording to change.

The binding workflow is:

1. Open the authorization flow that contains the Consent stage.
2. Go to **Stage Bindings**.
3. Expand the Consent stage binding that should use the custom text.
4. Bind the expression policy to that stage binding.

### Stored consent

When consent is stored, authentik keeps track of the user, the application, and the granted permissions so later requests can reuse or re-prompt according to the selected mode.

Users can check their past consent approvals via the User Settings menu.

---

## Deny stage

The Deny stage stops the current flow immediately.

## About the deny stage

Use this stage when the flow should end with access denied, including cases where the user is not signed in yet and group-based permissions are not available.

## Configuration options

This stage has no stage-specific configuration options.

## Flow integration

Bind this stage where a flow should stop after a policy or earlier stage determines that the user must not continue.

## Notes

To use this stage effectively, make sure **Evaluate when flow is planned** is disabled on the stage binding. See [Planning and stage policies](../../flow/planner.mdx#planning-and-stage-policies).

If the binding is evaluated during flow planning, the denial can happen earlier than intended and skip the checks that were meant to decide whether the user should be denied.

### Example: block a known IP range

One common use case is to bind a Deny stage to an expression policy that blocks requests from a specific IP range.

For example:

1. Create a Deny stage.
2. Create an [Expression policy](../../../../customize/policies/types/expression/index.mdx) with logic such as:

```python
from ipaddress import ip_network

return ak_client_ip in ip_network("203.0.113.0/24")
```

3. Bind that policy to the Deny stage in the flow.

When the policy passes, the Deny stage runs and the flow stops immediately.

### Example: Block password recovery for inactive users

Account deactivation prevents authentication, but it does not automatically prevent recovery stages from sending email or changing a password. To stop inactive users before those actions occur:

1. Add a Deny stage to the recovery flow after the Identification stage and before the Email stage.

2. Create an [Expression policy](../../../../customize/policies/types/expression/index.mdx) with the following expression:

   ```python
   pending_user = request.context.get("pending_user")

   return bool(
       pending_user
       and pending_user.pk
       and not pending_user.is_active
   )
   ```

3. Bind the policy to the Deny stage binding.

4. On the Deny stage binding, disable **Evaluate when flow is planned** and enable **Evaluate when stage is run**. The policy must run after the Identification stage adds `pending_user` to the flow context.

The Deny stage runs only when the identified user exists and is inactive. Active users and placeholder users that represent unknown identifiers skip the Deny stage.

The Deny stage produces a different response for an inactive account than the **Email sent.** challenge that the Email stage displays for unknown and active accounts. An attacker can use this difference to determine that an account exists or is inactive.

Use this configuration only if disclosing account state is acceptable. A Deny stage cannot both stop recovery and preserve the Email stage's indistinguishable response.

---

## Email stage

The Email stage sends a verification or action email from within a flow.

## About the email stage

This stage is used for email verification, account recovery, invitations, and similar flow steps where authentik should send a tokenized link or message to a user.

The email is normally sent to the current `pending_user`, but the target address can be overridden from flow context.

When an email cannot be delivered immediately, authentik retries delivery through its background worker.

## Configuration options

- **Use global connection settings**: use authentik's global email configuration instead of stage-specific SMTP settings.
- **SMTP Host**: SMTP server hostname for stage-specific delivery.
- **SMTP Port**: SMTP server port.
- **SMTP Username**: optional SMTP username.
- **SMTP Password**: optional SMTP password.
- **Use TLS**: enable STARTTLS for the SMTP connection.
- **Use SSL**: enable SMTPS for the SMTP connection.
- **Timeout**: SMTP connection timeout in seconds.
- **From address**: sender address used for flow emails.
- **Account Recovery Max Attempts**: maximum number of recovery emails allowed in the configured time window.
- **Account Recovery Cache Timeout**: time window used for recovery-email rate limiting.
- **Activate user on success**: set the identified user's `is_active` state to `True` after they return with a valid email token. In a recovery flow, this setting allows an inactive user to reactivate their account through email verification. Disable this setting if reactivation must remain an administrative action. Disabling it does not prevent the user from receiving a recovery email or changing their password.
- **Token expiry**: how long the email token remains valid.
- **Subject**: subject line used for the email.
- **Template**: template used to render the email body.

## Flow integration

Use this stage in recovery, enrollment, verification, or invitation flows where an email should be sent before the flow continues.

By default, the message goes to the current `pending_user`. To override the destination, set `email` in the flow plan context before the stage runs:

```python
request.context["flow_plan"].context["email"] = "foo@bar.baz"
return True
```

You can also source the address from prompt data or another user attribute:

```python
request.context["flow_plan"].context["email"] = request.context["prompt_data"]["email"]
return True
```

```python
request.context["flow_plan"].context["email"] = request.context["pending_user"].attributes.get("otherEmail")
return True
```

## Notes

### Rate limiting

The recovery rate-limiting fields only affect recovery-style email sends. They limit how many recent attempts a user can trigger within the configured time window.

### Recovery and account enumeration

When an Identification stage does not find a user, it can create a placeholder user if **Pretend user exists** is enabled. In a recovery flow, the Email stage shows the same **Email sent.** challenge for this placeholder user without sending an email or creating a recovery token. This behavior prevents the recovery response from disclosing whether the identifier belongs to an account.

An existing inactive user is not a placeholder user. By default, the Email stage sends that user a recovery email and creates a recovery token. Deactivating an account prevents authentication, but it does not automatically prevent the user from recovering their account.

You can use a policy bound to a Deny stage to block inactive users before the Email stage. However, the denial response differs from the response for an unknown or active account and can disclose whether an account exists or is inactive. For configuration details and this security tradeoff, see [Block password recovery for inactive users](../deny/index.mdx#example-block-password-recovery-for-inactive-users).

### Custom templates

You can provide custom email templates.

You can also add a matching `.txt` file next to the `.html` file to send multipart text and HTML emails.

Place custom templates in the `custom-templates` directory next to your Compose file. The template becomes selectable in the Email stage configuration.

  
  
Create a ConfigMap with your email templates:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
    name: authentik-templates
    namespace: authentik
data:
    my-template.html: |
        <tr>...
```

Then mount it into the worker container from your Helm values:

```yaml
volumes:
    - name: email-templates
      configMap:
          name: authentik-templates
volumeMounts:
    - name: email-templates
      mountPath: /templates
```

  

If a custom template does not appear in the selector, check the worker logs.

### Template variables

Templates are rendered with Django's templating engine. Common variables include:

- `url`: the full URL the user should open
- `user`: the pending user
- `expires`: when the token expires

These templates are rendered with Django's templating engine, so you can also use standard template inheritance and translation tags.

![](./custom_template.png)

### Example template

Templates can extend the base email template and use standard Django template tags. For example:

Each Django `{% ... %}` tag must stay on one line; a tag wrapped across lines won't parse.

<!-- prettier-ignore -->
```html
{# This comment is not rendered in the final email. #}
{% extends "email/base.html" %}
{% load i18n %}
{% load humanize %}

{% block content %}
<tr>
    <td class="alert alert-success">
        {% blocktrans with username=user.username %} Hi {{ username }},{% endblocktrans %}
    </td>
</tr>
<tr>
    <td class="content-wrap">
        <table width="100%" cellpadding="0" cellspacing="0">
            <tr>
                <td class="content-block">
                    {% blocktrans %}You recently requested to change your password for your authentik account. Use the button below to set a new password.{% endblocktrans %}
                </td>
            </tr>
            <tr>
                <td class="content-block">
                    <table role="presentation" border="0" cellpadding="0" cellspacing="0" class="btn btn-primary">
                        <tbody>
                            <tr>
                                <td align="center">
                                    <table role="presentation" border="0" cellpadding="0" cellspacing="0">
                                        <tbody>
                                            <tr>
                                                <td>
                                                    <a id="confirm" href="{{ url }}" rel="noopener noreferrer" target="_blank">{% trans 'Reset Password' %}</a>
                                                </td>
                                            </tr>
                                        </tbody>
                                    </table>
                                </td>
                            </tr>
                        </tbody>
                    </table>
                </td>
            </tr>
            <tr>
                <td class="content-block">
                    {% blocktrans with expires=expires|timeuntil %}If you did not request a password change, please ignore this email. The link above is valid for {{ expires }}.{% endblocktrans %}
                </td>
            </tr>
        </table>
    </td>
</tr>
{% endblock %}
```

---

## Endpoint stage

The Endpoint stage checks whether the current browser or device is known to authentik's Endpoint Devices system and injects device facts into flow context.

## About the endpoint stage

This stage integrates with [Endpoint Devices](../../../../endpoint-devices/index.mdx). It can associate the current session with a managed endpoint and make device facts available to policies and later stages.

## Configuration options

- **Connector**: which endpoint connector should be used to gather device information.
- **Mode**: whether endpoint verification is optional or required.

## Flow integration

Use this stage in authentication or authorization flows where device posture should influence access decisions.

The device facts gathered by this stage can then be consumed by policies or by later flow logic.

## Notes

- In **required** mode, the flow fails if the device cannot be verified.
- In **optional** mode, authentik attempts verification and can continue without attaching a device if verification does not complete in time.

---

## Identification stage

The Identification stage is the primary user-identification step in most authentik login flows.

## About the identification stage

This stage lets the user identify themselves by username, email address, UPN, or external source. You can also embed password entry, CAPTCHA verification, and passkey autofill directly into the identification step.

## Configuration options

- **User Fields**: which identifiers the user can enter.
  - **Username**
  - **Email**
  - **UPN**
- **Password stage**: optional [Password stage](../password/index.mdx) to render inline instead of as a separate step.
- **Captcha stage**: optional [Captcha stage](../captcha/index.mdx) to run as part of identification.
- **WebAuthn Authenticator Validation Stage**: optional [Authenticator Validation stage](../authenticator_validate/index.mdx) used for passkey autofill.
- **Case-insensitive matching**: match identifiers regardless of case.
- **Show matched user**: display the matched user's username and avatar after a valid identifier is entered.
- **Pretend user exists**: continue even when the entered identifier does not match a real user.
- **Enable remember me on this device**: allow the browser to remember the entered username and jump directly to password entry later.
- **Enrollment flow**: optional flow linked as a sign-up path.
- **Recovery flow**: optional flow linked as a recovery path.
- **Passwordless flow**: optional flow linked as a dedicated passwordless sign-in path.
- **Sources**: which OAuth or SAML sources should be shown.
- **Show source labels**: show labels in addition to source icons.

## Flow integration

This stage usually appears first in authentication and recovery flows.

- If **Password stage** is configured here, do not also bind that Password stage separately in the same flow.
- If **Captcha stage** is configured here, do not also bind that Captcha stage separately in the same flow.
- If no user fields are selected, the stage acts as a source-only entry point.

## Notes

### User fields

If no user fields are selected, only the configured sources are shown.

For **UPN**, authentik matches against the `upn` attribute on the user, which is commonly populated from an LDAP source.

### Password and CAPTCHA embedding

If you set a **Password stage** here, the password prompt appears on the same step as identification instead of as a later stage.

If you set a **Captcha stage** here, configure that CAPTCHA for invisible or background use so it renders correctly inside the identification form.

### Pretend user exists

When enabled, invalid identifiers still let the flow continue as long as the format is valid for the selected field type. Stages such as [Password](../password/index.mdx) and [Email](../email/index.mdx) are aware of this behavior and handle the synthetic pending user safely.

### Source behavior

Selected OAuth and SAML sources are shown below the local identification form. If no user fields are selected and exactly one source is configured, authentik can redirect to that source automatically as long as **Passwordless flow** is not configured.

By default, sources are shown by icon only. Enable **Show source labels** if the source name should be shown alongside the icon.

Sources can also be marked as **Promoted** in their source configuration. Promoted sources are shown as prominent full-width buttons on the login page instead of small icon buttons.

### Linked flows

The **Enrollment flow** and **Recovery flow** settings control the links shown below the identification form. The passwordless flow setting adds a direct link to a separate passwordless authentication flow.

When **Enable remember me on this device** is enabled, authentik can store the username locally and jump to the password field on later visits. Users can still select **Not you?** to enter a different username or disable the remembered value.

### Passkey autofill (WebAuthn conditional UI)2025.12

When configured, the Identification stage can offer passkey login directly from the browser's passkey or autofill UI without requiring the user to type a username first.

authentik automatically falls back to the normal identification flow when passkey autofill is not available.

### CAPTCHA and passkey authentication

When a user authenticates with a passkey through the Identification stage's WebAuthn configuration, authentik completes the stage immediately after the WebAuthn check. It does not run a CAPTCHA that is configured on the Identification stage, including an interactive CAPTCHA. This is intentional: CAPTCHA protects primarily against bots that guess, reuse, or vary credentials, while WebAuthn uses a cryptographic challenge and does not expose those attack paths. Skipping the CAPTCHA does not reduce protection against credential-guessing attacks and avoids an unnecessary challenge for passkey users.

If you need to reduce the impact of requests that consume resources during authentication, use rate limiting or similar controls in your reverse proxy configuration instead of relying on a CAPTCHA after a successful WebAuthn check.

#### Requirements

- **HTTPS** is required except on `localhost`.
- The browser must support WebAuthn conditional mediation.
- The user must have a compatible discoverable credential, also known as a resident key.
- The user must access authentik on the same hostname the passkey was created for.

#### Configuration

1. Create or edit an [Authenticator Validation stage](../authenticator_validate/index.mdx) that allows the **WebAuthn** device class.
2. Set the Identification stage's **WebAuthn Authenticator Validation Stage** to that stage.
3. Make sure users have already enrolled a WebAuthn authenticator, for example with the [WebAuthn / FIDO2 / Passkeys Authenticator setup stage](../authenticator_webauthn/index.mdx).

If the user has multiple passkeys, the browser shows its own picker. In the default authentication flow, authentik skips the MFA validation stage after a passkey login with an expression policy; adjust that policy if you still want a second factor after passkey login.

#### Troubleshooting

- If no passkey prompt appears, check HTTPS, browser support, and that the validation stage is configured. The browser normally triggers the passkey suggestion when the user focuses the username field.
- If no passkey prompt appears, make sure the login page is not embedded in an iframe because some browsers block conditional UI outside top-level browsing contexts.
- If the prompt appears but falls back to username/password, check that the referenced validation stage allows WebAuthn and that the user has a valid enrolled authenticator.

---

## Invitation stage

The Invitation stage is used to invite users to enroll in authentik. It can optionally enroll users with preset values.

## About the invitation stage

This stage is typically used in enrollment flows where users should only be allowed to continue if they were invited by an administrator.

An invitation can also carry fixed data that is applied during enrollment.

## Configuration options

- **Continue flow without invitation**: if enabled, the flow continues when no invitation token is present. If disabled, the flow stops when the token is missing.

## Flow integration

Add this stage near the beginning of an enrollment flow that should be invitation-gated.

Users can enter the flow with an invitation token by using a URL like:

```text
https://authentik.example/if/flow/your-enrollment-flow/?itoken=invitation-token
```

You can also collect the token with a [Prompt stage](../prompt/index.mdx) by using a prompt field with the key `token`.

## Notes

- In policies, you can check whether an invitation is active with `request.context.get("invitation_in_effect", False)`.
- Invitation objects can be restricted to a specific flow and can be marked as single-use.

---

## Mutual TLS stage

The Mutual TLS stage authenticates or enrolls users by validating a presented client certificate.

## About the mutual TLS stage

This stage uses a client certificate from the browser or device, such as one stored locally or on a smart card, PIV card, or hardware token.

## Configuration options

- **Mode**: whether the certificate is optional or required.
- **Certificate authorities**: certificate authorities used to validate client certificates.
- **Certificate attribute**: which certificate attribute should be read for matching.
  - subject
  - common name
  - email
- **User attribute**: which user attribute should be compared against the certificate value.
  - username
  - email

## Flow integration

Use this stage in authentication or enrollment flows where client-certificate authentication is required or should be offered.

If **Certificate authorities** is left empty, authentik falls back to the client-certificate configuration on the active brand.

## Notes

Do not use a publicly trusted certificate authority for client authentication. Use a private PKI that is trusted only by your managed endpoints, and combine mTLS with policy checks when needed.

### Reverse-proxy configuration

When authentik is behind a reverse proxy, the proxy must validate the client certificate and forward it to authentik.

#### nginx

```nginx
# server {
    ssl_client_certificate /etc/ssl/path-to-my-ca.pem;
    ssl_verify_client on;

    # location / {
        proxy_set_header ssl-client-cert $ssl_client_escaped_cert;
    # }
# }
```

#### ingress-nginx

```yaml
nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
nginx.ingress.kubernetes.io/auth-tls-secret: namespace/secretName
```

The referenced secret must contain `ca.crt`, which is the certificate authority used to validate client certificates.

See the [ingress-nginx client-certificate documentation](https://kubernetes.github.io/ingress-nginx/examples/auth/client-certs/) for details.

#### Traefik

```yaml
tls:
    options:
        default:
            clientAuth:
                caFiles:
                    - tests/clientca1.crt
                    - tests/clientca2.crt
                clientAuthType: RequireAndVerifyClientCert
```

See the [Traefik mTLS documentation](https://doc.traefik.io/traefik/https/tls/#client-authentication-mtls).

#### Traefik middleware

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
    name: test-passtlsclientcert
spec:
    passTLSClientCert:
        pem: true
```

See the [Traefik PassTLSClientCert documentation](https://doc.traefik.io/traefik/middlewares/http/passtlsclientcert/) for details.

#### Envoy

See the [Envoy mTLS documentation](https://www.envoyproxy.io/docs/envoy/latest/start/quick-start/securing#use-mutual-tls-mtls-to-enforce-client-certificate-authentication) and [Envoy forwarded-client-cert header documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-client-cert) for the required proxy configuration.

#### No reverse proxy

If authentik terminates TLS itself, configure the trusted client certificate authorities on the active [brand](../../../../customize/branding/index.mdx#client-certificates).

### Stage setup outline

After the reverse proxy or brand is configured to pass client certificates through:

1. Create or import the certificate authority under **System** > **Certificates**.
2. Create a **Mutual TLS Stage** under **Flows and Stages** > **Stages**.
3. Set the stage **Mode** to either optional or required.
4. Select the certificate authorities that should be trusted.
5. Choose which certificate attribute should be matched against which user attribute.
6. Bind the stage into the authentication or enrollment flow.

### Matching behavior

The stage does not authenticate on certificate presence alone. It extracts the selected certificate attribute and compares it to the selected user attribute, so correctness of that mapping matters as much as trust-chain validation.

---

## Password stage

The Password stage prompts the current `pending_user` for a password and validates it against one or more configured backends.

## About the password stage

Use this stage in authentication or password-change flows when a user should prove possession of a password.

The stage supports authentik's built-in password database, app passwords, LDAP-backed passwords, and Kerberos-backed passwords.

## Configuration options

- **Backends**: select one or more password backends to test in order.
  - **User database + standard password**
  - **User database + app passwords**
  - **User database + LDAP password**
  - **User database + Kerberos password**
- **Failed attempts before cancel**: how many failed password submissions are allowed before the flow is canceled.
- **Allow show password**: show a button that reveals the entered password.
- **Configuration flow**: optional authenticated flow that lets users configure or change their password from user settings.

## Flow integration

This stage is typically bound after an [Identification](../identification/index.mdx) stage and before an [Authenticator Validation](../authenticator_validate/index.mdx) or [User Login](../user_login/index.mdx) stage.

If the [Identification stage](../identification/index.mdx) has its **Password stage** option set, the password prompt is rendered as part of the identification step and the Password stage should not also be bound separately in the same flow.

## Notes

Service accounts have automatically generated app passwords. Those can be viewed from the service account's user settings or from the admin interface.

### Passwordless patterns

There are two common ways to avoid prompting for a password:

- Use an [Authenticator Validation](../authenticator_validate/index.mdx#passwordless-authentication) stage with WebAuthn for a dedicated passwordless flow.
- Conditionally skip the Password stage by binding a policy to its stage binding.

If you want users to be able to pick a passkey from the browser's passkey/autofill UI without entering a username first, configure **Passkey autofill (WebAuthn conditional UI)** in the [Identification stage](../identification/index.mdx#passkey-autofill-webauthn-conditional-ui). This is separate from configuring a dedicated passwordless flow, and can be used alongside normal identification flows.

### Dynamically skip a Password stage

This setup keeps a normal identification flow, but skips the Password stage for users who already have a supported authenticator configured.

To configure this setup:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies** and create an [Expression Policy](../../../../customize/policies/types/expression/index.mdx).
3. Configure the expression so that it returns `True` only when the Password stage should run. Use one of the expressions below, depending on the authenticator type.
4. Navigate to **Flows and Stages** > **Flows** and open your authentication flow.
5. Open the **Stage Bindings** tab, expand the Password stage binding, and bind the Expression Policy there. Do not bind it to the flow itself or directly to the stage object. For more background, see [Bind a policy to a stage binding](../../../../customize/policies/working_with_policies.mdx#bind-a-policy-to-a-stage-binding).
6. On the Password stage binding, enable **Evaluate when stage is run**. Disable **Evaluate when flow is planned** unless the user is already known before the flow starts. See [Planning and stage policies](../../flow/planner.mdx#planning-and-stage-policies).

#### WebAuthn

```python
from authentik.stages.authenticator_webauthn.models import WebAuthnDevice

pending_user = request.context.get("pending_user")
if not pending_user:
    return True

return not WebAuthnDevice.objects.filter(user=pending_user, confirmed=True).exists()
```

Or for Duo:

```python
from authentik.stages.authenticator_duo.models import DuoDevice

pending_user = request.context.get("pending_user")
if not pending_user:
    return True

return not DuoDevice.objects.filter(user=pending_user, confirmed=True).exists()
```

Because the expression already returns whether the Password stage should run, you do not need to enable **Negate Result** on the policy binding.

If the Password stage binding has more than one policy attached, review its **Policy engine mode** carefully:

- With only this policy attached, either mode works.
- If multiple policies are attached, `all` requires every policy to pass before the Password stage runs.
- If multiple policies are attached, `any` runs the Password stage when any bound policy passes.

#### Default authentication flow

The built-in `default-authentication-flow` already includes a policy binding on its Password stage, `default-authentication-flow-password-stage`, which controls whether the Password stage should appear.

If you add a second policy to that same Password stage binding, set the stage binding's **Policy engine mode** to `all` so both the built-in policy and your Expression Policy must pass before the Password stage runs.

Keep **Evaluate when stage is run** enabled on that binding. In the default blueprint, this is already configured.

---

## Prompt stage

The Prompt stage prompts the user to enter information. The submitted values are then stored in the flow context.

## About the prompt stage

Use this stage to collect user input, such as profile attributes, passwords, invitation tokens, file uploads, or approval choices.

Submitted values are written to `prompt_data` in the flow context and can be consumed by later stages or policies.

## Configuration options

### Stage options

- **Fields**: the ordered set of prompt definitions included in the stage.
- **Validation Policies**: optional policies evaluated after submission to validate the entered data.

### Prompt field types

Each prompt field can use one of these types:

| Type                  | Description                                                          |
| --------------------- | -------------------------------------------------------------------- |
| Text                  | Arbitrary text input.                                                |
| Text (read-only)      | Text displayed but not editable.                                     |
| Text area             | Multiline text input.                                                |
| Text area (read-only) | Multiline text displayed but not editable.                           |
| Username              | Text input with username uniqueness checks.                          |
| Email                 | Text input validated as an email address.                            |
| Password              | Masked input. Multiple password fields in the same stage must match. |
| Number                | Numeric input.                                                       |
| Checkbox              | Boolean checkbox input.                                              |
| Radio Button Group    | Single-choice selection rendered as radio buttons.                   |
| Dropdown              | Single-choice selection rendered as a dropdown.                      |
| Date                  | Date picker.                                                         |
| Date-time             | Date and time picker.                                                |
| File                  | File upload stored in flow context as a data URI.                    |
| Separator             | Static separator element.                                            |
| Hidden                | Hidden value inserted into the form submission.                      |
| Static                | Static value displayed as-is.                                        |
| authentik: Locale     | Locale selector populated from authentik-supported locales.          |

### Prompt field attributes

Each prompt field definition includes these core attributes:

- **field\_key**: key used to store the field value in `prompt_data`.
- **label**: label shown to the user.
- **required**: whether the field must be provided.
- **placeholder**: placeholder text, or for choice fields, the available choices.
- **initial value**: pre-filled value, or for choice fields, the default selected choice.
- **order**: numeric ordering among the prompt fields.
- **Interpret placeholder as expression**: evaluate the placeholder dynamically.
- **Interpret initial value as expression**: evaluate the initial value dynamically.

For **Radio Button Group** and **Dropdown**, the placeholder defines the valid choices. It can be a plain string, a list of values, or a list of objects with `label` and `value`.

Some field types also have special behavior:

- **Username** checks for uniqueness.
- **Password** fields within the same stage must all match.
- **Hidden** and **Static** use their configured values without user editing.
- **Radio Button Group** and **Dropdown** only allow values from the defined choice set.

## Use prompt data to update a user

The Prompt stage does not update the user. It stores each submitted value in `prompt_data` under the prompt's **Field Key**.

To write a value to the user, bind a [User Write](../user_write/index.mdx) stage after the Prompt stage. The User Write stage stores the value on the user when the **Field Key** is a user property or starts with `attributes.`:

| Field key                    | Result after the User Write stage                                      |
| ---------------------------- | ---------------------------------------------------------------------- |
| `username`                   | Sets the user's username.                                              |
| `name`                       | Sets the user's display name.                                          |
| `email`                      | Sets the user's email address.                                         |
| `attributes.given_name`      | Adds or updates `given_name` in the user's **Attributes** dictionary.  |
| `attributes.family_name`     | Adds or updates `family_name` in the user's **Attributes** dictionary. |
| `attributes.department`      | Adds or updates `department` in the user's **Attributes** dictionary.  |
| `attributes.settings.locale` | Adds or updates the nested value `settings.locale` in **Attributes**.  |

A prompt with a **Field Key** such as `department` only adds the value to `prompt_data`, where policies and later stages can use it. The User Write stage does not store the value on the user because `department` is not a user property.

To store the value as a custom attribute, set the prompt's **Field Key** to `attributes.department`.

For a complete enrollment example, see [Collect custom user attributes during enrollment](../../flow/collect-user-attributes.mdx).

## Flow integration

Use this stage anywhere a flow needs user-provided input.

Common follow-ups include:

- A [User Write](../user_write/index.mdx) stage to store collected values
- An [Email](../email/index.mdx) or [Invitation](../invitation/index.mdx) stage to act on collected data
- Policy checks that read from `request.context["prompt_data"]`

## Notes

### Access submitted data

Prompt values are stored in `prompt_data`:

```python
request.context.get("prompt_data", {}).get("<field_key>")
```

### Dynamic choices and defaults

For choice fields, placeholder and initial value can be generated dynamically with expressions. The prompt context is available during evaluation.

Choice fields also support context overrides:

- `<field_key>__choices` overrides the available choices
- `<field_key>` overrides the initial value

For `Radio Button Group` and `Dropdown`, choices can be plain values or objects like:

```python
return [
    "first option",
    42,
    {"label": "another option", "value": "some value"},
]
```

For fixed-choice fields, the default value must be one of the valid choices.

When prompt expressions are evaluated, they run in the same general expression environment used by authentik mappings and policies and also have access to `prompt_context`.

### Validation

Additional validation can be done with validation policies bound directly to the Prompt stage. For example, to ensure two password fields match:

```python
if request.context["prompt_data"]["password"] == request.context["prompt_data"]["password_repeat"]:
    return True

ak_message("Passwords don't match.")
return False
```

---

## Redirect stage

The Redirect stage sends the user to another flow or a static URL.

## About the redirect stage

This stage is most commonly used to branch from one flow into another while optionally preserving the current flow context.

## Configuration options

- **Keep flow context**: preserve the current flow context when redirecting to another flow.
- **Mode**: choose whether the target is a static URL or another flow.
- **Static target**: URL used in static mode.
- **Target Flow**: flow used in flow mode.

## Flow integration

Use this stage when the flow should hand off to another flow or redirect to a fixed destination.

In **flow** mode, the redirected flow can continue using the existing flow context if **Keep flow context** is enabled.

## Notes

- You can override the target dynamically from an expression policy by setting `redirect_stage_target` in the [flow context](../../flow/context/index.mdx#redirect_stage_target-string).
- When **Keep flow context** is disabled, authentik clears the current flow context before handing off, except for the redirect marker used internally to track the redirect.

---

## Source stage

The Source stage sends the user to an [OAuth](../../../../users-sources/sources/protocols/oauth/index.mdx) or [SAML](../../../../users-sources/sources/protocols/saml/index.mdx) source before returning to the flow.

## About the source stage

Use this stage when an external identity provider should be part of the current authentik flow, for example during staged migrations or additional external verification.

Common examples include:

- Authenticating against a legacy IdP such as [Microsoft Entra ID](../../../../users-sources/sources/social-logins/entra-id/oauth/index.mdx), [Google Workspace](../../../../users-sources/sources/social-logins/google/workspace/index.mdx), or [Okta](../../../../users-sources/sources/social-logins/okta/index.mdx) during an IdP migration and then using the returned identity and attributes inside authentik
- Routing users through an external OAuth or SAML identity provider
- Sending users through a custom device-health or posture-check system before continuing

For pure authentication or enrollment, an [OAuth](../../../../users-sources/sources/protocols/oauth/index.mdx) or [SAML](../../../../users-sources/sources/protocols/saml/index.mdx) source can also be used directly without a Source stage. Use the Source stage when that external step needs to be embedded inside another authentik flow.

## Configuration options

- **Source**: the OAuth or SAML source to use.
- **Resume timeout**: how long authentik keeps the suspended flow available while the user is away at the external source.

## Flow integration

Bind this stage to a flow when the user should authenticate or enroll through an external source and then return to the authentik flow.

The configured source must be a browser-based source such as OAuth or SAML. LDAP and other non-browser sources are not compatible.

## Notes

### Important source-flow behavior

Do not bind a [User Login stage](../user_login/index.mdx) to the source's own authentication or enrollment flow.

The Source stage resumes the original flow by appending a dynamic in-memory stage to the source flow. If the source flow logs the user in directly, the original flow will not resume correctly.

### Workflow

```mermaid
sequenceDiagram
    participant u as User
    participant ak as authentik
    participant eidp as External IDP

    u->>ak: User initiates flow
    ak->>u: User reaches Source stage

    u->>eidp: User is redirected to external IDP
    eidp->>ak: User authenticates with external IDP

    alt User already linked to external IDP
        ak->>u: Source authentication flow starts
        u->>ak: User finishes source authentication flow
    else User must be linked first
        ak->>u: Source enrollment flow starts
        u->>ak: User finishes source enrollment flow
    end

    ak->>u: Original authentik flow resumes
```

### Resume timeout

If the user takes longer than the configured timeout to return from the external source, the original suspended flow is discarded and the flow restarts from the beginning on return.

---

## User delete stage

The User Delete stage deletes the current `pending_user`.

## About the user delete stage

This stage is intended for unenrollment or account-removal flows where a user account should be removed from authentik after the user has already been verified.

## Configuration options

This stage has no stage-specific configuration options.

## Flow integration

Use this stage near the end of an unenrollment flow after any confirmation, re-authentication, or policy checks have occurred.

## Notes

This stage deletes the `pending_user` without showing a confirmation prompt. Make sure the flow includes the checks and confirmation steps you want before the stage runs.

The deleted user is also removed from the current session.

---

## User login stage

The User Login stage attaches the current `pending_user` to a new authentik session.

## About the user login stage

This stage is usually the final stage in authentication, enrollment and recovery flows, signing the user in immediately upon success.

## Configuration options

- **Session duration**: how long the created session should last. A value of `seconds=0` keeps the session until the browser session ends.
- **Network binding**: optionally bind the session to ASN, network, or IP-derived network information.
- **GeoIP binding**: optionally bind the session to continent, country, or city information.
- **Terminate other sessions**: revoke the user's other active authentik sessions when this stage succeeds.
- **Remember me offset**: extend the session when the user explicitly chooses the remember-me option. A value of `seconds=0` hides the option.
- **Remember device**: store a longer-lived cookie that helps authentik recognize a known device on later sign-ins.

## Flow integration

Use this stage near the end of flows that should create an authenticated browser session.

Common placements include:

- after a [Password](../password/index.mdx) or [Authenticator Validation](../authenticator_validate/index.mdx) stage in authentication flows
- after a [User Write](../user_write/index.mdx) stage in enrollment flows

## Notes

Browsers handle session cookies differently. A session configured with `seconds=0` is intended to end when the browser session ends, but some browsers can retain session state longer.

Duration fields use the standard authentik timedelta syntax such as `hours=1,minutes=30,seconds=0`.

All values accept floating-point numbers.

Valid keys in those duration strings include:

- microseconds

- milliseconds

- seconds

- minutes

- hours

- days

- weeks

- If **Remember me offset** is greater than `seconds=0`, authentik shows the user a **Remember me on this device** option during login.

![](./stay_signed_in.png)

- If **Remember device** is enabled, authentik stores a cookie that can be used in later flows or policies to distinguish known from unknown devices.
- If the user already has another authenticated session from the same IP address, authentik also classifies that sign-in as coming from a known device.
- If **Network binding** or **GeoIP binding** is enabled, authentik terminates sessions that later violate the selected binding.

When a session is terminated because a binding is broken, the generated logout event includes additional binding data describing what changed.

```json
{
    "asn": {
        "asn": 6805,
        "as_org": "Telefonica Germany",
        "network": "5.4.0.0/14"
    },
    "geo": {
        "lat": 51.2993,
        "city": "",
        "long": 9.491,
        "country": "DE",
        "continent": "EU"
    },
    "binding": {
        "reason": "network.missing",
        "new_value": {
            "asn": 6805,
            "as_org": "Telefonica Germany",
            "network": "5.4.0.0/14"
        },
        "previous_value": {}
    },
    "ip": {
        "previous": "1.2.3.4",
        "new": "5.6.7.8"
    },
    "http_request": {
        "args": {},
        "path": "/if/admin/",
        "method": "GET",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
    },
    "logout_reason": "Session binding broken"
}
```

For alerting and policy use, authentik can also classify a login as coming from a known or unknown device based on the "Remember me on this device" cookie and related session information.

See the notification policy examples for [logins from unknown devices](../../../../sys-mgmt/events/notification_rule_expression_policies.mdx#trigger-alert-when-user-logs-in-from-unknown-device).

When **Terminate other sessions** is enabled, previous authentik sessions for the same user are revoked. This does not affect OAuth refresh tokens.

---

## User logout stage

The User Logout stage ends the user's authentik session and, if configured, initiates [Single Logout](../../../providers/single-logout/index.mdx).

## About the user logout stage

This stage removes the current authentik session. When Single Logout is enabled for SAML or OIDC providers, authentik can also inject additional logout handling for those provider sessions.

## Configuration options

This stage has no stage-specific configuration options.

## Flow integration

The default flows use this stage differently:

- `default-invalidation-flow`: used when the user logs out directly from authentik. This flow includes the User Logout stage.
- `default-provider-invalidation-flow`: the default flow used when a logout starts from an application. This flow does not include the User Logout stage.

If RP-initiated logout should also end the main authentik session, select `default-invalidation-flow` as the invalidation flow of the provider. For more information, see [Choose the logout behavior for a provider](../../../providers/single-logout/index.mdx#choose-the-logout-behavior-for-a-provider).

## Notes

When this stage runs, authentik can inject additional logout stages for active provider sessions:

- front-channel iframe logout stages
- front-channel native logout stages
- back-channel logout execution

This enables automatic provider-specific logout without manually adding those stages to the flow.

---

## User write stage

The User Write stage writes data from the current flow context into a user object.

## About the user write stage

This stage updates the current `pending_user`, or creates a new user if the flow does not already have one and the configured creation mode allows it.

It is commonly used in enrollment, recovery, and profile-update flows after a [Prompt stage](../prompt/index.mdx) has collected input into `prompt_data`.

## Configuration options

- **User creation mode**: control whether the stage never creates users, creates them only when required, or always creates them.
- **Create users as inactive**: mark newly created users as inactive.
- **Create users group**: optionally add newly created users to a specific group.
- **User type**: select the user type for newly created users: Internal, External, or Service Account.
- **User path template**: optionally set the path new users will be created under. If left blank, the default path will be used.

## Data written to users

The stage reads values from `prompt_data` in the [flow context](../../flow/context/index.mdx#prompt_data-dictionary). The key tells the stage where to store each value:

| Prompt data key            | Result on the user                              |
| -------------------------- | ----------------------------------------------- |
| `username`                 | Sets the built-in username.                     |
| `name`                     | Sets the built-in display name.                 |
| `email`                    | Sets the built-in email address.                |
| `password`                 | Sets the user's password.                       |
| `attributes`               | Merges a dictionary into the user's attributes. |
| `attributes.<key>`         | Sets a custom user attribute.                   |
| `attributes.<group>.<key>` | Sets a nested custom user attribute.            |

For example, prompt fields with the keys `attributes.given_name` and `attributes.family_name` produce these user attributes:

```yaml
family_name: Roy
given_name: Dominic
```

Use `attributes.<key>` for custom attributes. The stage does not write other keys, such as `department`, to the user; their values remain in `prompt_data` until the flow ends, available to later stages and policies.

For a complete configuration procedure, see [Collect custom user attributes during enrollment](../../flow/collect-user-attributes.mdx).

## Flow integration

Use this stage after one or more stages that populate flow context, usually an [Identification stage](../identification/index.mdx), [Prompt stage](../prompt/index.mdx), or [Email stage](../email/index.mdx).

In enrollment flows, this stage is often followed by a [User Login](../user_login/index.mdx) stage so the newly created user is immediately signed in.

## Notes

### Invitation data

An [Invitation](../invitation/index.mdx) stage adds the invitation's built-in properties and custom attributes to `prompt_data`. The User Write stage stores an `attributes` dictionary or dotted keys such as `attributes.department` in the same way as submitted prompt values. For more information, see [Invitations](../../../../users-sources/user/invitations.mdx).

### Dynamic groups

To add users to dynamic groups, set `groups` in the flow plan context before this stage runs. The value must be a list of actual `Group` objects:

```python
from authentik.core.models import Group

group, _ = Group.objects.get_or_create(name="some-group")
request.context["flow_plan"].context["groups"] = [group]
return True
```

---

## Expression Policies

Expression policies let you write custom Python for cases where the built-in policy types are not enough.

They are commonly used to:

- branch or redirect inside authentication flows
- validate prompt data
- enforce organization-specific access rules
- make decisions based on request metadata, GeoIP, ASN, or flow context

For general policy concepts such as bindings, ordering, `Any` vs `All`, and where policies are attached, see [Policy bindings and evaluation](../../bindings.mdx).

Expression policies execute server-side Python inside authentik. Treat the ability to create or edit them as a highly privileged permission.

## Start here

- [Expression reference](./reference.mdx) covers return values, helper functions, variables, and flow context.
- [Managing flow context keys](./managing_flow_context_keys.mdx) shows how to change flow behavior.
- [Switch which source is used based on email address](./source_switch.mdx) shows a common routing pattern.
- [Ensure unique email addresses](./unique_email.mdx) and [Allow only specific email domains](./whitelist_email.mdx) cover prompt-data validation.

## A simple example

The following expression causes an MFA validation stage to run only for one specific user:

```python
if request.context["pending_user"].username == "marie":
    return True
return False
```

When the policy is bound to the stage binding, the stage runs only when the expression passes.

To understand what values are available in the expression environment, see [Expression reference](./reference.mdx).

## Common pitfalls

### Use `context['pending_user']` inside flows

When a policy runs during a flow, `request.user` is not always the user who is currently being authenticated. Until a login or user-writing stage updates the active user, `request.user` may still be `AnonymousUser` or the previously authenticated user.

Inside authentication and enrollment flows, prefer:

```python
pending_user = request.context.get("pending_user")
```

instead of relying on `request.user`.

### Prompt data lives in `context['prompt_data']`

If you are validating values entered in a [Prompt stage](../../../../add-secure-apps/flows-stages/stages/prompt/index.mdx), read them from `context["prompt_data"]`:

```python
email = context["prompt_data"]["email"]
```

### Flow state can be changed through `flow_plan`

When an expression runs inside a flow, you can inspect and update flow state through `context["flow_plan"]` and `context["flow_plan"].context`. This is powerful, but it also means your expression can change how the rest of the flow behaves.

For examples, see [Managing flow context keys](./managing_flow_context_keys.mdx) and [Switch which source is used based on email address](./source_switch.mdx).

## Sample expression policies

The following examples document common uses:

- [Switch which source is used based on email address](./source_switch.mdx)
- [Managing flow context keys](./managing_flow_context_keys.mdx)
- [Ensure unique email addresses](./unique_email.mdx)
- [Allow only specific email domains](./whitelist_email.mdx)

### `auth_method` and `auth_method_args`

Depending on the flow, `context["auth_method_args"]` may also be populated.

Some fields from the flow-plan context are mirrored into the root policy context and updated from it, such as `prompt_data`, but not every flow-plan key is copied that way.

Common `auth_method` values include:

- `password`: standard password login
- `auth_mfa`: MFA login without a password step
- `auth_webauthn_pwl`: passwordless WebAuthn or passkey login
- `token`: token-based authentication, such as an app password
- `jwt`: machine-to-machine login through an external JWT
- `ldap`: LDAP bind authentication

For some authentication methods, `context["auth_method_args"]` contains additional structured data.

For `auth_mfa`, `context["auth_method_args"]` is shaped like:

```json
{
    "mfa_devices": [
        {
            "pk": 1,
            "app": "otp_static",
            "name": "Static Token",
            "model_name": "staticdevice"
        }
    ]
}
```

For `token`, `context["auth_method_args"]` depends on the code path. It may contain a token object:

```json
{
    "token": {
        "pk": "f6d639aac81940f38dcfdc6e0fe2a786",
        "app": "authentik_core",
        "name": "test (expires=2021-08-23 15:45:54.725880+00:00)",
        "model_name": "token"
    }
}
```

or a token identifier:

```json
{
    "identifier": "service-account-token"
}
```

For `ldap`, `context["auth_method_args"]` contains information about the source used:

```json
{
    "source": {}
}
```

For simple country or ASN checks, a [GeoIP policy](../geoip.mdx) is usually easier to manage than a custom expression. For flow manipulation, see the example pages above.

---

## Managing flow context keys

[Flow context](../../../../add-secure-apps/flows-stages/flow/context/index.mdx) can be read and updated from an [Expression policy](./index.mdx) through `context["flow_plan"].context`. For more information about the active plan, see [Flow Planner](../../../../add-secure-apps/flows-stages/flow/planner.mdx).

This is useful when you want to influence later stages in the same flow, such as changing a redirect target or passing data to another stage.

For `redirect_stage_target`, use the format `ak-flow://{slug}` when you want the [Redirect stage](../../../../add-secure-apps/flows-stages/stages/redirect/index.mdx) to redirect to another flow. See [`redirect_stage_target`](../../../../add-secure-apps/flows-stages/flow/context/index.mdx#redirect_stage_target-string) for the full behavior.

## Set a flow-context key

```python
context["flow_plan"].context["redirect_stage_target"] = "ak-flow://redirected-authentication-flow"
return True
```

## Remove a flow-context key

```python
context["flow_plan"].context.pop("redirect_stage_target", None)
return True
```

Be careful when modifying flow context in widely reused policies, because the change affects the active flow plan, not only the policy itself.

---

## Expression Reference

This page documents the expression policy execution environment in authentik.

## Return values

An expression policy passes when it returns `True` and fails when it returns `False`.

```python
return True
```

```python
return False
```

## Available helper functions

### `ak_message(message: str)`

Add a user-visible message to the current policy result.

```python
ak_message("Access denied")
return False
```

### `regex_match(value: Any, regex: str) -> bool`

Check if `value` matches Regular Expression `regex`.

Example:

```python
return regex_match(request.user.username, '.*admin.*')
```

### `regex_replace(value: Any, regex: str, repl: str) -> str`

Replace anything matching `regex` within `value` with `repl` and return it.

Example:

```python
user_email_local = regex_replace(request.user.email, '(.+)@.+', '')
```

### `list_flatten(value: list[Any] | Any) -> Optional[Any]`

Flatten a list by either returning its first element, None if the list is empty, or the passed in object if it's not a list.

Example:

```python
user = list_flatten(["foo"])
# user = "foo"
```

### `ak_call_policy(name: str, **kwargs) -> PolicyResult`

Call another policy with the name *name*. The current request is passed to the policy. Keyword arguments
can be used to modify the request's context.

Example:

```python
result = ak_call_policy("test-policy")
# result is a PolicyResult object, so you can access `.passing` and `.messages`.
# Starting with authentik 2023.4, you can also access `.raw_result`, which is the raw value returned from the called policy
# `result.passing` will always be a boolean if the policy is passing or not.
return result.passing

result = ak_call_policy("test-policy-2", foo="bar")
# Inside the `test-policy-2` you can then use `request.context["foo"]`
return result.passing
```

If the called policy raises an exception, `ak_call_policy` does not propagate it. A failing `PolicyResult`
is returned (`.passing` will be `False`), with the error message available in `.messages`.

If no policy matches *name*, a `ValueError` is raised and the **calling** policy fails.

### `ak_is_group_member(user: User, **group_filters) -> bool`

Check if `user` is member of a group matching `**group_filters`.

Example:

```python
return ak_is_group_member(request.user, name="test_group")
```

### `ak_user_by(**filters) -> Optional[User]`

Fetch a user matching `**filters`.

Returns `None` if no user was found; otherwise, returns the [User](../../users-sources/user/index.mdx) object.

Example:

```python
# Find user by username
other_user = ak_user_by(username="other_user")

# Find user by custom attribute
other_user = ak_user_by(attributes__<custom_attribute_name>="<value>")
```

### `ak_user_has_authenticator(user: User, device_type: Optional[str] = None) -> bool`

Check if a user has any authenticator devices. Only fully validated devices are counted.

Optionally, you can filter by a specific device type. The following options are valid:

- `totp`
- `duo`
- `static`
- `webauthn`

Example:

```python
return ak_user_has_authenticator(request.user)
```

### `ak_create_event(action: str, **kwargs) -> None`

Create a new event with the action set to `action`. Any additional keyword parameters will be saved in the event context. Additionally, `context` will be set to the context in which this function is called.

Before saving, any data structures which are not representable in JSON are flattened, and credentials are removed.

The event is saved automatically.

Example:

```python
ak_create_event("my_custom_event", foo=request.user)
```

### `ak_create_jwt(user: User, provider: OAuth2Provider | str, scopes: list[str], validity = "seconds=60") -> str | None`2025.2

This function will only work when there is an HTTP request in the current context.

Create a new JWT signed by the given `provider` for `user`.

The `provider` parameter can either be an instance of `OAuth2Provider` or the name of a provider instance as a string. Scopes are an array of all scopes that the JWT should have.

The JWT is valid for 60 seconds by default, and this can be customized using the `validity` parameter. The syntax of the parameter is `hours=1,minutes=2,seconds=3`. The following keys are allowed:

- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks

All values accept floating-point values.

Example:

```python
jwt = ak_create_jwt(request.user, "my-oauth2-provider-name", ["openid", "profile", "email"])
```

### `ak_create_jwt_raw(provider: OAuth2Provider | str, validity = "seconds=60", **kwargs) -> str | None`2025.12

Similar to [`ak_create_jwt`](#ak_create_jwtuser-user-provider-oauth2provider--str-scopes-liststr-validity--seconds60---str--none), however this function does *not* require an HTTP request and allows for setting custom claims via `**kwargs`.

The `provider` parameter can either be an instance of `OAuth2Provider` or the name of a provider instance as a string. Scopes are an array of all scopes that the JWT should have.

The JWT is valid for 60 seconds by default, and this can be customized using the `validity` parameter. The syntax of the parameter is `hours=1,minutes=2,seconds=3`. The following keys are allowed:

- Microseconds
- Milliseconds
- Seconds
- Minutes
- Hours
- Days
- Weeks

All values accept floating-point values.

Example:

```python
jwt = ak_create_jwt_raw("my-oauth2-provider-name", my_claim="my_value")
```

### `ak_send_email(address: str | list[str], subject: str, body: str = None, stage: EmailStage = None, template: str = None, context: dict = None, cc: str | list[str] = None, bcc: str | list[str] = None) -> bool`2025.10

Send an email using authentik's email system.

The `address` parameter specifies the recipient email address(es). It can be:

- A single email address as a string: `"user@example.com"`
- A list of email addresses: `["user1@example.com", "user2@example.com"]`

When using multiple recipients in the `address` or `cc` fields, all email addresses will be visible to all recipients. Use `bcc` to send to multiple recipients without revealing addresses to each other.

The `subject` parameter sets the email subject line.

You must provide either `body` (for plain text/HTML content) or `template` (for template rendering), but not both.

The `stage` parameter can be an `EmailStage` instance for custom email settings. If `None`, global email settings are used.

The `template` parameter specifies a template name to render. When using templates, you can pass additional context variables via the `context` parameter.

The `cc` parameter specifies email address(es) to carbon copy. Same format as `address`.

The `bcc` parameter specifies email address(es) to blind carbon copy. Same format as `address`. Recipients in `bcc` will not be visible to other recipients.

If the email is queued successfully, the function returns `True`; otherwise, it returns `False`.

Examples:

```python
# Send email with plain body to single recipient
ak_send_email("user@example.com", "Welcome!", body="Welcome to our platform!")

# Send email to multiple recipients
ak_send_email(
    ["user1@example.com", "user2@example.com", "admin@example.com"],
    "System Maintenance",
    body="Scheduled maintenance will occur tonight."
)

# Send email using a template
ak_send_email("user@example.com", "Password Reset", template="email/password_reset.html")

# Send email with custom context for template to multiple recipients
ak_send_email(
    ["user@example.com", "admin@example.com"],
    "Account Update",
    template="email/event_notification.html",
    context={
        "title": "Profile Updated",
        "body": "Your account profile has been successfully updated.",
        "key_value": {"Updated Field": "Email Address", "Date": "2025-01-01"}
    }
)

# Send email with custom email stage
ak_send_email("admin@example.com", "Report", body="Daily report", stage=my_custom_stage)

# Send email with CC
ak_send_email(
    "user@example.com",
    "Important Update",
    body="Please review this update.",
    cc="manager@example.com"
)

# Send email with multiple CC and BCC recipients
ak_send_email(
    "user@example.com",
    "Confidential Report",
    body="Attached is the quarterly report.",
    cc=["manager@example.com", "lead@example.com"],
    bcc=["audit@example.com", "compliance@example.com"]
)
```

## Comparing IP Addresses

To compare IP addresses or check if an IP address is within a given subnet, you can use the functions `ip_address('192.0.2.1')` and `ip_network('192.0.2.0/24')`. With these objects you can do [arithmetic operations](https://docs.python.org/3/library/ipaddress.html#operators).

You can also check if an IP Address is within a subnet by writing the following:

```python
ip_address('192.0.2.1') in ip_network('192.0.2.0/24')
# evaluates to True
```

## DNS resolution and reverse DNS lookups

To resolve a hostname to a list of IP addresses, use the functions `resolve_dns(hostname)` and `resolve_dns(hostname, ip_version)`.

```python
resolve_dns("google.com")  # returns a list of all IPv4 and IPv6 addresses
resolve_dns("google.com", 4)  # returns a list of only IPv4 addresses
resolve_dns("google.com", 6)  # returns a list of only IPv6 addresses
```

You can also perform reverse DNS lookups.

Reverse DNS lookups may not return the expected host if the IP address is part of a shared hosting environment.
See: [https://stackoverflow.com/a/19867936](https://stackoverflow.com/a/19867936)

To perform a reverse DNS lookup use `reverse_dns("192.0.2.0")`. If no DNS records are found the original IP address is returned.

DNS resolving results are cached in memory. The last 32 unique queries are cached for up to 3 minutes.

## Available variables and objects

- `ak_logger`: structlog BoundLogger. See [structlog documentation](https://www.structlog.org/en/stable/api.html#structlog.BoundLogger)

  Example:

  ```python
  ak_logger.debug("This is a test message")
  ak_logger.warning("This will be logged with a warning level")
  ak_logger.info("Passing structured data", request=request)
  ```

- `requests`: requests Session object. See [requests documentation](https://requests.readthedocs.io/en/master/user/advanced/)

## Expression-specific context

The imported object reference above covers the generic expression environment. The values below are the ones that are most specific to expression policies in authentik.

### `request`

`request` is a policy request object with the following properties:

- `request.user`: the current user against which the policy is being evaluated. See [User](../../../../users-sources/user/index.mdx).
- `request.http_request`: the Django HTTP request, when one exists. See the [Django request documentation](https://docs.djangoproject.com/en/4.1/ref/request-response/#httprequest-objects).
- `request.obj`: the object the policy is being evaluated against
- `request.context`: a dictionary with dynamic data for the current execution

When an expression policy runs inside a flow, `request.user` is not always the user who is currently being authenticated. Until a `user_login` stage updates the active user, this may still be `AnonymousUser` or another previously authenticated user.

In authentication and enrollment flows, use `context["pending_user"]` when you want the user currently being identified or enrolled.

If the user is not authenticated, `request.user` will be `AnonymousUser`, which is still an instance of [authentik.core.models.User](https://docs.djangoproject.com/en/4.1/ref/contrib/auth/#django.contrib.auth.models.User).

### Common flow-related values

The most commonly used values in flow-related expressions are:

- `context["pending_user"]`: the user currently being identified or enrolled in a flow
- `context["prompt_data"]`: data collected from a prompt stage
- `context["application"]`: the application involved in the current authorization flow
- `context["source"]`: the source involved in the current login or enrollment
- `context["flow_plan"]`: the active flow plan and its mutable context
- `context["geoip"]` and `context["asn"]`: GeoIP and ASN lookups for the client IP
- `ak_client_ip`: the parsed client IP address object
- `ak_is_sso_flow`: whether the current flow was initiated by an external identity provider source

### `geoip`

`context["geoip"]` contains GeoIP information for the client IP.

Available fields include:

- `continent`: a two-character continent code such as `NA` or `EU`
- `country`: the two-character [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1) alpha code
- `lat`: approximate latitude
- `long`: approximate longitude
- `city`: city name, when available

```python
return context["geoip"]["continent"] == "EU"
```

For simple country matching, prefer a [GeoIP policy](../geoip.mdx).

### `asn`

`context["asn"]` contains autonomous system information for the client IP.

Available fields include:

- `asn`: the autonomous system number
- `as_org`: the organization name for that ASN
- `network`: the matching network

```python
return context["asn"]["asn"] == 6939
```

For simple ASN matching, prefer a [GeoIP policy](../geoip.mdx).

### `ak_client_ip`

`ak_client_ip` is the parsed client IP address object. You can compare it with [Python's `ipaddress` helpers](https://docs.python.org/3/library/ipaddress.html#ipaddress.ip_address):

```python
from ipaddress import ip_network

return ak_client_ip in ip_network("10.0.0.0/24")
```

You can also inspect properties on the parsed IP object, for example:

```python
return ak_client_ip.is_private
```

`ak_client_ip.is_private` follows Python's `ipaddress` semantics and returns `True` for addresses that are not globally reachable, not only for RFC1918 private ranges.

### `ak_is_sso_flow`

`ak_is_sso_flow` is `True` when the current flow was initiated by an external identity provider source.

## Flow context keys

When the policy runs inside a flow, authentik exposes the current flow context under `context`.

Common keys include:

- `context["flow_plan"]`: the active flow plan
- `context["flow_plan"].context`: the mutable flow-plan context
- `context["flow_plan"].context["redirect"]`: the post-flow redirect URL, when set
- `context["prompt_data"]`: data collected from prompt stages or external sources
- `context["application"]`: the application being authorized
- `context["source"]`: the source being used for authentication or enrollment
- `context["pending_user"]`: the user currently being identified or enrolled
- `context["is_restored"]`: the flow token when the flow was restored from a link
- `context["auth_method"]`: the authentication method recorded by the flow

---

## Switch which source is used based on email address

You can use an [expression policy](./index.mdx) to route users to different [sources](../../../../../users-sources/sources/) based on the email address they enter.

This is useful when different email domains should authenticate against different upstream identity providers.

## Create the policy

[Create an expression policy](../../working_with_policies.mdx#create-a-policy) that:

1. maps email domains to source slugs
2. reads the identifier collected earlier in the flow
3. redirects the user to the matching source when a mapping exists

## Where to bind it

Bind the expression to the stage binding immediately after the [Identification stage](../../../../add-secure-apps/flows-stages/stages/identification/index.mdx), or after whichever stage first collects the identifier you want to inspect.

For more background on binding policies to stages, see [Working with policies](../../working_with_policies.mdx#bind-a-policy-to-a-stage-binding).

## Example expression

```python
# Map email domains to source slugs.
source_email_map = {
    "foo.bar.com": "entra-foo",
    "bar.baz.com": "entra-bar",
}

user_email = request.context["pending_user_identifier"]

_username, _, domain = user_email.partition("@")
source = source_email_map.get(domain)
if not source:
    return True

plan = request.context.get("flow_plan")
if not plan:
    return False

# For OIDC
# plan.redirect(f"/source/oauth/login/{source}/")
# For SAML
plan.redirect(f"/source/saml/{source}")
return False
```

## How it works

- The policy reads `pending_user_identifier`, which is the identifier gathered earlier in the flow.
- If the email domain is not in the mapping, the policy returns `True` and flow execution continues normally.
- If the domain maps to a source, the policy redirects the flow and returns `False` so the current path does not continue.

Adjust the redirect path for the source type you use. The example above includes both OIDC and SAML patterns.

---

## Ensure unique email addresses

By default, authentik does not require email addresses to be unique. If you want to enforce uniqueness, use an [expression policy](./index.mdx) during enrollment or profile-edit flows.

Bind the policy before the [User write stage](../../../../add-secure-apps/flows-stages/stages/user_write/index.mdx), or attach it directly to the [Prompt stage](../../../../add-secure-apps/flows-stages/stages/prompt/index.mdx) that collects the email address.

## Example expression

In this example, `email` must match the field key from your prompt stage. The `pending_user` exclusion lets the same policy work for updates as well as new users.

```python
# Ensure this matches the *Field Key* value of the prompt
field_name = "email"
email = request.context["prompt_data"][field_name]
pending_user = request.context.get("pending_user")

from authentik.core.models import User
query = User.objects.filter(email__iexact=email)
if pending_user:
    query = query.exclude(pk=pending_user.pk)
elif request.user and request.user.is_authenticated:
    query = query.exclude(pk=request.user.pk)

if query.exists():
    ak_message("Email address in use")
    return False

return True
```

---

## Allow only specific email domains

Use an [expression policy](./index.mdx) when only specific email domains should be allowed to enroll or authenticate.

The examples below work well with source-related enrollment and authentication flows.

## Restrict enrollment by domain

To update an existing source-enrollment policy:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Open the policy used for source enrollment, such as `default-source-enrollment-if-sso`.
4. Replace the expression body with logic like the example below.
5. Save the policy.

Edit the policy used for source enrollment, such as `default-source-enrollment-if-sso`, and use an expression like this:

```python
allowed_domains = ["example.org", "example.net", "example.com"]

current_domain = request.context["prompt_data"]["email"].split("@")[1] if request.context.get("prompt_data", {}).get("email") else None
if current_domain in allowed_domains:
    email = request.context["prompt_data"]["email"]
    request.context["prompt_data"]["username"] = email
    return ak_is_sso_flow
else:
    ak_message("Enrollment denied for this email domain")
    return False
```

This expression:

- checks the submitted email address
- allows only the domains in `allowed_domains`
- copies the email address into `username` for the rest of the flow
- shows a user-visible error when enrollment is denied

## Restrict authentication by domain

To enforce the same rule for authentication:

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Policies**.
3. Open the source-authentication policy, such as `default-source-authentication-if-sso`.
4. Update the expression with logic like the example below.
5. Save the policy.

To enforce the same rule during authentication, edit the source-authentication policy, such as `default-source-authentication-if-sso`, and use:

```python
allowed_domains = ["example.org", "example.net", "example.com"]

current_domain = request.user.email.split("@")[1] if hasattr(request.user, 'email') and request.user.email else None
if current_domain in allowed_domains:
    return ak_is_sso_flow
else:
    ak_message("Authentication denied for this email domain")
    return False
```

If you use different flows or policy names, adapt the example to the policy that already governs enrollment or authentication for that source.

---

## AWS CLI authentication

You can use the authentik Agent to authenticate to the AWS CLI with authentik credentials.

## Prerequisites

- The authentik Agent must be deployed on your device.

## authentik configuration

To support the integration of authentik Agent with AWS CLI, you need to create an application/provider pair in authentik.

### Create an application and provider in authentik for AWS CLI

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
   - **Application**: provide a descriptive name (e.g. `authentik-aws-cli`), an optional group for the type of application, the policy engine mode, and optional UI settings.
   - **Choose a Provider Type**: select **OAuth2/OpenID Connect** as the provider type.
   - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
     - Set the **Client Type** to `Public`.
     - Set the **Client ID** to `authentik-aws-cli`.
     - Select any available signing key.
     - Under **Machine-to-Machine authentication settings** add the `authentik-cli` provider as a **Federated OIDC Provider**.
   - **Configure Bindings** *(optional)*: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.mdx) (policy, group, or user) to manage access to the application.

3. Click **Submit** to save the new application and provider.

## AWS configuration

To support the integration of AWS with the authentik Agent, you need to configure authentik CLI as an IdP and set up permission roles in AWS.

### Configure authentik CLI as an IDP in AWS

1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
2. Open the [IAM Console](https://console.aws.amazon.com/iam/) and in the left sidebar under **Access Management**, click **Identity providers**.
3. Click **Add provider** and configure the following fields:
   - **Provider type**: `OpenID Connect`
   - **Provider URL**: `https://authentik.company/application/o/<application-slug>/`
   - **Audience**: `authentik-aws-cli`
4. Click **Add provider**
5. On the **Identity providers** page, click on the name of the provider that you just added.

### Configure permissions in AWS

1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
2. Open the [IAM Console](https://console.aws.amazon.com/iam/) and in the left sidebar under **Access Management**, click **Roles**.
3. Either create or edit a role that you want authentik users to be able to use.
4. Open the **Trust relationships** tab.
5. Click **Edit trust policy** and add the following, replacing `<account_id>` with your AWS Account ID:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account_id>:oidc-provider/authentik.company/application/o/authentik-aws-cli/"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "authentik.company/application/o/authentik-aws-cli/:aud": "authentik-aws-cli"
                }
            }
        }
    ]
}
```

6. Click **Update policy**.
7. Take note of the role ARN as it will be required in the next section.

### Configure AWS CLI to authenticate with authentik CLI

On the device running AWS CLI, update the `~/.aws/credentials` file with the following, replacing `<role_arn>` with the ARN of the role above:

```
[default]
credential_process = ak auth aws --client-id authentik-aws-cli --role-arn <role_arn>
```

To verify, run `aws sts get-caller-identity`, which should output something like this

```json
{
    "UserId": "xxxxxx",
    "Account": "<account_id>",
    "Arn": "arn:aws:sts::<account_id>:assumed-role/<role name>/<authentik username>"
}
```

---

## CLI application authentication

The authentik Agent can authenticate to CLI applications such as [`aws`](./aws.mdx) and [`kubectl`](./k8s.mdx).

## How CLI authentication works

First, `authentik-agent` and `authentik-cli` request an authentik token from the [authentik-cli OAuth Provider](../../configuration.mdx#create-an-application-and-provider-in-authentik-for-cli) and exchange it for a token from the specified Kubernetes or AWS provider.

This token is cached until expiration. This improves performance by eliminating repeated token requests.

## More information

For more information, refer to each of the topics below:

---

## Kubernetes CLI authentication

You can use the authentik Agent to authenticate to `kubectl` with authentik credentials.

## Prerequisites

- The device that you're using must have the [authentik Agent deployed on it](../../agent-deployment/index.mdx).

## authentik configuration

To support the integration of authentik Agent with `kubectl`, you need to create an application/provider pair in authentik.

### Create an application and provider in authentik for Kubernetes

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Applications** > **Applications** and click **New Application** to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)
   - **Application**: provide a descriptive name (e.g. `kubernetes-cluster`), an optional group for the type of application, the policy engine mode, and optional UI settings.
   - **Choose a Provider Type**: select **OAuth2/OpenID Connect** as the provider type.
   - **Configure the Provider**: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
     - Set the **Client Type** to `Public`.
     - Set the **Client ID** to `kubernetes-cluster`.
     - Select any available signing key.
     - Under **Machine-to-Machine authentication settings** add the `authentik-cli` provider as a **Federated OIDC Provider**.
   - **Configure Bindings** *(optional)*: you can create a [binding](../../../../add-secure-apps/bindings-overview/index.mdx) (policy, group, or user) to manage access to the application.

3. Click **Submit** to save the new application and provider.

## Kubernetes configuration

These instructions depend on how you're running Kubernetes and are specifically for kubeadm. The same instructions can't be applied to a hosted/cloud Kubernetes platform where you don't have control over the Kubernetes API server.

[kube-oidc-proxy](https://github.com/TremoloSecurity/kube-oidc-proxy) is a useful project that provides a reverse proxy to authenticate to managed Kubernetes API servers via OIDC.

To integrate the authentik Agent with your Kubernetes deployment, you'll need to configure kubeadm.

### Configure kubeadm settings

Update your kubeadm config file using the template below:

```yaml
apiVersion: kubeadm.k8s.io/v1beta4
kind: ClusterConfiguration
apiServer:
    # [...]
    extraArgs:
        - name: oidc-client-id
          value: kubernetes-cluster
        - name: oidc-groups-claim
          value: groups
        - name: oidc-groups-prefix
          value: "oidc:"
        - name: oidc-issuer-url
          value: https://authentik.company/application/o/<application-slug>/
        - name: oidc-username-claim
          value: email
```

Run the following command to apply the changes to an existing Kubernetes cluster:

This command will restart the API server. Plan accordingly for production environments.

```sh
kubeadm upgrade apply <version> --config=kubeadm_config.yml
```

Where `<version>` matches the target Kubernetes version specified in your config file.

### Configure kubectl to authenticate with authentik CLI

Update your kubeconfig file (\~/.kube/config) to use the `ak` command to authenticate

```yaml
users:
    - name: kubernetes-cluster
      user:
          exec:
              apiVersion: client.authentication.k8s.io/v1
              args:
                  - auth
                  - kubectl
                  - --client-id=kubernetes-cluster
              command: ak
              env: null
              interactiveMode: IfAvailable
              provideClusterInfo: false
```

To verify, run `kubectl auth whoami`, which should output your authentik email address as a username.

---

## Local device login

Local device login allows you to log in to devices using authentik credentials instead of separate local accounts.

Users authenticate with authentik, just like they do for any application. The operating system login screen on a laptop, desktop, or server is connected to authentik.

Local device login is currently only supported on Windows and Linux.

For more information, pick a topic below:

---

## Linux local device login

<!-- TODO @BeryJu add screenshot -->

## Prerequisites

- The authentik Agent deployed on the Linux device. See [Deploy the authentik Agent on Linux](../../agent-deployment/linux.mdx) for more details.
- Configure an authorization flow on the Agent connector.
- A **[device access group](../device-access-groups.mdx)** configured with the appropriate user or group bindings. Without this group, all login attempts are denied. See [Configure device access](#configure-device-access).

## How it works

- authentik Agent is integrated with the Pluggable Authentication Modules (PAM) framework on the Linux device.
- The end user logs in via the usual Linux login screen and is prompted for their authentik credentials.
- The Agent authenticates the credentials against the authentik server and the user is logged in.

## How to log in to a Linux device

When configured correctly, when you log in you should see a prompt for **authentik Password** rather than just **Password**.

1. On the Linux login screen, you enter your authentik credentials.
2. After you authenticate, you are logged in to the Linux device.

## Configure device access

Local device login requires the authenticating user to have access to the device. Access is controlled via [device access groups](../device-access-groups.mdx), which always apply. On Enterprise, direct device bindings for users, groups, or policies also affect access. Without an appropriately configured device access group or direct binding, **all login attempts are denied**.

1. In the Admin interface, navigate to **Endpoint Devices** > **Device access groups** and click **New Device Access Group**.
2. Provide a **Group Name** (e.g. `linux-devices`) and click **Create Device Access Group**.
3. Expand the newly created device access group and click **Bind existing Policy / Group / User**.
4. Select **Group** and choose a group that contains the users who should be allowed to log in to the device. Alternatively, bind a specific **User** or a **Policy**.
5. Click **Create**.
6. Navigate to **Endpoint Devices** > **Devices** and edit the device for which you want to enable login.
7. Set the **Access group** to the device access group you created.
8. Click **Update**.

You can also assign a device access group during enrollment by selecting a **Device Group** when creating the enrollment token.

## Known issues

- Only WebAuthn MFA is supported.
- On non-Debian Linux distributions, you currently need to [manually configure NSS and PAM](../../agent-deployment/linux.mdx#configure-device-login-on-non-debian-systems).

---

## Windows local device login

## Windows Credential Provider

Windows Credential Provider (WCP) is a component of the authentik Agent that allows logging in to Windows devices using authentik credentials.

Currently, only local login is supported; RDP login is not yet available and is under development.

- WCP is currently only tested on Windows 11 and Windows Server 2026.
- When WCP is enabled, the password of the Windows user account that's used to log in is set to a random string.
- Support with Active Directory has not been confirmed yet.
- Offline login is currently not supported.

## Prerequisites

- The authentik Agent (including the WCP component) deployed on the Windows device. See [Deploy the authentik Agent on Windows](../../agent-deployment/windows.mdx) for more details.
- Configure an authorization flow on the Agent connector.
- A **[device access group](../device-access-groups.mdx)** configured with the appropriate user or group bindings. Without this group, all login attempts are denied. See [Configure device access](#configure-device-access).

## How it works

- The system agent requests an authentication and authorization URL from authentik, using its token.
- This URL is opened in a browser that also injects the device token information, allowing authentik to know that the login request is executed on the same machine.
- The end user logs in normally using the standard authentik interface and flows.
- After authentication finishes, the browser is redirected to a well-defined location and uses the token it receives to finish authentication and authorization through the system agent.

## How to log in to a Windows device

1. On the Windows login screen, click the authentik icon:

![Windows login screen](authentik-login.png)

2. A browser window opens and prompts you for your authentik credentials.
3. After you authenticate, you are logged in to the Windows device.

## Configure device access

Local device login requires the authenticating user to have access to the device. Access is controlled via [device access groups](../device-access-groups.mdx), which always apply. On Enterprise, direct device bindings for users, groups, or policies also affect access. Without an appropriately configured device access group or direct binding, **all login attempts are denied**.

1. In the Admin interface, navigate to **Endpoint Devices** > **Device access groups** and click **New Device Access Group**.
2. Provide a **Group Name** (e.g. `windows-devices`) and click **Create Device Access Group**.
3. Expand the newly created device access group and click **Bind existing Policy / Group / User**.
4. Select **Group** and choose a group that contains the users who should be allowed to log in to the device. Alternatively, bind a specific **User** or a **Policy**.
5. Click **Create**.
6. Navigate to **Endpoint Devices** > **Devices** and edit the device for which you want to enable login.
7. Set the **Access group** to the device access group you created.
8. Click **Update**.

You can also assign a device access group during enrollment by selecting a **Device Group** when creating the enrollment token.

---

## Active Directory

## Preparation

The following placeholders are used in this guide:

- `ad.company` is the name of the Active Directory domain.
- `authentik.company` is the FQDN of the authentik installation.

## Active Directory configuration

To support the integration of Active Directory with authentik, you need to create a service account in Active Directory.

1. Open **Active Directory Users and Computers** on a domain controller or computer with **Active Directory Remote Server Administration Tools** installed.

2. Navigate to an Organizational Unit, right-click it, and select **New** > **User**.

3. Create a service account, matching your naming scheme, for example:

   ![](./01_user_create.png)

4. Set the password for the service account. Ensure that the **Reset user password and force password change at next logon** option is not checked.

   Either one of the following commands can be used to generate the password:

   ```sh
   pwgen 64 1
   ```

   ```sh
   openssl rand 36 | base64 -w 0
   ```

5. Open the **Delegation of Control Wizard** by right-clicking the domain Active Directory Users and Computers, and selecting **All Tasks**.

6. Select the authentik service account that you've just created.

7. Grant these additional permissions. They are required only when *User password writeback* is enabled on the LDAP source in authentik, and depend on your Active Directory domain.

   ![](./02_delegate.png)

Optionally, if you don't want authentik to be able to view and sync objects within certain Organizational Units, you can limit the service account's permissions:

1. Right-click the Organizational Unit in question and navigate to **Properties** > **Security**.
2. Select the authentik service account that you created.
3. Under the **Deny** column, check **Read**.
4. Click **Apply**.

You can repeat this process for other OUs and objects within Active Directory.

By default, Windows Server 2025 requires LDAP signing, which can disrupt authentik's Active Directory connectivity if LDAPS is not in use. You can address this by enabling LDAPS or by disabling LDAP signing on the domain controller. Disabling LDAP signing has security implications.

## authentik setup

To support the integration of authentik with Active Directory, create a new LDAP source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**.

3. Click **Create** and select **LDAP Source** as the type.

4. Provide a name, slug, and the following required configurations:

   Under **Connection settings**:

   - **Server URI**: `ldap://ad.company`

   For authentik to be able to write passwords back to Active Directory, make sure to use `ldaps://` as a prefix. You can verify that LDAPS is working by opening the `ldp.exe` tool on a domain controller and attempting a connection to the server via port 636. If a connection can be established, LDAPS is functioning as expected. More information can be found in the [Microsoft LDAPS documentation](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/ldap-over-ssl-connection-issues).

   Multiple servers can be specified by separating URIs with a comma (for example, `ldap://dc1.ad.company,ldap://dc2.ad.company`). If a DNS entry with multiple records is used, authentik selects a random entry when first connecting.

   - **Bind CN**: `<service account>@ad.company`
   - **Bind Password**: the password of the service account created in the previous section.
   - **Base DN**: the base DN that you want authentik to sync.

   Under **LDAP Attribute mapping**:

   - **User Property Mappings**: select all mappings that start with `authentik default LDAP` and `authentik default Active Directory`.
   - **Group Property Mappings**: select `authentik default LDAP Mapping: Name`.

   Under **Additional settings**, adjust these optional configurations based on the setup of your domain:

   - **Group**: if enabled, all synchronized groups will be given this group as a parent.
   - **Addition User/Group DN**: additional DN that is *prepended* to the base DN configured above to limit the scope of user and group synchronization.
   - **User object filter**: objects that should be considered users (for example, `(objectClass=user)`). For Active Directory, set it to `(&(objectClass=user)(!(objectClass=computer)))` to exclude computer accounts.
   - **Group object filter**: objects that should be considered groups (for example, `(objectClass=group)`).
   - **Lookup using a user attribute**: acquire group membership from a user object attribute (`memberOf`) instead of a group attribute (`member`). This works with directories and nested group memberships (Active Directory, Red Hat IDM/FreeIPA), using `memberOf:1.2.840.113556.1.4.1941:` as the group membership field.
   - **Group membership field**: the user object attribute or group object attribute that determines the group membership of a user (for example, `member`). If **Lookup using a user attribute** is set, this should be a user object attribute. Otherwise, this should be a group object attribute.
   - **User membership attribute**: ensure that this is set to `distinguishedName`.
   - **Object uniqueness field**: a user attribute that contains a unique identifier (for example, `objectSid`).

5. Click **Finish** to save the LDAP source. An LDAP synchronization begins in the background. After it is complete, view the summary by navigating to **Dashboards** > **System Tasks**:

   ![](./03_additional_perms.png)

6. To finalize the Active Directory setup, enable the `authentik LDAP` backend in the password stage.

   ![](./11_ak_stage.png)

---

## FreeIPA

## Preparation

The following placeholders are used in this guide:

- `svc_authentik` is the name of the bind account.
- `freeipa.company` is the name of the domain.
- `ipa1.freeipa.company` is the name of the FreeIPA server.

## FreeIPA setup

1. Log in to FreeIPA.

2. Create a user in FreeIPA that matches your naming scheme. Provide a strong password. Example generation methods are `pwgen 64 1` or `openssl rand 36 | base64 -w 0`. After you are done, click **Add and Edit**.

   ![](./user_create.png)

3. In the user management screen, select the **Roles** tab.

   ![](./user_roles.png)

4. Add a role that has privileges to change user passwords. The default `User Administrators` role is sufficient. This is needed to support password resets from within authentik.

   ![](./add_user_role.png)

5. By default, if an administrator account resets a user's password in FreeIPA, the user's password expires after the first use and must be reset again. This is a security feature to ensure password complexity and history policies are enforced. To bypass this feature for a more seamless experience, make the following modification on each FreeIPA server:

   ```
   $ ldapmodify -x -D "cn=Directory Manager" -W -h ipa1.freeipa.company -p 389

   dn: cn=ipa_pwd_extop,cn=plugins,cn=config
   changetype: modify
   add: passSyncManagersDNs
   passSyncManagersDNs: uid=svc_authentik,cn=users,cn=accounts,dc=freeipa,dc=company
   ```

For more information, see [22.1.2. Enabling Password Reset Without Prompting for a Password Change at the Next Login](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/user-authentication#user-passwords-no-expiry).

## authentik setup

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues.

See the [LDAP Source documentation](../../protocols/ldap) for more information on these settings.

To create a new LDAP source in authentik:

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, select **LDAP Source**, and click **Next**.

3. Configure the following settings:

   - **Name**: Provide a descriptive name for the LDAP source.

   - **Slug**: Provide a slug for the LDAP source.

   - **Update internal password on login**: Enable this if you want users to still be able to log in when FreeIPA is unavailable.

   - **Delete not found object**: Enable to delete users from authentik when they are deleted in FreeIPA.

   - Under **Connection settings**:
     - **Server URI**: `ldaps://ipa1.freeipa.company`

       You can specify multiple server URIs separated by commas (for example, `ldap://ipa1.freeipa.company,ldap://ipa2.freeipa.company`). If you use a DNS record with multiple entries, authentik picks one at random on first connection.
     - **Enable StartTLS**: Enable for `ldap://` protocol, disable for `ldaps://`.
     - **TLS Verification Certificate**: Optionally select the certificate used to validate the remote certificate.
     - **Bind CN**: `uid=svc_authentik,cn=users,cn=accounts,dc=freeipa,dc=company`
     - **Bind Password**: The password for the user account above.
     - **Base DN**: `dc=freeipa,dc=company`

   - Under **LDAP Attribute mapping**:
     - **User Property Mappings**: Select all Mappings whose names begin with `authentik default LDAP` and `authentik default OpenLDAP`. Deselect any other Mappings that are selected by default.
     - **Group Property Mappings**: Select `authentik default OpenLDAP Mapping: cn`

   - Under **Additional settings**:
     - **Additional Parent Group**: If selected, all synchronized groups will be given this authentik group as a parent.
     - **User Path**: The path that users will be saved under in authentik.
     - **Addition User/Group DN**: `cn=users,cn=accounts`
     - **Addition Group DN**: `cn=groups,cn=accounts`
     - **User object filter**: `(objectClass=person)`
     - **Group object filter**: `(objectClass=groupofnames)`
     - **Group membership field**: `memberOf`
     - **User membership attribute**: `distinguishedName`
     - **Lookup using user attribute**: Enabled.
     - **Object uniqueness field**: `ipaUniqueID`

   FreeIPA groups can contain nested groups. The `memberOf` user attribute lists all group memberships, direct and indirect.

   If you want to sync only direct group memberships, use the following settings:

   - **Group membership field**: `member`
   - **User membership attribute**: `distinguishedName`
   - **Lookup using user attribute**: Disabled.

4. Click **Finish**.

### Manual synchronization

After saving the source, start a synchronization by opening the source, going to the **Sync** tab, and clicking **Run sync again**.

Finally, confirm that the **User database + LDAP password** backend is selected in **Flows and Stages** > **Stages** > **Password stage**.

![](./password_stage.png)

### Blueprints

You can also configure the LDAP source with a blueprint:

You must set the username (dn) and password in the environment variables `FREEIPA_DN` and `FREEIPA_PASSWORD`.

```yaml
# yaml-language-server: $schema=https://goauthentik.io/blueprints/schema.json
version: 1
metadata:
    name: FreeIPA LDAP Source
    labels:
        blueprints.goauthentik.io/description: "LDAP Source configuration for FreeIPA"
entries:
    - model: authentik_sources_ldap.ldapsource
      identifiers:
          slug: ldap-source-freeipa
      attrs:
          enabled: true
          base_dn: dc=freeipa,dc=company
          additional_user_dn: cn=users,cn=accounts
          additional_group_dn: cn=groups,cn=accounts
          bind_cn: !Env FREEIPA_DN
          bind_password: !Env FREEIPA_PASSWORD
          delete_not_found_objects: true
          group_membership_field: memberOf
          group_object_filter: (objectClass=groupofnames)
          lookup_groups_from_user: true
          object_uniqueness_field: ipaUniqueID
          server_uri: ldaps://ipa1.freeipa.company,ldaps://ipa2.freeipa.company
          sni: true
          sync_groups: true
          sync_users: true
          sync_users_password: true
          user_membership_attribute: distinguishedName
          user_object_filter: (objectClass=person)
          user_property_mappings:
              - !Find [
                    authentik_sources_ldap.ldapsourcepropertymapping,
                    [managed, goauthentik.io/sources/ldap/openldap-cn],
                ]
              - !Find [
                    authentik_sources_ldap.ldapsourcepropertymapping,
                    [managed, goauthentik.io/sources/ldap/openldap-uid],
                ]
              - !Find [
                    authentik_sources_ldap.ldapsourcepropertymapping,
                    [managed, goauthentik.io/sources/ldap/default-mail],
                ]
              - !Find [
                    authentik_sources_ldap.ldapsourcepropertymapping,
                    [managed, goauthentik.io/sources/ldap/default-dn-path],
                ]
              - !Find [
                    authentik_sources_ldap.ldapsourcepropertymapping,
                    [managed, goauthentik.io/sources/ldap/default-name],
                ]
          group_property_mappings:
              - !Find [
                    authentik_sources_ldap.ldapsourcepropertymapping,
                    [managed, goauthentik.io/sources/ldap/openldap-cn],
                ]
```

If using LDAP, prepend the server URI with `ldap://` and include `start_tls: true`.

---

## Browser configuration for SPNEGO

You might need to configure your web browser to allow SPNEGO. Following are the instructions for major browsers.

## Firefox

1. In the address bar of Firefox, type `about:config` to display the list of current configuration options.
2. In the **Filter** field, type `negotiate` to restrict the list of options.
3. Double-click the `network.negotiate-auth.trusted-uris` entry to display the **Enter string value** dialog box.
4. Enter the name of the domain against which you want to authenticate. For example, `.example.com`.

On Windows environments, to automate the deployment of this configuration use a [Group policy](https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows). On Linux or macOS systems, use [policies.json](https://support.mozilla.org/en-US/kb/customizing-firefox-using-policiesjson).

## Chrome

This section applies only for Chrome users on macOS and Linux machines. For Windows, see the instructions below.

1. Make sure you have the necessary directory created by running: `mkdir -p /etc/opt/chrome/policies/managed/`
2. Create a new `/etc/opt/chrome/policies/managed/mydomain.json` file with write privileges limited to the system administrator or root, and include the following line: `{ "AuthServerWhitelist": "*.example.com" }`.

If you use Chromium, use `/etc/chromium/policies/managed/` instead of `/etc/opt/chrome/policies/managed/`.

To automate the deployment of this configuration use a [Group policy](https://support.google.com/chrome/a/answer/187202).

## Windows / Internet Explorer

Log in to the Windows machine using an account of your Kerberos realm (or administrative domain).

Open Internet Explorer, click **Tools** and then click **Internet Options**. You can also find **Internet Options** using the system search.

1. Click the **Security** tab.
2. Click **Local intranet**.
3. Click **Sites**.
4. Click **Advanced**.
5. Add your domain to the list.
6. Click the **Security tab**.
7. Click **Local intranet**.
8. Click **Custom Level**.
9. Select **Automatic login only in Intranet zone**.

To automate the deployment of this configuration use a [Group policy](https://learn.microsoft.com/en-us/previous-versions/troubleshoot/browsers/administration/how-to-configure-group-policy-preference-settings).

---

## Kerberos

This source allows users to enroll themselves with an existing Kerberos identity.

## Preparation

The following placeholders are used in this guide:

- `REALM.COMPANY` is the Kerberos realm.
- `authentik.company` is the FQDN of the authentik installation.

Examples are shown for an MIT Krb5 KDC system; you might need to adapt them for your Kerberos installation.

There are three ways to use the Kerberos source:

- As a password backend, where users can log in to authentik with their Kerberos password.
- As a directory source, where users are synced from the KDC.
- With SPNEGO, where users can log in to authentik with their [browser](./browser.mdx) and their Kerberos credentials.

You can choose to use one or more of those methods.

## Common settings

In the authentik Admin interface, under **Directory** > **Federation and Social login**, create a new source of type Kerberos with these settings:

- Name: a value of your choosing. This name is shown to users if you use the SPNEGO login method.
- Slug: `kerberos`
- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx).
- Realm: `REALM.COMPANY`
- Kerberos 5 configuration: If you need to override the default Kerberos configuration, you can do it here. See [man krb5.conf(5)](https://web.mit.edu/kerberos/krb5-latest/doc/admin/conf_files/krb5_conf.html) for the expected format.
- User matching mode: define how Kerberos users get matched to authentik users.
- Group matching mode: define how Kerberos groups (specified via property mappings) get matched to authentik groups.
- User property mappings and group property mappings: see [Source property mappings](../../property-mappings/index.mdx) and the section below for details.

## Password backend

No extra configuration is required. Simply select the Kerberos backend in the password stage of your flow.

Note that this only works on users that have been linked to this source, i.e. they must have been created via sync or via SPNEGO.

## Sync

The sync process uses the [Kerberos V5 administration system](https://web.mit.edu/kerberos/krb5-latest/doc/admin/database.html) to list users. Your KDC must support it to sync users with this source.

You need to create both a principal (a unique identity that represents a user or service in a Kerberos network) for authentik and a keytab file:

```bash
$ kadmin
> add_principal authentik/admin@REALM.COMPANY
> ktadd -k /tmp/authentik.keytab authentik/admin@REALM.COMPANY
> exit
$ cat /tmp/authentik.keytab | base64
$ rm /tmp/authentik.keytab
```

In authentik, configure these extra options:

- Sync users: enable it
- Sync principal: `authentik/admin@REALM.COMPANY`
- Sync keytab: the base64-encoded keytab created above.

If you do not wish to use a keytab, you can also configure authentik to authenticate using a password or an existing credentials cache.

## SPNEGO

You need to create both a principal (a unique identity that represents a user or service in a Kerberos network) for authentik and a keytab file:

```bash
$ kadmin
> add_principal HTTP/authentik.company@REALM.COMPANY
> ktadd -k /tmp/authentik.keytab HTTP/authentik.company@REALM.COMPANY
> exit
$ cat /tmp/authentik.keytab | base64
$ rm /tmp/authentik.keytab
```

In authentik, configure these extra options:

- SPNEGO keytab: the base64-encoded keytab created above.

If you do not wish to use a keytab, you can also configure authentik to use an existing credentials cache.

You can also override the SPNEGO server name if needed.

You might need to configure your web browser to allow SPNEGO. Check out [our documentation](./browser.mdx) on how to do so. You can now log in to authentik using SPNEGO.

### Custom server name

If your authentik instance is accessed from multiple domains, you might want to force the use of a specific server name. You can do so with the **Custom server name** option. The value must be in the form of `HTTP@authentik.company`.

If not specified, the server name defaults to trying out all entries in the keytab/credentials cache until a valid server name is found.

## Extra settings

There are some extra settings you can configure:

- Update internal password on login: when a user logs in to authentik using the Kerberos source as a password backend, their internal authentik password will be updated to match the one from Kerberos.
- Use password writeback: when a user changes their password in authentik, their Kerberos password is automatically updated to match the one from authentik. This is only available if synchronization is configured, and requires authentik to receive the raw password; [hashed-password imports](../../../../install-config/automated-install.mdx#authentik_bootstrap_password_hash) are not written back to Kerberos.

## Kerberos source property mappings

See the [overview](../../property-mappings/index.mdx) for information on how property mappings work with external sources.

By default, authentik ships with [pre-configured mappings](#built-in-property-mappings) for the most common Kerberos setups. These mappings can be found on the Kerberos Source Configuration page in the Admin interface.

### Built-in property mappings

Kerberos property mappings are used when you define a Kerberos source. These mappings define which Kerberos property maps to which authentik property. By default, the following mappings are created:

- authentik default Kerberos User Mapping: Add realm as group
  The realm of the user will be added as a group for that user.
- authentik default Kerberos User Mapping: Ignore other realms
  Realms other than the one configured on the source are ignored, and logging in is not allowed.
- authentik default Kerberos User Mapping: Ignore system principals
  System principals such as `K/M` or `kadmin/admin` are ignored.
- authentik default Kerberos User Mapping: Multipart principals as service accounts
  Multipart principals (for example: `HTTP/authentik.company`) have their user type set to **service account**.

These property mappings are configured with the most common Kerberos setups.

### Expression data

The following variable is available to Kerberos source property mappings:

- `principal`: a Python string containing the Kerberos principal. For example `alice@REALM.COMPANY` or `HTTP/authentik.company@REALM.COMPANY`.

When the property mapping is invoked from a SPNEGO context, the following variable is also available:

- `spnego_info`: a Python dictionary with the following keys:
  - `initiator_name`: the name of the initiator of the GSSAPI security context
  - `target_name`: the name of the target of the GSSAPI security context
  - `mech`: the GSSAPI mechanism used. Should always be Kerberos
  - `actual_flags`: the flags set on the GSSAPI security context

When the property mapping is invoked from a synchronization context, the following variable is also available:

- `principal_obj`: a [`Principal`](https://kadmin-rs.readthedocs.io/latest/kadmin.html#kadmin.Principal) object retrieved from the KAdmin API

### Additional expression semantics

If you need to skip synchronization for a specific object, you can raise the `SkipObject` exception. To do so, create or modify a Kerberos property mapping to use an expression to define the object to skip.

**Example:**

```python
localpart, realm = principal.rsplit("@", 1)
if localpart == "username":
    raise SkipObject
```

## Troubleshooting

You can start authentik with the `KRB5_TRACE=/dev/stderr` environment variable for Kerberos to print errors in the logs.

Reverse proxy caching can break the Kerberos authentication flow because, during negotiation, the server sends a second `401 Unauthorized` response containing the `WWW-Authenticate` header that the client needs to continue the handshake; if the reverse proxy caches that `401` instead of forwarding it to authentik, the authentication process fails, so response caching should be disabled on any reverse proxy routes involved in Kerberos authentication.

---

## LDAP source

Sources allow you to connect authentik to an existing user directory. This source allows you to import users and groups from an LDAP server.

User and group synchronization only creates or updates objects in authentik, not on the LDAP server. **User password writeback** separately writes password changes to LDAP. Creating a user in an external LDAP directory from authentik requires custom automation, such as a [notification rule expression policy](../../../../sys-mgmt/events/notification_rule_expression_policies.mdx#create-ldap-users-from-authentik-events).

For Active Directory, follow the [Active Directory integration](../../directory-sync/active-directory/index.mdx).

For FreeIPA, follow the [FreeIPA integration](../../directory-sync/freeipa/index.mdx).

## Configuration options for LDAP sources

To create or edit a source in authentik, open the Admin interface and navigate to **Directory > Federation and Social login**. There you can create a new LDAP source, or edit an existing one, using the following settings.

- **Enabled**: Toggle this option on to allow authentik to use the defined LDAP source.
- **Update internal password on login**: When the user logs in to authentik using the LDAP password backend, the password is stored as a hashed value in authentik. Toggle off (default setting) if you do not want to store the hashed passwords in authentik.
- **Sync users**: Enable or disable user synchronization from LDAP to authentik.
- **User password writeback**: Enable this option if you want to write password changes that are made in authentik back to LDAP. This requires authentik to receive the raw password; [hashed-password imports](../../../../install-config/automated-install.mdx#authentik_bootstrap_password_hash) are not written back to LDAP.
- **Sync groups**: Enable or disable group synchronization from LDAP to authentik.
- **Delete Not Found Objects**: 2025.6 This option synchronizes user and group deletions from LDAP sources to authentik. User deletion requires enabling **Sync users** and group deletion requires enabling **Sync groups**.

#### Connection settings

- **Server URI**: URI to your LDAP server or domain controller. You can specify multiple servers by separating URIs with a comma, such as `ldap://ldap1.company,ldap://ldap2.company`. When using a DNS entry with multiple records, authentik selects a random entry when first connecting.
  - **Enable StartTLS**: Enables StartTLS functionality. To use LDAPS instead, use port `636`.
  - **Use Server URI for SNI verification**: this setting is required for servers using TLS 1.3+

- **TLS Verification Certificate**: Select a certificate/keypair containing the LDAP server CA chain to validate the remote certificate. Leave this field empty to skip certificate validation for LDAPS and StartTLS connections. Leaving it empty does not use the container or operating system trust store.

- **TLS Client authentication certificate**: Client certificate keypair to authenticate against the LDAP server's certificate.

- **Bind CN**: CN of the bind user. This can also be a UPN in the format of `user@domain.tld`.

- **Bind Password**: Password used during the bind process.

- **Base DN**: Base DN (distinguished name) used for all LDAP queries.

If the LDAP server rejects the TLS handshake, verify that **Server URI**, **Enable StartTLS**, and **Use Server URI for SNI verification** match the server configuration. You can also configure `AUTHENTIK_LDAP__TLS__CIPHERS` if the server requires a specific cipher suite.

#### LDAP Attribute mapping

- **User Property Mappings** and **Group Property Mappings**: Define which LDAP properties map to which authentik properties. The default set of property mappings is generated for Active Directory. See also our documentation on [property mappings](#ldap-source-property-mappings).

  When the **Sync users** and/or the **Sync groups** options are enabled, their respective property mapping options must have at least one mapping selected, otherwise the sync will not start.

#### Additional settings

- **Sync Group Parents**: Sync group hierarchy from LDAP directories. Adds parents to groups imported from this LDAP directory, using same lookup fields and method as for user group membership.
- **Additional Parent Group**: Parent group for all the groups imported from LDAP. An example use case would be to import Active Directory groups under a root `imported-from-ad` group.
- **User path**: Path template for all new users created.
- **Additional User DN**: Prepended to the base DN for user queries.
- **Additional Group DN**: Prepended to the base DN for group queries.
- **User object filter**: Consider objects matching this filter to be users.
- **Group object filter**: Consider objects matching this filter to be groups.
- **Lookup using a user attribute**: Acquire group membership from a User object attribute (`memberOf`) instead of a Group attribute (`member`). This works with directories with nested group memberships (Active Directory, RedHat IDM/FreeIPA), using `memberOf:1.2.840.113556.1.4.1941:` as the group membership field.
- **Group membership field**: The user object attribute or the group object attribute that determines the group membership for a user. If **Lookup using a user attribute** is set, this should be a user object attribute, otherwise a group object attribute.
- **User membership attribute**: Attribute name on authentik user objects that is checked against the **Group membership field**. Two common cases are:
  - If your groups have `member` attributes containing DNs, set this to `distinguishedName`. (The `distinguishedName` attribute for User objects in authentik is set automatically.)
  - If your groups have `memberUid` attributes containing `uid`s, set this to `uid`. Make sure that you've created a property mapping that creates an attribute called `uid`.
- **Object uniqueness field**: This field contains a unique identifier.

## LDAP source property mappings

See the [overview](../../property-mappings/index.mdx) for information on how property mappings work.

By default, authentik ships with [pre-configured mappings](#built-in-property-mappings) for the most common LDAP setups. These mappings can be found on the LDAP Source Configuration page in the Admin interface.

You can assign the value of a mapping to any user attribute. Keep in mind, though, data types from the LDAP server will be carried over. This means that with some implementations, where fields are stored as an array in LDAP, they will be saved as an array in authentik. To prevent this, use the built-in `list_flatten` function. Here is an example mapping for the user's username and a custom attribute for a phone number:

```python
return {
    "username": ldap.get("uid"), # list_flatten is automatically applied to top-level attributes
    "attributes": {
        "phone": list_flatten(ldap.get("phoneNumber")), # but not for attributes!
    },
}
```

The same LDAP source property mapping type is used for both users and groups. A mapping only applies to groups when you assign it under **Group Property Mappings** on the LDAP source. If you only use the built-in group property mappings, synced groups will keep the automatically populated LDAP attributes, such as `distinguishedName`, but custom LDAP attributes won't be copied unless you add your own group mapping.

### Copy a custom LDAP group attribute

To store a custom LDAP group attribute in authentik's group `attributes`, create an **LDAP Source Property Mapping** and assign it to **Group Property Mappings** on the source:

```python
return {
    "attributes": {
        "acl": list_flatten(ldap.get("acl")),
    },
}
```

If your LDAP server stores the value as JSON text and you want authentik to keep it as structured data instead of a string, decode it in the mapping:

```python
import json

raw_acl = list_flatten(ldap.get("acl"))
return {
    "attributes": {
        "acl": json.loads(raw_acl) if raw_acl else None,
    },
}
```

### Built-in property mappings

LDAP property mappings are used when you define an LDAP source. These mappings define which LDAP property maps to which authentik property. By default, the following mappings are created:

- `authentik default Active Directory Mapping: givenName`
- `authentik default Active Directory Mapping: sAMAccountName`
- `authentik default Active Directory Mapping: sn`
- `authentik default Active Directory Mapping: userPrincipalName`
- `authentik default LDAP Mapping: mail`
- `authentik default LDAP Mapping: Name`
- `authentik default OpenLDAP Mapping: cn`
- `authentik default OpenLDAP Mapping: uid`

These are configured for most common LDAP setups.

### Expression data

The following variables are available to LDAP source property mappings:

- `ldap`: A Python dictionary containing data from LDAP.
- `dn`: The object DN.

### Additional expression semantics

If you need to skip inbound synchronization for a specific user or group, you can raise the `SkipObject` exception. To do so, create or modify an LDAP property mapping to use an expression to define the object to skip.

`SkipObject` only affects inbound synchronization. It does not control password writeback or custom LDAP writes from notification policies.

**Example:**

```python
if ldap.get("cn") == "doNotSync":
    raise SkipObject
```

## Password login

By default, authentik doesn't update the password it stores for a user when they log in using their LDAP credentials. That means that if the LDAP server is not reachable by authentik, users will not be able to log in. This behavior can be turned on with the **Update internal password on login** setting on the LDAP source.

Sources created prior to the 2024.2 release have this setting turned on by default.

Be aware of the following security considerations when turning on this functionality:

- Updating the LDAP password does not invalidate the password stored in authentik; however for LDAP Servers like FreeIPA and Active Directory, authentik will lock its internal password during the next LDAP sync. For other LDAP servers, the old passwords will still be valid indefinitely.
- Logging in via LDAP credentials overwrites the password stored in authentik if users have different passwords in LDAP and authentik.
- Custom security measures that are used to secure the password in LDAP may differ from the ones used in authentik. Depending on threat model and security requirements this could lead to unknowingly being non-compliant.

## Troubleshooting

To troubleshoot LDAP sources and their synchronization, see [LDAP Troubleshooting](../../../../troubleshooting/ldap_source.mdx).

---

## OAuth source

This source allows users to enroll themselves with an external OAuth-based identity provider. The generic provider expects the endpoint to return OpenID Connect-compatible information. Vendor-specific implementations have their own OAuth source.

- Policies: Allow/Forbid users from linking their accounts with this provider.
- Icon: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx).
- Request Token URL: This field is used for OAuth v1 implementations and will be provided by the provider.
- Authorization URL: This value will be provided by the provider.
- Access Token URL: This value will be provided by the provider.
- Profile URL: This URL is called by authentik to retrieve user information upon successful authentication.
- Consumer key/Consumer secret: These values will be provided by the provider.
- Scopes: Configure additional scopes to send to the provider.

  Starting with authentik 2022.10, the default scopes can be replaced by prefixing the value for scopes with `*`.

## OpenID Connect

### Well-known

Instead of configuring the URLs for a source manually, if the application you're configuring implements the [OpenID Connect Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html), you can configure the source with a single URL. The URL should always end with `.well-known/openid-configuration`. Many applications don't explicitly mention this URL, but for most of them it will be `https://application.company/.well-known/openid-configuration`.

This URL is fetched upon saving the source, and all the URLs will be replaced by the ones from the Discovery document. No automatic re-fetching is done.

### JWKS

To simplify machine-to-machine authentication, you can create an OAuth source as a trusted source of JWTs. Create a source and configure either the Well-known URL or the OIDC JWKS URL. You can also manually enter the JWKS data.

Afterward, this source can be selected in one or more OAuth 2.0 providers. Any JWT issued by the configured source's JWKS can authenticate. To learn more about this, see [JWT authentication](../../../../add-secure-apps/providers/oauth2/machine_to_machine#jwt-authentication).

### `login_hint` parameter

If the OAuth authentication was started from within an authentik flow and the user has already identified themselves, authentik will set the `login_hint` parameter to the email address of the user. If the Identification stage has the **Pretend user exists** option enabled and a user could not be found, the `login_hint` value will be set to the identifier that the user entered.

## OAuth source property mappings

See the [overview](../../property-mappings/index.mdx) for information on how property mappings work.

### Expression data

The following variables are available to OAuth source property mappings:

- `info`: A Python dictionary containing OAuth claims. For example (values might differ depending on the source):
  ```python
  {
      "iss": "https://source.company",
      "sub": "f153e7da687eec8c8789c72b6cc6bb5197df7b48b263b3151f36908e1bc10691",
      "aud": "01e4DmQiG1d3kaewD3Mkz7E7kXknk9j43eZMkNaE",
      "aud": "a7809c1b1c4aaa50adfb68660a6273dd9c8d15e4",
      "email": "user@authentik.company",
      "email_verified": True,
      "name": "User",
      "given_name": "User",
      "preferred_username": "user",
      "nickname": "user",
  }
  ```
- `client`: The OAuth client for this login. Call `client.do_request(method, url, token=token, **kwargs)` to make an authenticated request to the identity provider. It accepts request options such as `params` and `headers` and returns a `requests.Response`. Call `raise_for_status()` before reading the response if an API error should stop the mapping.
- `token`: A Python dictionary containing the OAuth tokens for this login. Pass it to `client.do_request` when making an authenticated request.

For example, a user property mapping can retrieve a field that the profile response does not include:

```python
response = client.do_request("GET", "https://source.company/api/user", token=token)
response.raise_for_status()
return {"attributes": {"department": response.json().get("department")}}
```

Replace the URL and response field with values from your identity provider's API. For a working provider-specific example, see [GitHub organization membership](../../social-logins/github/index.mdx#check-for-membership-of-a-github-organization).

---

## SAML source

This source allows authentik to act as a SAML service provider. Like the [SAML provider](../../../../add-secure-apps/providers/saml/index.mdx), it supports signed requests. Vendor-specific documentation is available in the integrations section.

## Terminology

| Abbreviation | Name                       | Description                                                                                                                                  |
| ------------ | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| IdP          | Identity provider          | The authoritative SAML authentication source that holds the user database.                                                                   |
| SP           | Service provider           | The client that is connected to an IdP, usually providing a service, such as a web application. In the current context, authentik is the SP. |
| -            | Assertion                  | A message sent by the IdP asserting that the user has been identified.                                                                       |
| ACS          | Assertion Consumer Service | The service on the SP side that consumes the assertion sent from the IdP.                                                                    |
| SSO URL      | Single sign-on URL         | The URL on the IdP side that the SP calls to initiate an authentication process.                                                             |
| SLO URL      | Single logout URL          | The URL on the IdP side that the SP calls to invalidate a session and log the user out of the IdP and the SP.                                |

## Example configuration

If you have the provider metadata, you can extract the values that you need from it. The following table provides example values for a basic IdP metadata file.

| Name                       | Example                                                              | Description                                                                                                                                                                                                                                                                       |
| -------------------------- | -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name                       | Company SAML                                                         | The name of the authentication source                                                                                                                                                                                                                                             |
| Slug                       | company-saml                                                         | The slug used in URLs for the source                                                                                                                                                                                                                                              |
| Icon                       | `branding/company-icon.svg`                                          | Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx).                                                                                                                                                                     |
| SSO URL                    | [https://saml.company/login/saml](https://saml.company/login/saml)   | The SingleSignOnService URL for the IdP. This value can be found in the metadata or IdP documentation. There can be different URLs for different binding types, such as HTTP-Redirect and HTTP-POST. Use the URL for the binding type that you choose below.                      |
| SLO URL                    | [https://saml.company/logout/saml](https://saml.company/logout/saml) | The URL that is called when a user logs out of authentik. This can be used to automatically log the user out of the SAML IdP after logging out of authentik. Not all IdPs support or require this behavior.                                                                       |
| Binding Type               | HTTP-POST                                                            | How authentik communicates with the SSO URL (302 redirect or POST request). This will depend on what the provider supports.                                                                                                                                                       |
| Allow IdP-initiated logins | False                                                                | Whether to allow the IdP to log users into authentik without any interaction. Activating this can be a security risk because this request is not verified, and could be used by an attacker to authenticate a user without interaction.                                           |
| Force authentication       | False                                                                | When enabled, authentik requests the IdP to force re-authentication of the user, even if they already have an active session with the IdP.                                                                                                                                        |
| Issuer override            | `https://authentik.company/source/saml/<source-slug>/metadata/`      | The identifier (Entity ID) for the authentik instance in the SAML federation. This is optional and defaults to the metadata URL of the source, as shown in the example. To override it, set any value that the IdP recognizes. This must match what you register on the IdP side. |
| NameID Policy              | Persistent                                                           | Depending on what the IdP sends as persistent ID, some IdPs use the username or email address while others use a random string or hashed value. If the user in authentik receives a random string as a username, try using **Email address** or **Windows**.                      |
| Flow settings              | Default                                                              | If there are custom flows in your instance for external authentication, select them here.                                                                                                                                                                                         |

## Transient users and account lifetime

When the IdP sends a `transient` NameID, authentik creates a temporary user linked to the SAML source. This is determined by the NameID format in the assertion, even if the source's **NameID Policy** requests another format.

Temporary users are deleted:

- when they log out of authentik, or
- by a cleanup task after they expire.

The **Delete temporary users after** setting determines the expiration time from account creation. The default is `days=1`; you can set values such as `hours=8` or `hours=1;minutes=30`. This setting does not delay deletion on logout. Cleanup tasks run periodically, rather than at the exact expiration time, and do not check for active sessions, so an expired temporary user can be deleted while still logged in.

Mapping a transient user's username or email to a stable value does not make the account persistent or prevent deletion.

Use **Persistent** NameIDs when users need to keep the same authentik account across logins. Configure the IdP to send a stable persistent NameID and set the source's **NameID Policy** to **Persistent**. authentik uses the NameID to find the existing source connection on subsequent logins.

## Add authentik as a service provider with your IdP

This depends on the software that you use for your IdP. On the **Metadata** tab in the SAML federation source, you can download the metadata for the service provider. This should let you import the service provider into most IdPs. If this does not work, the important parts are:

- Entity ID: Taken from the Issuer override field above
- Return URL/ACS URL: `https://authentik.company/source/saml/<source-slug>/acs/`
- Certificate: If you have chosen to sign your outgoing requests, use the public side of the certificate that you specified in the settings.

## Example IdP metadata

```xml
<md:EntityDescriptor entityID="https://saml.company/idp">
    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="false">
        <md:NameIDFormat>
            urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
        </md:NameIDFormat>
        <md:NameIDFormat>
            urn:oasis:names:tc:SAML:2.0:nameid-format:transient
        </md:NameIDFormat>
        <md:NameIDFormat>
            urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
        </md:NameIDFormat>
        <md:NameIDFormat>
            urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
        </md:NameIDFormat>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://saml.company/login/saml/"/>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://saml.company/login/saml/"/>
    </md:IDPSSODescriptor>
    <md:Organization>
        <md:OrganizationName xml:lang="en">Example Organization</md:OrganizationName>
        <md:OrganizationDisplayName xml:lang="en">Example Organization</md:OrganizationDisplayName>
        <md:OrganizationURL xml:lang="en">http://www.company</md:OrganizationURL>
    </md:Organization>
    <md:ContactPerson contactType="technical">
        <md:Company>Example Organization</md:Company>
        <md:GivenName>John</md:GivenName>
        <md:SurName>Doe</md:SurName>
        <md:EmailAddress>john.doe@company</md:EmailAddress>
        <md:TelephoneNumber>012 345 67890</md:TelephoneNumber>
    </md:ContactPerson>
    <md:ContactPerson contactType="support">
        <md:Company>Example Organization</md:Company>
        <md:GivenName>Helpdesk</md:GivenName>
        <md:SurName>Support</md:SurName>
        <md:EmailAddress>helpdesk@company</md:EmailAddress>
        <md:TelephoneNumber>012 345 67890</md:TelephoneNumber>
    </md:ContactPerson>
</md:EntityDescriptor>
```

## SAML source property mappings

See the [overview](../../property-mappings/index.mdx) for information on how property mappings work.

SAML source property mappings customize the user and group properties created from a SAML assertion. authentik parses the assertion's `AttributeStatement` into the `properties` dictionary before custom mappings run, using each SAML attribute's `Name` as the dictionary key. Custom mappings can then translate those SAML attribute names to authentik user fields such as `username`, `email`, `name`, and `attributes`.

Property mappings do not change the internal SAML source connection identifier, which is based on the assertion's NameID. To persist mapped user fields, ensure the source flow that runs for the user includes a [User Write stage](../../../../add-secure-apps/flows-stages/stages/user_write/index.mdx) before the user login stage. For existing users, this is the source's authentication flow; for new users, this is the source's enrollment flow.

### Expression data

The following variables are available to SAML source property mappings:

The parsed XML objects use Python's standard [`xml.etree.ElementTree`](https://docs.python.org/3/library/xml.etree.elementtree.html) API.

- `root`: The parsed XML root containing data from the source.
- `assertion`: The parsed XML element containing the SAML assertion.
- `name_id`: The parsed XML element identifying the user.
- `properties`: A Python dictionary containing the source's parsed SAML attributes and the results of any previously run mappings.

### Example

This example maps common SAML attributes to authentik user fields. Replace the attribute names with the SAML attribute `Name` values sent by the external identity provider connected to this SAML source.

```python
email = properties.get("email") or properties.get("urn:oid:0.9.2342.19200300.100.1.3")
first_name = properties.get("firstname") or properties.get("urn:oid:2.5.4.42")
last_name = properties.get("lastname") or properties.get("urn:oid:2.5.4.4")

return {
    "username": email,
    "email": email,
    "name": f"{first_name or ''} {last_name or ''}".strip(),
    "attributes": {
        "first_name": first_name,
        "last_name": last_name,
    },
}
```

If you need to read the XML assertion directly, use the SAML assertion namespace when searching for elements:

```python
NS_SAML_ASSERTION = "urn:oasis:names:tc:SAML:2.0:assertion"

attributes = {}
for attribute in assertion.findall(f".//{{{NS_SAML_ASSERTION}}}Attribute"):
    values = [
        value.text
        for value in attribute.findall(f"{{{NS_SAML_ASSERTION}}}AttributeValue")
    ]
    attributes[attribute.attrib["Name"]] = values[0] if len(values) == 1 else values

return {
    "email": attributes.get("email"),
}
```

---

## SCIM source

The SCIM source allows other applications to directly create users and groups within authentik. SCIM provides a predefined schema for users and groups, along with a RESTful API, to enable automatic user provisioning and deprovisioning. SCIM is supported by applications such as Microsoft Entra ID, Google Workspace, and Okta.

The base SCIM URL is in the format of `https://authentik.company/source/scim/<source-slug>/v2`. Authentication is done via Bearer tokens that are generated by authentik. When an SCIM source is created, a service account is created and a matching token is provided.

## First steps

To set up an SCIM source, log in to authentik as an administrator. Navigate to **Directory** > **Federation and Social login** and click **Create**. Select the **SCIM Source** type and give the source a name.

After the source is created, click the name of the source in the list. The page displays the **SCIM Base URL** that is used by the SCIM client. Use the **Click to copy token** button to copy the token that the client uses to authenticate SCIM requests.

## Supported options and resource types

### `/v2/Users`

Endpoint to list, create, update, and delete users.

### `/v2/Groups`

Endpoint to list, create, update, and delete groups.

There are also `/v2/ServiceProviderConfig` and `/v2/ResourceTypes`, which are used by SCIM-enabled applications to find out which features authentik supports.

## Trust model and security

The SCIM source Bearer token is a **high-trust provisioning credential**. Anyone who can use the token can manage users and groups through the SCIM endpoints for that source. Treat it like a secret with roughly the same sensitivity as an administrative provisioning integration, not like a narrowly scoped API key.

By default, authentik applies the following behavior for inbound SCIM requests:

### User and group correlation

On create and update, authentik can **correlate** SCIM resources to **existing** directory objects in the same tenant:

- **Users** are matched by `userName` across the entire tenant, not only users already linked to this SCIM source.
- **Groups** are matched by `displayName` (mapped to the group `name`) across the entire tenant, not only groups already linked to this SCIM source.

If a matching object exists, the SCIM source adopts and updates that object.

### Group membership

Group `members` operations accept **any user UUID in the tenant**. authentik does not require that member users were originally created by, or are exclusively managed by, the same SCIM source.

### Deprovisioning (DELETE)

SCIM **DELETE** on a user or group removes the **underlying authentik `User` or `Group` object**, not only the SCIM source link. This applies to correlated objects as well as objects created through SCIM.

### Default bootstrap layout

Fresh installs create a superuser group named **`authentik Admins`** (`is_superuser=true`) and an initial admin user. Because group correlation is tenant-wide, a SCIM token holder can interact with that group if they use the same `displayName`, including changing membership or deleting the group after correlating to it.

### Recommendations

- Restrict network access to SCIM endpoints where possible.
- Rotate and revoke SCIM tokens when an IdP integration is decommissioned.
- Do not share SCIM tokens across untrusted systems.

## SCIM source property mappings

See the [overview](../../property-mappings/index.mdx) for information on how property mappings work.

### Expression data

Each top-level SCIM attribute is available as a variable in the expression. For example, given a SCIM request with the payload of

<!-- prettier-ignore-start -->
```json
{
    "schemas": [
        "urn:scim:schemas:core:2.0",
        "urn:scim:schemas:extension:enterprise:2.0"
    ],
    "userName": "foo.bar",
    "name": {
        "familyName": "bar",
        "givenName": "foo",
        "formatted": "foo.bar"
    },
    "emails": [
        {
            "value": "foo.bar@authentik.company",
            "type": "work",
            "primary": true
        }
    ],
    "title": "",
    "urn:scim:schemas:extension:enterprise:2.0": {
        "department": ""
    }
}
```
<!-- prettier-ignore-end -->

The following variables are available in the expression:

- `schemas` as a list of strings
- `userName` as a string
- `name` as a dictionary
- `emails` as a dictionary
- `title` as a string
- `urn_scim_schemas_extension_enterprise_2_0` as a dictionary

    Top-level keys that include symbols not allowed in Python syntax are converted to `_`.

---

## Log in with Apple

This source lets users authenticate with their Apple ID credentials by configuring Apple as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

Apple mandates the use of a [registered top-level domain](https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains), therefore this source will not work with `.local` and other non-public TLDs.

## Apple configuration

To integrate Apple with authentik, you need to register two identifiers and a key in the Apple Developer Portal.

### Register identifiers

1. Log in to the [Apple Developer Portal](https://developer.apple.com/account/), and navigate to **Account** > **Certificates, IDs & Profiles**, then click **Identifiers** in the sidebar.
2. Register a new identifier with the type of **App IDs**, and the subtype **App**.
3. Choose a name that users will recognize for the **Description** field (e.g. `authentik`).
4. For your **Bundle ID**, use the reverse of your authentik domain, for example: `company.authentik`.
5. Scroll down the list of capabilities, and check the box next to **Sign In with Apple**.
6. At the top, click **Continue** and **Register**.

![](./app_id.png)

7. Register another new identifier with the type of **Services IDs**.
8. Again, choose the same name as above for your **Description** field.
9. Use the same identifier as above, but add a suffix like `signin` or `oauth`, as identifiers are unique.
10. At the top, click **Continue** and **Register**.

![](./service_id.png)

### Configure an identifier

11. After you return to the overview list, click the identifier that you created.
12. Enable the checkbox next to **Sign In with Apple**, and click **Configure**
13. Under **Domains and Subdomains**, enter `authentik.company`.
14. Under **Return URLs**, enter `https://authentik.company/source/oauth/callback/apple/`.

![](./app_service_config.png)

### Register a key

15. Click **Keys** in the sidebar, then register a new key with any name, and select **Sign in with Apple**.
16. Click **Configure**, then select the App ID that you created.
17. At the top, click **Save**, **Continue** and **Register**.
18. Download the Key file and note the **Key ID**.

![](./key.png)

19. Take note of the **Team ID** visible at the top of the page.

## authentik configuration

To support the integration of Apple with authentik, you need to create an Apple OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, then configure the following settings:
   - **Select type**: select **Apple OAuth Source**.
   - **Create Apple OAuth Source**: provide a name, a slug that must match the slug used in the Apple `Return URL`, and the following required configurations:
     - Under **Protocol Settings**:
       - **Consumer key**: The identifier from step 9, then `;`, then your **Team ID** from step 19, then `;`, then the **Key ID** from step 18. (e.g. `company.authentik;JQNH45HN7V;XFBNJ82BV6`).
       - **Consumer secret**: Paste the contents of the keyfile you've downloaded.
       - **Scopes** *(optional)*: define any further access scopes.

3. Click **Save**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

---

## Log in with Apereo CAS

This source lets users authenticate with their Apereo CAS credentials by configuring CAS as a federated identity provider with OpenID Connect.

authentik does not support the native CAS protocol as a source. This guide uses the OpenID Connect provider that CAS ships in its `cas-server-support-oidc` module, so your CAS deployment must include that module.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `cas.company` is the FQDN of the CAS installation.
- `cas-slug` is the slug to assign to the OAuth source in authentik (for example, `cas`).

This guide assumes CAS is served under the default `/cas` context path, so its OpenID Connect endpoints are below `https://cas.company/cas/oidc/`.

## CAS configuration

### Enable the OpenID Connect provider

Add the following to your CAS configuration, typically `/etc/cas/config/cas.properties`.

```properties title="/etc/cas/config/cas.properties"
cas.authn.oidc.core.issuer=https://cas.company/cas/oidc
# CAS generates this keystore on first start if it does not already exist.
cas.authn.oidc.jwks.file-system.jwks-file=file:/etc/cas/oidc/keystore.jwks

# Required for authentik. See the note below.
cas.authn.oauth.core.user-profile-view-type=FLAT
```

`cas.authn.oauth.core.user-profile-view-type` defaults to `NESTED`, which wraps every claim in an `attributes` object:

```json
{ "sub": "casuser", "attributes": { "email": "casuser@company", "name": "CAS User" } }
```

authentik reads claims from the top level of the user info response, so with the default it finds only `sub`, and users are enrolled with an empty email and name. Setting the value to `FLAT` emits the claims where authentik expects them.

### Release attributes to authentik

CAS only sends the claims that a service is explicitly allowed to receive, and it can only send attributes that the principal actually has. If your CAS deployment resolves users from LDAP or a database, make sure the attributes you want are resolved under the names of the OpenID Connect claims that carry them: `email` for the `email` scope, and `name` and `preferred_username` for the `profile` scope.

For a test deployment that uses the static account handler, you can define the attributes directly:

```properties title="/etc/cas/config/cas.properties"
cas.authn.attribute-repository.stub.attributes.name=CAS Demo User
cas.authn.attribute-repository.stub.attributes.preferred_username=casuser
cas.authn.attribute-repository.stub.attributes.email=casuser@company
```

### Register authentik as a relying party

Create a JSON service definition in your CAS service registry directory, typically `/etc/cas/services`. The file name must be `<name>-<id>.json` and match the `name` and `id` fields inside it.

```json title="/etc/cas/services/authentik-1001.json"
{
    "@class": "org.apereo.cas.services.OidcRegisteredService",
    "clientId": "authentik",
    "clientSecret": "<a secret you generate>",
    "serviceId": "^https://authentik\\.company/source/oauth/callback/cas-slug/?.*",
    "name": "authentik",
    "id": 1001,
    "description": "authentik OAuth source delegating authentication to CAS",
    "bypassApprovalPrompt": true,
    "scopes": ["java.util.HashSet", ["openid", "profile", "email"]],
    "supportedResponseTypes": ["java.util.HashSet", ["code"]],
    "supportedGrantTypes": ["java.util.HashSet", ["authorization_code"]],
    "attributeReleasePolicy": {
        "@class": "org.apereo.cas.services.ChainingAttributeReleasePolicy",
        "policies": [
            "java.util.ArrayList",
            [
                { "@class": "org.apereo.cas.oidc.claims.OidcProfileScopeAttributeReleasePolicy" },
                { "@class": "org.apereo.cas.oidc.claims.OidcEmailScopeAttributeReleasePolicy" }
            ]
        ]
    }
}
```

`serviceId` is a regular expression that CAS matches against the callback URL, so the dots in the hostname are escaped and the slug must match the slug you give the source in authentik. Without `attributeReleasePolicy`, CAS authenticates the user but releases no claims beyond `sub`.

Restart CAS so it picks up the configuration and the new service definition.

## authentik configuration

To support the integration of CAS with authentik, you need to create an OpenID Connect OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **OpenID Connect OAuth Source** as the source type.
   - **Create OpenID Connect OAuth Source**: provide a name, a slug that must match the slug used in the `serviceId` expression (for example, `cas`), and the following required settings:
     - Under **Protocol settings**:
       - **Consumer key**: enter the `clientId` from the CAS service definition.
       - **Consumer secret**: enter the `clientSecret` from the CAS service definition.
     - Under **URL settings**:
       - **OIDC Well-known URL**: `https://cas.company/cas/oidc/.well-known/openid-configuration`

3. Click **Finish** to save your settings.

authentik reads the authorization, token, user info, and JWKS URLs from the well-known URL, so you do not need to enter them individually.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source).

## Troubleshooting

- **Application Not Authorized to Use CAS**: CAS did not load a service definition matching the callback URL. Check that the `serviceId` expression matches `https://authentik.company/source/oauth/callback/<cas-slug>/`, that the file name matches the `name` and `id` fields, and that the JSON parses. A service file that fails to deserialize, for example because of a misspelled `@class` value, is skipped, and CAS reports this error as though the service were never registered.
- **Users are enrolled with an empty email and name**: CAS is returning nested claims. Set `cas.authn.oauth.core.user-profile-view-type` to `FLAT`.
- **Only `sub` is returned**: the service definition has no `attributeReleasePolicy`, or the principal has no attributes to release. Set `logging.level.org.apereo.cas.services=debug` in `cas.properties` and check the CAS log for the "Final collection of attributes allowed are" entry, which shows what CAS resolved and released.

## Resources

- [Apereo CAS Docs — OpenID Connect Authentication](https://apereo.github.io/cas/development/authentication/OIDC-Authentication.html)
- [Apereo CAS Docs — Attribute Release Policies](https://apereo.github.io/cas/development/integration/Attribute-Release-Policies.html)
- [Apereo CAS Docs — JSON Service Registry](https://apereo.github.io/cas/development/services/JSON-Service-Management.html)

---

## Log in with Discord

This source lets users authenticate with their Discord credentials by configuring Discord as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## Discord configuration

To integrate Discord with authentik, create an OAuth application in the Discord Developer Portal.

1. Log in to the [Discord Developer Portal](https://discord.com/developers/applications).
2. Navigate to **Applications** and click **New Application**.
3. Provide a name for the application, accept the terms, and then click **Create**.
4. Select **OAuth2** in the sidebar.
5. Under **Client Secret**, click **Reset Secret** and follow the steps.
6. Take note of the **Client ID** and **Client Secret**. They will be required in the next section.
7. Click **Add Redirect** and enter `https://authentik.company/source/oauth/callback/discord/`.

## authentik configuration

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Discord OAuth Source** as the source type.
   - **Create Discord OAuth Source**: provide a name, a slug that must match the slug used in the Discord `Redirect URI` (e.g. `discord`), and the following required configurations:
     - Under **Protocol Settings**:
       - **Consumer key**: set the Client ID from Discord.
       - **Consumer secret**: set the Client Secret from Discord.
       - **Scopes** *(optional)*: if you need authentik to sync guild membership information from Discord, add the `guilds guilds.members.read` scope.

3. Click **Save**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../add-secure-apps/flows-stages/stages/source/).

## Optional additional configuration

### Sync Discord roles and avatars to authentik

This mapping reads the user's role IDs in one Discord guild, links matching authentik groups, and stores an avatar URL. authentik reconciles source-linked group memberships after successful logins.

Before creating the mapping, add `guilds guilds.members.read` under **Protocol settings** > **Scopes** on the Discord OAuth source. For each authentik group to link, set an attribute named `discord_role_id` to its Discord role ID under **Directory** > **Groups** > **Your group** > **Attributes**. Enable Discord developer mode to copy the guild and role IDs.

1. In the authentik Admin interface, navigate to **Customization** > **Property Mappings**.
2. Click **Create**, select **OAuth Source Property Mapping**, and then click **Next**.
3. Provide a name for the mapping and enter this expression. Replace the guild ID with your own.

```python
from authentik.core.models import Group

guild_id = "123456789123456789"
guild_url = f"https://discord.com/api/v10/users/@me/guilds/{guild_id}/member"
response = client.do_request("GET", guild_url, token=token)
if response.status_code == 404:
    is_member = False
    role_ids = []
else:
    response.raise_for_status()
    is_member = True
    role_ids = response.json()["roles"]

groups = Group.objects.filter(attributes__discord_role_id__in=role_ids)
avatar_url = None
if info.get("avatar"):
    avatar_url = (
        f"https://cdn.discordapp.com/avatars/{info['id']}/{info['avatar']}.png?size=128"
    )

return {
    "name": info.get("global_name") or info.get("username"),
    "groups": list(groups.values_list("name", flat=True)),
    "attributes": {
        "discord": {
            "id": info.get("id"),
            "username": info.get("username"),
            "guild_id": guild_id,
            "is_member": is_member,
            "role_ids": role_ids,
        },
        "avatar": avatar_url,
    },
}
```

4. Click **Finish**.
5. Edit the Discord OAuth source under **Directory** > **Federation and Social login**. Set **Group matching mode** to **Link to a group with identical name**.
6. Under **OAuth Attribute mapping** > **User Property Mappings**, add the mapping to **Selected User Property Mappings**, and then click **Update**.

Only existing authentik groups with a matching `discord_role_id` are linked. Use distinct group names, because **Link to a group with identical name** can link a group created for another source. A Discord 404 result leaves the role list empty; other API errors stop the login rather than clearing membership.

To display the stored avatar, set the [avatar configuration](../../../../sys-mgmt/settings.mdx#avatars) to `attributes.avatar`.

### Check Discord guild membership

To deny login to users outside the guild, create an **Expression Policy** under **Customization** > **Policies** with this expression. It reads the result of the source property mapping above, so the policy does not call Discord again.

```python
from authentik.sources.oauth.models import OAuthSource

source = request.context.get("source")
if not isinstance(source, OAuthSource) or source.provider_type != "discord":
    return True

discord = request.context.get("prompt_data", {}).get("attributes", {}).get("discord", {})
if not discord.get("is_member"):
    ak_message("You are not a member of the required Discord guild.")
    return False
return True
```

Click **Finish**, then bind the policy to both the Discord source's enrollment and authentication flows. See [policy bindings and evaluation](../../../../customize/policies/bindings.mdx).

### Check Discord guild role membership

To require a specific Discord role, create another **Expression Policy** with this expression. Set `required_role_id` to the role ID copied from Discord.

```python
from authentik.sources.oauth.models import OAuthSource

required_role_id = "123456789123456789"
source = request.context.get("source")
if not isinstance(source, OAuthSource) or source.provider_type != "discord":
    return True

discord = request.context.get("prompt_data", {}).get("attributes", {}).get("discord", {})
if required_role_id not in discord.get("role_ids", []):
    ak_message("You do not have the required Discord role.")
    return False
return True
```

Click **Finish**, then bind the policy to both the Discord source's enrollment and authentication flows.

The mapping must be attached to the source before either policy is bound. If the mapping has not run, both policies deny Discord users because their mapped membership data is missing.

If a policy denies a returning user, the group update stage does not run. Any group membership from an earlier successful login remains until that user logs in successfully again or you remove it separately. Use the policy result, not the synchronized group, when you need to enforce current Discord membership at login.

## Resources

- [Discord Developer Documentation](https://discord.com/developers/docs/intro)
- [Discord Developer Documentation - OAuth2](https://discord.com/developers/docs/topics/oauth2#oauth2)

---

## Log in with Entra ID

There are several ways that Entra ID can be integrated with authentik to allow for user and group provisioning and authentication with Entra ID user credentials. If you are instead looking to authenticate to Entra ID with authentik credentials, refer to our [Microsoft 365 SAML](/integrations/platforms/microsoft-saml/index.mdx) or [Microsoft 365 WS-Federation](/integrations/platforms/microsoft-ws-federation/index.mdx) integrations guides.

## OAuth

The [Entra ID OAuth](./oauth/index.mdx) guide explains how to set up Entra ID as a federated OAuth identity provider for authentik.

This enables users to sign in to authentik using their Entra ID credentials. User accounts are created in authentik upon first login and updated on each subsequent login.

Alternatively, Entra ID authentication can be embedded into a flow via a [Source stage](../../../../../add-secure-apps/flows-stages/stages/source).

## SCIM

The [Entra ID SCIM](./scim/index.mdx) guide explains how you can provision users and groups from Entra ID into authentik via the SCIM protocol.

Optionally, both the OAuth and SCIM integrations can be used in conjunction so that users and groups are provisioned before a user signs in using their Entra ID credentials. This is the recommended setup for organizations with large numbers of users and groups.

---

## Log in with Facebook

This source lets users authenticate with their Facebook credentials by configuring Facebook as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## Facebook configuration

To integrate Facebook with authentik, create an OAuth application in the Meta for Developers Dashboard.

1. Log in to the [Meta for Developers Dashboard](https://developers.facebook.com/) with your Facebook account.
2. After logging in, [register as a developer](https://developers.facebook.com/async/registration). Refer to the [Facebook development documentation](https://developers.facebook.com/docs/development) for more information.

After registering, you need to create an application so that Facebook generates a unique ID for authentik.

3. On the [Meta for Developers Dashboard](https://developers.facebook.com/) click **Create**.
4. Follow the prompts to create the application.

After creating the application you need to customize its login settings.

5. On the [Meta for Developers Dashboard](https://developers.facebook.com/) click **Use Cases** in the left navigation pane.
6. Under **Authentication and account creation** click **Customize** and then **Go to settings**.
7. Set the **Valid OAuth redirect URIs** field to `https://authentik.company/source/oauth/callback/facebook/` and then click **Save**.
8. Navigate to the **Use cases** > **Customize** page.
9. Under **Permissions** click **Add** for the **email** permission.

Next, you need to obtain the **App ID** and **App Secret** for the Facebook app. These will be required when creating the source in authentik.

10. Go back to the Dashboard, and in the bottom-left of the navigation pane, click **App settings** > **Basic**.
11. Take note of the **App ID** and the **App secret** values.

Finally, you need to publish the Facebook app.

12. Go back to the Dashboard, and on the **Create and publish this app** page, follow the prompts to complete the process.

## authentik configuration

To support the integration of Facebook with authentik, you need to create a Facebook OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Facebook OAuth Source** as the source type.
   - **Create Facebook OAuth Source**: provide a name, a slug that must match the slug used in the Facebook `Valid OAuth redirect URIs` field (e.g. `facebook`), and the following required configurations:
     - **Protocol settings**
       - **Consumer key**: enter the **App ID** from Facebook.
       - **Consumer secret**: enter the **App Secret** from Facebook.
       - **Scopes** *(optional)*: define any further access scopes.
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [Meta for Developers Documentation - Facebook Login Overview](https://developers.facebook.com/docs/facebook-login/overview)

---

## Log in with GitHub

This source lets users authenticate with their GitHub credentials by configuring GitHub as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `www.my.company` is the Homepage URL for your site

## GitHub configuration

To integrate GitHub with authentik, you need to create an OAuth application in GitHub Developer Settings.

1. Log in to GitHub and open the [Developer Settings](https://github.com/settings/developers) menu.

2. Create an OAuth app by clicking on the **Register a new application** button and set the following values:
   - **Application Name**: `authentik`
   - **Homepage URL**: `www.my.company`
   - **Authorization callback URL**: `https://authentik.company/source/oauth/callback/github`

3. Click **Register Application**

4. Click **Generate a new client secret** and take note of the **Client Secret** and **Client ID**. These values will be required in the next section.

## authentik configuration

To support the integration of GitHub with authentik, you need to create a GitHub OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **GitHub OAuth Source** as the source type.
   - **Create GitHub OAuth Source**: provide a name, a slug that must match the slug used in the GitHub `Authorization callback URL` field (e.g. `github`), and set the following required configurations:
     - **Protocol settings**
       - **Consumer key**: `<client_ID>`
       - **Consumer secret**: `<client_secret>`
       - **Scopes** *(optional)*: define any further access scopes.
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../add-secure-apps/flows-stages/stages/source/).

## Optional additional configuration

### Check for membership of a GitHub organization

GitHub's profile response does not contain organization membership. A source property mapping can use the OAuth client and token to query the membership API. The mapping below records whether the user is an active member and synchronizes a source-linked authentik group for active members.

1. Edit the GitHub OAuth source under **Directory** > **Federation and Social login**. Add `read:org` under **Protocol settings** > **Scopes**, and then click **Update**.
2. Navigate to **Customization** > **Property Mappings**. Click **Create**, select **OAuth Source Property Mapping**, and then click **Next**.
3. Provide a name and enter this expression. Replace `your_organization` with the GitHub organization login.

```python
organization = "your_organization"
response = client.do_request(
    "GET",
    f"https://api.github.com/user/memberships/orgs/{organization}",
    token=token,
)
if response.status_code == 404:
    active = False
else:
    response.raise_for_status()
    active = response.json().get("state") == "active"

return {
    "attributes": {"github_org_membership": {"organization": organization, "active": active}},
    "groups": [f"github:{organization}"] if active else [],
}
```

4. Click **Finish**. Edit the GitHub OAuth source again and add the mapping under **OAuth Attribute mapping** > **User Property Mappings** > **Selected User Property Mappings**. Click **Update**.

authentik creates the `github:<organization>` group using the source's default group matching mode. It reconciles source-linked membership after successful logins. If the GitHub API returns an error other than 404, the mapping stops the login rather than treating an API failure as a membership denial.

To deny login to users outside the organization, create an **Expression Policy** with this expression and bind it to both the source's enrollment and authentication flows:

```python
from authentik.sources.oauth.models import OAuthSource

source = request.context.get("source")
if not isinstance(source, OAuthSource) or source.provider_type != "github":
    return True

membership = request.context.get("prompt_data", {}).get("attributes", {}).get(
    "github_org_membership", {}
)
if not membership.get("active"):
    ak_message("You are not an active member of the required GitHub organization.")
    return False
return True
```

The policy reads the property mapping's result from the flow's `prompt_data`. Binding it to both flows covers new and returning users. See [policy bindings and evaluation](../../../../customize/policies/bindings.mdx) for binding instructions.

If the policy denies a returning user, the group update stage does not run. Any group membership from an earlier successful login remains until that user logs in successfully again or you remove it separately. Use the policy result, not the synchronized group, when you need to enforce current organization membership at login.

## Source property mappings

The organization example above uses an OAuth source property mapping to query GitHub. See the [source property mappings overview](../../property-mappings/index.mdx) and [OAuth expression data](../../protocols/oauth/index.mdx#expression-data) for other fields and client methods.

## Resources

---

## Log in with GitLab

This source lets users authenticate with their GitLab credentials by configuring GitLab as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `gitlab.company` is the FQDN of the GitLab installation. Use `gitlab.com` for GitLab SaaS.

## GitLab configuration

To integrate GitLab with authentik, you need to create an OAuth application in GitLab.

1. Log in to GitLab and navigate to the application settings:
   - For a user-owned application, select your avatar, click **Edit profile**, and then navigate to **Access** > **Applications**.
   - For a group-owned application, navigate to the group and then click **Settings** > **Applications**.
   - For an instance-wide application, navigate to **Admin** > **Applications**.

2. Click **Add new application** or **New application** and set the following values:
   - **Name**: `authentik`
   - **Redirect URI**: `https://authentik.company/source/oauth/callback/gitlab/`
   - **Scopes**: select all four of the following:
     - `read_user`
     - `openid`
     - `profile`
     - `email`

3. Click **Save application** and take note of the **Application ID** and **Secret**. These values are required in the next section.

## authentik configuration

To support the integration of GitLab with authentik, you need to create a GitLab OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **GitLab OAuth Source** as the source type.
   - **Create GitLab OAuth Source**: provide a name, a slug that must match the slug used in the GitLab **Redirect URI** field (e.g. `gitlab`), and set the following required configurations:
     - Under **Protocol settings**:
       - **Consumer key**: set the **Application ID** from GitLab.
       - **Consumer secret**: set the **Secret** from GitLab.
     - Under **URL settings** *(self-hosted GitLab instances only)*:
       - **Authorization URL**: `https://gitlab.company/oauth/authorize`
       - **Access token URL**: `https://gitlab.company/oauth/token`
       - **Profile URL**: `https://gitlab.company/oauth/userinfo`
       - **OIDC Well-known URL**: `https://gitlab.company/.well-known/openid-configuration`
       - **OIDC JWKS URL**: `https://gitlab.company/oauth/discovery/keys`
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [GitLab Docs - Configure GitLab as an OAuth 2.0 authentication identity provider](https://docs.gitlab.com/integration/oauth_provider/)

---

## Google identity providers

There are several ways that Google services can be integrated with authentik to allow for authentication with Google user credentials.

authentik can also be configured to authenticate users to Google services.

For more information, see the [Google Workspace Integration](/integrations/cloud-providers/google/) guide.

## Google Cloud (OAuth)

Google Cloud Identity Platform provides OAuth 2.0 as a federated identity provider. This configuration guide shows how to set up OAuth 2.0 as the authentication method between Google and authentik.

[Configure Google Cloud with authentik](./cloud/index.mdx)

## Google Workspace (SAML)

Google Workspace (formerly G Suite) allows users to authenticate to applications using their company email addresses. This configuration guide shows how to set up Security Assertion Markup Language (SAML) as the authentication method between Google Workspace and authentik.

[Configure Google Workspace with authentik](./workspace/index.mdx)

---

## Log in with JumpCloud

This source lets users authenticate with their [JumpCloud](https://jumpcloud.com/) credentials by configuring JumpCloud as a federated identity provider using SAML or OpenID Connect (OIDC).

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `jumpcloud-slug` is the slug to assign to the source in authentik (for example, `jumpcloud`).

## Configuration methods

You can integrate JumpCloud with authentik using either SAML or OpenID Connect (OIDC). Select a tab below for the corresponding instructions.

## SAML

### JumpCloud configuration

To integrate JumpCloud with authentik, create a custom SAML application in the JumpCloud Admin Portal.

1. Log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com/) as an administrator.

2. Navigate to **Access** > **SSO Applications** and click **Add New Application**.

3. Select **Custom Application** and click **Next**.

4. Under **Manage Single Sign-On (SSO)**, select **Configure SSO with SAML**, then click **Next**.

5. Set the **Display Label** to `authentik` and click **Save Application**, then click **Configure Application**.

6. On the **SSO** tab, configure the following settings:
   - **SP Entity ID**: `https://authentik.company/source/saml/jumpcloud/metadata/`
   - **ACS URL**: `https://authentik.company/source/saml/jumpcloud/acs/`
   - **SAMLSubject NameID**: `email`
   - **SAMLSubject NameID Format**: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`

7. Open the application's **User Groups** tab, check the **All Users** group.

8. Click **Save** in the bottom right to create the application.

9. On the **SSO** tab, note the **IDP URL** (`https://sso.jumpcloud.com/saml2/authentik`) and the SAML **Metadata URL** (`https://sso.jumpcloud.com/saml2/metadata/authentik`). Both are used in the next section.

### authentik configuration

To support the integration of JumpCloud with authentik, you need to import the JumpCloud signing certificate and create a JumpCloud SAML source in authentik.

#### Import the JumpCloud certificate

JumpCloud does not offer a direct certificate download; the signing certificate is embedded in the application's SAML metadata. You need to extract it and wrap it in PEM markers before importing it into authentik.

1. Open the JumpCloud SAML **Metadata URL** (`https://sso.jumpcloud.com/saml2/metadata/authentik`) in a browser.

2. Locate the `<X509Certificate>` element inside the `<md:KeyDescriptor use="signing">` block and copy its contents (the value between the opening and closing tags).

3. Log in to authentik as an administrator and open the authentik Admin interface.

4. Navigate to **System** > **Certificates** and click **Create**.

5. Provide a name (for example, `JumpCloud SAML`) and paste the copied value into the **Certificate** field, manually adding the PEM header and footer lines so that it matches the following format:

   ```
   -----BEGIN CERTIFICATE-----
   <X509Certificate content copied from the JumpCloud metadata>
   -----END CERTIFICATE-----
   ```

6. Leave the **Private Key** field empty and click **Create**.

#### Create a SAML source in authentik

1. Navigate to **Directory** > **Federation and Social login** and click **New Source**.

2. Select **SAML Source** and configure the following settings:

   - Set **Name** to `jumpcloud`.
   - Set **Slug** to `jumpcloud` (this must match the `<jumpcloud-slug>` used in the SP Entity ID and ACS URL above).
   - Set **SSO URL** to `https://sso.jumpcloud.com/saml2/authentik`.
   - Set **Binding Type** to `Post-auto Binding`.
   - Set **Verification Certificate** to the `JumpCloud SAML` certificate imported above, so authentik validates the signature on incoming responses.
   - Uncheck **Verify Assertion Signature**.
   - Check **Verify Response Signature**.

   JumpCloud signs the SAML response rather than the individual assertion, so these two options must be inverted from their defaults. If they are left at their defaults, signature verification fails.

3. Click **Finish**.

## OIDC

### JumpCloud configuration

To integrate JumpCloud with authentik, create a custom OIDC application in the JumpCloud Admin Portal.

1. Log in to the [JumpCloud Admin Portal](https://console.jumpcloud.com/) as an administrator.

2. Navigate to **Access** > **SSO Applications** and click **Add New Application**.

3. Select **Custom Application** and click **Next**.

4. Under **Manage Single Sign-On (SSO)**, select **Configure SSO with OIDC**, then click **Next**.

5. Set the **Display Label** to `authentik` and click **Save Application**, then click **Configure Application**.

6. On the **SSO** tab, configure the following settings:
   - **Redirect URIs**: `https://authentik.company/source/oauth/callback/jumpcloud/`
   - **Client Authentication Type**: `Client Secret Basic`
   - **Grant Types**: leave **Authorization Code** selected (the default).
   - Under **Attribute Mapping**, enable the `email` and `profile` scopes so those claims are returned.

7. Open the application's **User Groups** tab, check the **All Users** group.

8. Click **Save** in the bottom right to create the application.

9. After saving, JumpCloud will display a popup with the **Client ID** and **Client Secret**. Both are required in the next section.

### authentik configuration

To support the integration of JumpCloud with authentik, create a JumpCloud OpenID Connect source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login** and click **New Source**.

3. Select **OpenID Connect OAuth Source** and configure the following settings:

   - Set **Name** to `jumpcloud`.
   - Set **Slug** to `jumpcloud` (this must match the `<jumpcloud-slug>` used in the redirect URI above).
   - Under **Protocol settings**:
     - Set **Consumer key** to the **Client ID** from JumpCloud.
     - Set **Consumer secret** to the **Client Secret** from JumpCloud.
   - Under **URL settings**:
     - Set **Authorization URL** to `https://oauth.id.jumpcloud.com/oauth2/auth`.
     - Set **Access token URL** to `https://oauth.id.jumpcloud.com/oauth2/token`.
     - Set **Profile URL** to `https://oauth.id.jumpcloud.com/userinfo`.
     - Set **OIDC Well-known URL** to `https://oauth.id.jumpcloud.com/.well-known/openid-configuration`.
     - Set **OIDC JWKS URL** to `https://oauth.id.jumpcloud.com/.well-known/jwks.json`.

   The URLs above are for the US region. For the EU or IN regions, replace `oauth.id.jumpcloud.com` with `oauth.id.eu.jumpcloud.com` or `oauth.id.in.jumpcloud.com`.

4. Click **Finish**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [JumpCloud - Get Started: SSO Applications](https://jumpcloud.com/support/get-started-applications-sso)

---

## Log in with Keycloak

This source lets users authenticate with their Keycloak credentials by configuring Keycloak as a federated identity provider with SAML.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `keycloak.company` is the FQDN of the Keycloak installation.
- `keycloak-slug` is the slug to assign to the SAML source in authentik (for example, `keycloak`).

## Export certificates

Before configuring either service, you need to export the signing certificates from both Keycloak and authentik. Each service needs the other's public certificate to verify signatures and handle SAML encryption.

### Export the Keycloak signing certificate

1. Log in to Keycloak as an administrator.
2. Navigate to **Realm settings** > **Keys**.
3. Find the RSA key with **Use** set to `SIG`.
4. Click **Certificate** to copy the certificate value.
5. Save the certificate in the following format:

```
-----BEGIN CERTIFICATE-----
<Copied Keycloak Public Key Certificate Content>
-----END CERTIFICATE-----
```

### Export the authentik signing certificate

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **System** > **Certificates**.
3. Click the certificate you plan on using for signing (e.g., the default `authentik Self-signed Certificate`).
4. Click **Download Certificate**.

## Keycloak configuration

### Create a SAML client in Keycloak

1. Log in to Keycloak as an administrator.
2. Navigate to **Clients** and click **Create client**.
3. Configure the client with the following settings:
   - Set **Client type** to `SAML`.
   - Set **Client ID** to `https://authentik.company/source/saml/<keycloak-slug>/metadata/`.
4. Click **Next**.
5. Configure the following settings:
   - Set **Valid redirect URIs** to `https://authentik.company/source/saml/<keycloak-slug>/acs/`.
   - Set **Master SAML Processing URL** to `https://authentik.company/source/saml/<keycloak-slug>/acs/`.
   - Set **Root URL** to `https://authentik.company`.
6. Click **Save**.

### Configure signing and encryption

1. Navigate to the **Settings** tab and scroll to **Signature and Encryption**.
2. Configure the following settings:
   - Enable **Sign documents**.
   - Enable **Sign assertions**.
   - Enable **Encrypt assertions**.

### Upload the authentik certificate to Keycloak

1. In the Keycloak Admin console, navigate to **Clients** and click the SAML client you created earlier.
2. Navigate to the **Keys** tab.
3. Configure the following settings:
   - Enable **Client signature required**.
   - Click **Import** and upload the authentik certificate you exported earlier. This allows Keycloak to verify signatures on requests from authentik.
   - Enable **Encrypt assertions**.
   - Click **Import** under the encryption key and upload the authentik certificate.

## authentik configuration

### Upload the Keycloak certificate to authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **System** > **Certificates** and click **Import**.
3. Give it a name like `Keycloak Signing Certificate`.
4. Paste the Keycloak certificate you exported earlier into the **Certificate** field.
5. Leave the **Private Key** field empty.
6. Click **Create**.

### Create a SAML source in authentik

1. Navigate to **Directory** > **Federation and Social login** and click **New Source**.
2. Select **SAML Source** and configure the following settings:
   - Set **Name** to `Keycloak`.
   - Set **Slug** to `keycloak`.
   - Set **SSO URL** to `https://keycloak.company/realms/<realm-name>/protocol/saml`.
   - Set **SLO URL** to `https://keycloak.company/realms/<realm-name>/protocol/saml`.
   - Set **Issuer override** to `https://authentik.company/source/saml/<keycloak-slug>/metadata/` (optional; the source defaults to this value).
   - Set **Service Provider Binding** to `Post (Auto-Submit)`.
   - Set **Signing keypair** to an authentik certificate (e.g., the default `authentik Self-signed Certificate`).
   - Set **Verification Certificate** to the Keycloak certificate you uploaded earlier.
   - Enable **Verify Assertion Signature**.
   - Enable **Verify Response Signature**.
   - Set **Encryption Certificate** to an authentik certificate (e.g., the default `authentik Self-signed Certificate`).
3. Click **Finish**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source).

## Troubleshooting

- **Signature verification failed**: Ensure the correct certificates are configured on both sides. Each side needs the other's signing certificate for verification.
- **Encryption errors**: Ensure the encrypting party has the other party's public certificate, and the decrypting party has their own private key.

## Resources

- [Keycloak Docs — Creating a SAML Client](https://www.keycloak.org/docs/latest/server_admin/index.html#_client-saml-configuration)
- [Keycloak Docs — Configuring Realms](https://www.keycloak.org/docs/latest/server_admin/index.html#_configuring-realms)

---

## Log in with Mailcow

This source lets users authenticate with their Mailcow credentials by configuring Mailcow as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `mailcow.company` is the FQDN of the Mailcow installation.

## Mailcow configuration

To integrate Mailcow with authentik, create an OAuth application in Mailcow.

1. Log in to Mailcow as an administrator.
2. Navigate to **System** > **Configuration**, and then **Access** > **OAuth2 Apps**.
3. Click **Add OAuth2 client** and provide the **Redirect URI**: `https://authentik.company/source/oauth/callback/mailcow/`
4. Take note of the **Client ID** and **Client Secret**. These values will be required in the next section.

## authentik configuration

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **OAuth Source** as the source type.
   - **Create OAuth Source**: provide a name, a slug that must match the slug used in the Mailcow `Redirect URI` field (e.g. `mailcow`), and set the following required configurations:
     - **Protocol settings**
       - **Consumer key**: `<client_ID>`
       - **Consumer secret**: `<client_secret>`
       - **Scopes** *(optional)*: define any further access scopes.
     - **URL settings**
       - **Authorization URL**: `https://mailcow.company/oauth/authorize`
       - **Access token URL**: `https://mailcow.company/oauth/token`
       - **Profile URL**: `https://mailcow.company/oauth/profile`
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

---

## Log in with Okta

This source lets users authenticate with their Okta credentials by configuring Okta as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `company.okta.com` is the FQDN of your Okta tenant.

## Okta configuration

To integrate Okta with authentik, create an app integration in the Okta Admin Console.

1. Log in to the Okta Admin Console as an administrator.
2. Navigate to **Applications** > **Applications** > **Add App Integration**.
3. Select **OIDC - OpenID Connect**, set **Application Type** to **Web Application**, and then click **Next**.
4. Configure the following required settings:
   - **App Integration Name**: `authentik`
   - **Sign-in redirect URIs**: `https://authentik.company/source/oauth/callback/<source_slug>/`
   - Under **Assignments**, select how you'd like to control access to authentik. **Allow everyone in your organization to access** or select a group to limit access.
5. Click **Save**.
6. Under **Client Credentials**, take note of the **Client ID**. This value will be required in the next section.
7. Under **CLIENT SECRETS**, click the **Copy to clipboard** next to the secret and take note of the value, it will also be required in the next section.

## authentik configuration

To support the integration of Okta with authentik, you need to create an Okta OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Okta OAuth Source** as the source type.
   - **Create Okta OAuth Source**: provide a name, a slug that must match the slug used in the Okta Sign-in redirect URI field (e.g. `okta`), and the following required settings:
     - Under **Protocol settings**:
       - **Consumer key**: paste the **Client ID** from Okta
       - **Consumer secret**: paste the **Secret** from Okta
     - Under **URL settings**:
       - **Authorization URL**: `https://company.okta.com/oauth2/v1/authorize`
       - **Access token URL**: `https://company.okta.com/oauth2/v1/token`
       - **Profile URL**: `https://company.okta.com/oauth2/v1/userinfo`
       - **OIDC Well-known URL**: `https://company.okta.com/.well-known/openid-configuration`
       - **OIDC JWKS URL**: `https://company.okta.com/oauth2/v1/keys`

3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [Okta Developer Documentation - Create an app integration](https://developer.okta.com/docs/guides/create-an-app-integration/openidconnect/main/)

---

## Log in with Plex

This source lets users authenticate with their Plex credentials by configuring Plex as a federated identity provider.

## Preparation

No additional preparation is required.

## authentik configuration

To support the integration of Plex with authentik, you need to create a Plex source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Plex Source** as the source type.
   - **Create Plex Source**: provide a name, a slug, and set the following required configurations:
     - **Icon**: Optional icon or image shown for the source. See [File picker values](../../../../customize/file-picker.mdx).
     - **Protocol settings**
       - **Client ID**: Set a unique Client ID or leave the generated ID
         - Click **Load servers** to log in to Plex and pick the authorized Plex servers for "allowed users".
         - Decide if *anyone* with a Plex account can authenticate or only friends you share access with.
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

---

## Log in with Shibboleth

This source lets users authenticate with their [Shibboleth](https://www.shibboleth.net/about-us/the-shibboleth-project/) credentials by configuring Shibboleth as a federated identity provider with SAML.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `shibboleth.company` is the FQDN of the Shibboleth IdP installation.
- `shibboleth-slug` is the slug to assign to the SAML source in authentik (for example, `shibboleth`).

## authentik configuration

To integrate Shibboleth with authentik, create a SAML source in authentik.

### Create a SAML source in authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login** and click **New Source**.

3. Select **SAML Source** and configure the following settings:
   - Set **Name** to `Shibboleth`.

   - Set **Slug** to `shibboleth` (this sets the slug used in Shibboleth's metadata URL).

   - Set **SSO URL** to `https://shibboleth.company/idp/profile/SAML2/Redirect/SSO`.

   - Set **Binding Type** to `Redirect`.

   - Set **Issuer override** to `https://authentik.company/source/saml/<shibboleth-slug>/metadata/` (optional; the source defaults to this value).

   - Set **NameID Policy** to `Transient`.
     Shibboleth supports the **Transient** NameID by default. With this format, authentik creates a temporary account and deletes it when the user logs out of authentik. If the user does not log out, periodic cleanup deletes the account after it expires, even if its session is still active. **Delete temporary users after** sets the lifetime from account creation and defaults to `days=1`.

     For users who need to keep the same authentik account across logins, configure Shibboleth to issue persistent NameIDs and select **Persistent** instead. Changing only authentik's policy does not override the NameID format sent by Shibboleth. See [Transient users and account lifetime](../../protocols/saml/index.mdx#transient-users-and-account-lifetime) for details.

   - Set **Signing keypair** to an authentik certificate (e.g., the default `authentik Self-signed Certificate`).

   - Set **Encryption Certificate** to an authentik certificate (e.g., the default `authentik Self-signed Certificate`).

4. Click **Finish**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source).

## Shibboleth configuration

To integrate Shibboleth with authentik, add authentik as a service provider in your Shibboleth IdP.

### Add authentik as a service provider

1. Edit `/opt/shibboleth-idp/conf/metadata-providers.xml` on the Shibboleth IdP server.
2. Add the following `MetadataProvider` element before the final closing tag of the existing `MetadataProvider` block:

```xml
<MetadataProvider id="Authentik"
                  xsi:type="FileBackedHTTPMetadataProvider"
                  backingFile="%{idp.home}/metadata/authentik-metadata.xml"
                  metadataURL="https://authentik.company/source/saml/<shibboleth-slug>/metadata/" />
```

3. Restart the Shibboleth IdP to apply the changes.

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [Shibboleth IdP Documentation](https://shibboleth.atlassian.net/wiki/spaces/IDP5/overview)

---

## Log in with Telegram

This source lets users authenticate with their Telegram account credentials.

## Preparation

Using Telegram as a source requires that your authentik instance is served from a domain.

## Telegram configuration

To use Telegram as a source, you first need to register a Telegram bot:

1. Start a chat with `@BotFather` on Telegram.
2. Use the `/newbot` command to create a new bot. Define a name and username for your new bot (e.g., `authentik_bot`).
3. BotFather will provide you with a token for the new bot. Take note of the username and token because they will be required when setting up the source in authentik.
4. Link the bot to your authentik domain name using the `/setdomain` command.

The domain name set in Telegram must **exactly** match the FQDN of the authentik installation.

After the bot is configured, create a source in authentik.

## authentik configuration

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Telegram** as the source type.
   - **Create Telegram Source**: provide a name, a slug, and the following required configurations:
     - **Bot username**: The username of your Telegram bot (e.g., `authentik_bot`).
     - **Bot token**: The token of your Telegram bot.
     - **Request access to send messages from your bot**: enable this to allow your bot to send messages to authentik users utilizing the Telegram source for authentication.

3. Click **Save**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

## Telegram source property mappings

[Property mappings](../../property-mappings/index.mdx) can be used to map Telegram user properties to authentik user properties.

### Expression data

Telegram user data is accessible to Telegram source property mappings as a dictionary named `info`.
The dictionary contains the following fields:

- `id`: Telegram user ID.
- `username`: Username of the user. Might not be present.
- `first_name`: First name of the user. Might not be present.
- `last_name`: Last name of the user. Might not be present.
- `photo_url`: URL of the user's profile photo. Might not be present.

## Resources

- [Telegram Documentation - BotFather](https://core.telegram.org/bots/features#botfather)

---

## Log in with Twitch

This source lets users authenticate with their Twitch credentials by configuring Twitch as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## Twitch configuration

To integrate Twitch with authentik, create an OAuth application in the Twitch Developers Console.

1. Log in to the [Twitch Developers Console](https://dev.twitch.tv/console).

2. Next to **Applications** click **Register Your Application** and set the following fields:
   - **Name**: `authentik`
   - **OAuth Redirect URLs**: `https://authentik.company/source/oauth/callback/twitch`
   - **Category**: select a category for your application

3. Click **Create** to finish the registration of your application.

4. Next to your newly created application, click **Manage**.

5. Generate a secret by clicking **New Secret**.

6. Take note of the **Client ID** and **Client Secret**. This value will be required in the next section.

7. Click **Save**.

## authentik configuration

To support the integration of Twitch with authentik, create a Twitch OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Twitch OAuth Source** as the source type.
   - **Create OAuth Source**: provide a name, a slug that must match the slug used in the Twitch `OAuth Redirect URLs` field (e.g. `twitch`), and set the following required configurations:
     - **Protocol settings**
       - **Consumer key**: `<client_ID>`
       - **Consumer secret**: `<client_secret>`
       - **Scopes** *(optional)*: define any further access scopes.
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [Twitch Developer Documentation](https://dev.twitch.tv/docs)

---

## Log in with X (formerly Twitter)

This source lets users authenticate with their X credentials by configuring X as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## X configuration

To integrate X with authentik, create an OAuth application in the X Developer Portal.

1. Log in to the [X Developer Portal](https://developer.twitter.com/).

2. Navigate to **Projects & Apps** > **Overview**.

3. Click the **App Settings** icon (cogwheel) next to the Project App that you want to use. For information on creating a new Project App, refer to the [X Developer Documentation](https://docs.x.com/fundamentals/developer-apps#app-management).

4. Under **User authentication settings**, click **Set up** and set the following required fields:
   - **App permissions**: `Read`
   - **Type of App**: `Web App, Automated App or Bot`
   - **Callback URI / Redirect URL**: `https://authentik.company/source/oauth/callback/x/`
   - **Website URL**: `https://authentik.company`

5. Click **Save**.

6. Take note of the **Client ID** and **Client Secret**. These values will be required in the next section.

7. Click **Done**.

## authentik configuration

To support the integration of X with authentik, you need to create a Twitter OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Twitter OAuth Source** as the source type.
   - **Create OAuth Source**: provide a name, a slug that must match the slug used in the X `Callback URI / Redirect URL` field (e.g. `x`), and set the following required configurations:
     - **Protocol settings**
       - **Consumer key**: Enter the Client ID from the X Developer Portal.
       - **Consumer secret**: Enter the Client Secret from the X Developer Portal.
       - **Scopes** *(optional)*: define any further access scopes.
3. Click **Finish**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

## Resources

- [X Developer Portal Documentation](https://docs.x.com/fundamentals/developer-portal)
- [X Developer Documentation - App Management](https://docs.x.com/fundamentals/developer-apps#app-management)

---

## Log in with WeChat

This source lets users authenticate with their WeChat credentials by configuring WeChat as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## WeChat configuration

To integrate WeChat with authentik, register a "Website Application" (网站应用) on the [WeChat Open Platform](https://open.weixin.qq.com/).

1. Register for a developer account on the [WeChat Open Platform](https://open.weixin.qq.com/).
2. Navigate to the **Management Center** (管理中心) > **Website Application** (网站应用) and click **Create Website Application** (创建网站应用).
3. Submit the application for review.
4. After approval, WeChat provides an **AppID** and **AppSecret**.
5. In the WeChat application settings, configure the **Authorized Callback Domain** (授权回调域) to match your authentik domain (e.g. `authentik.company`).

This integration uses the WeChat "Website Application" login flow (QR Code login). When users access the login page on a desktop device (Windows/Mac) with the WeChat client installed, they may see a "Fast Login" prompt.

## authentik configuration

To support the integration of WeChat with authentik, you need to create a WeChat OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **WeChat OAuth Source** as the source type.
   - **Create OAuth Source**: provide a name, a slug (e.g. `wechat`), and set the following required configurations:
     - **Protocol settings**
       - **Consumer key**: Enter the **AppID** from the WeChat Open Platform.
       - **Consumer secret**: Enter the **AppSecret** from the WeChat Open Platform.
       - **Scopes**: define any further access scopes.
3. Click **Finish**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the [overview](../../property-mappings/index.mdx) for more information.

The following data is retrieved from WeChat and mapped to the user's attributes in authentik:

| WeChat Field            | authentik Attribute     | Description                     |
| :---------------------- | :---------------------- | :------------------------------ |
| `unionid` (or `openid`) | `username`              | Used as the primary identifier. |
| `nickname`              | `name`                  | The user's display name.        |
| `headimgurl`            | `attributes.headimgurl` | URL to the user's avatar.       |
| `sex`                   | `attributes.sex`        | Gender (1=Male, 2=Female).      |
| `city`                  | `attributes.city`       | User's city.                    |
| `province`              | `attributes.province`   | User's province.                |
| `country`               | `attributes.country`    | User's country.                 |

### User matching

WeChat users are identified by their `unionid` (if available) or `openid`.

- **UnionID**: Unique across multiple applications under the same developer account. authentik prioritizes this as the username.
- **OpenID**: Unique to the specific application. Used as a fallback if `unionid` is not returned.

WeChat does not provide the user's email address via the API.

## Resources

- [WeChat Open Platform](https://open.weixin.qq.com/)
- [WeChat Login document](https://developers.weixin.qq.com/doc/oplatform/Website_App/WeChat_Login/Wechat_Login.html)

---

## Entra ID OAuth authentication

This source lets users authenticate to authentik with their Entra ID credentials by configuring Entra ID as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## Entra ID configuration

To integrate Entra ID with authentik, you need to create an app registration in the Entra ID portal.

1. Log in to [Entra ID](https://entra.microsoft.com) using a [global administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator) account.

2. Navigate to **Applications** > **App registrations**.

3. Click **New registration** and set the following required configurations:
   - **Name**: provide a descriptive name (e.g. `authentik`).
   - Under **Supported account types**: select the account type that applies to your use case (e.g. `Accounts in this organizational directory only (Default Directory only - Single tenant)`).
   - Under **Redirect URI**:
     - **Platform**: `Web`
     - **URI**: `https://authentik.company/source/oauth/callback/entra-id/`

4. Click **Register**. When registration is complete, the **Overview** tab of the newly created app registration opens. Take note of the `Application (client) ID`. If you selected `Accounts in this organizational directory only (Default Directory only - Single tenant)` as the **Supported account types**, also note the `Directory (tenant) ID`. These values will be needed later when configuring authentik.

5. In the leftmost sidebar, navigate to **Certificates & secrets**.

6. Select the **Client secrets** tab and click **New Secret**. Configure the following required settings:
   - **Description**: provide a description for the secret (e.g. `authentik secret`).
   - **Expires**: choose an expiration period. As authentik does not yet support automatic secret rotation, either manual rotation or API-based updates are required. As a result, a duration of at least 12 months is recommended.

7. Copy the secret's value from the **Value** column.

The secret value is only displayed once at the time of creation. Make sure to copy and store it securely, as it cannot be retrieved later.

8. In the sidebar, navigate to **API Permissions**, then click **Add a permission** and select **Microsoft Graph** as the API.
9. Select **Delegated permissions** as the permission type and assign the following permissions:
   - Under **OpenID Permissions**: select `email`, `profile`, and `openid`.
   - Under **User**: select `User.Read`.
   - Under **Group Member** *(optional)*: if you need authentik to sync group membership information from Entra ID, select the `GroupMember.Read.All` permission.
10. Click **Add permissions**.
11. Under **Configured permissions**, click **Grant admin consent for default directory**.

## authentik configuration

To support the integration of Entra ID with authentik, you need to create an Entra ID OAuth source in authentik.

### Create Entra ID OAuth source

1. Log in to authentik as an administrator and open the authentik Admin interface.

2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Entra ID OAuth Source** as the source type.
   - **Create Entra ID OAuth Source**: provide a name, a slug that must match the slug used in the Entra ID `Redirect URI`, and the following required configurations:
     - Under **Protocol Settings**:
       - **Consumer key**: `Application (client) ID` from Entra ID.
       - **Consumer secret**: value of the secret created in Entra ID.
       - **Scopes** *(optional)*: if you need authentik to sync group membership information from Entra ID, add the `https://graph.microsoft.com/GroupMember.Read.All` scope.
     - Under **URL settings**:
       - For **Single tenant** Entra ID applications:
         - **Authorization URL**: `https://login.microsoftonline.com/<directory_(tenant)_id>/oauth2/v2.0/authorize`
         - **Access token URL**: `https://login.microsoftonline.com/<directory_(tenant)_id>/oauth2/v2.0/token`
         - **Profile URL**: `https://graph.microsoft.com/v1.0/me`
         - **OIDC JWKS URL**: `https://login.microsoftonline.com/<directory_(tenant)_id>/discovery/v2.0/keys`
       - For **Multi tenant** Entra ID applications:
         - **Authorization URL**: `https://login.microsoftonline.com/common/oauth2/v2.0/authorize`
         - **Access token URL**: `https://login.microsoftonline.com/common/oauth2/v2.0/token`
         - **Profile URL**: `https://graph.microsoft.com/v1.0/me`
         - **OIDC JWKS URL**: `https://login.microsoftonline.com/common/discovery/v2.0/keys`

3. Click **Save**.

When syncing group memberships from Entra ID, authentik creates all groups the user belongs to by based on the Microsoft Graph `/me/memberOf` response. The sync runs on each user login, which can cause login delays for organizations with many groups.

For organizations with larger numbers of users and groups, we recommend using the [Entra ID SCIM integration](../scim/) to provision users and groups. These users are then automatically linked to matching users logging in via this Entra ID OAuth source.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

### Machine-to-machine authentication

If using [Machine-to-Machine](../../../../../add-secure-apps/providers/oauth2/machine_to_machine.mdx#jwt-authentication) authentication, some specific steps need to be considered.

When getting the JWT token from Entra ID, set the scope to the **Application ID URI**, and *not* the Graph URL; otherwise the JWT will be in an invalid format.

```http
POST /<entra_tenant_id>/oauth2/v2.0/token/ HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=<application_client_id>&
scope=api://<application_client_id>/.default&
client_secret=<application_client_secret>
```

The JWT returned from the request above can be used in authentik and exchanged for an [authentik JWT](../../../../../add-secure-apps/providers/oauth2/machine_to_machine.mdx#authentik-issued-jwts).

## Source property mappings

The Entra ID OAuth source already maps the Microsoft Graph `/me` response to the user's username, email, and name. If you enable the `GroupMember.Read.All` permission and scope above, it also retrieves the user's direct group memberships from `/me/memberOf` and synchronizes those groups on login. You do not need a custom mapping for these fields.

Use an OAuth source property mapping for additional fields in the profile response. For example, this user mapping stores the Graph `jobTitle` field as a user attribute:

```python
return {"attributes": {"job_title": info.get("jobTitle")}}
```

To add it, open **Customization** > **Property Mappings**, create an **OAuth Source Property Mapping** with the expression above, and then edit the Entra ID OAuth source. Under **OAuth Attribute mapping** > **User Property Mappings**, add it to **Selected User Property Mappings** and click **Update**.

The source uses each Graph group ID as the stable group identifier and the group's `displayName` as its name. A group property mapping can use `group_id` and the corresponding entry in `info["raw_groups"]` to store more group data. For example:

```python
group = info.get("raw_groups", {}).get(group_id, {})
return {"attributes": {"entra_id": group_id, "description": group.get("description")}}
```

Add that mapping under the source's **Group Property Mappings**. It runs only for groups returned by the Entra ID source; the Graph group permission and scope are still required. See [source property mappings](../../../property-mappings/index.mdx#group-synchronization) and [OAuth expression data](../../../protocols/oauth/index.mdx#expression-data) for details.

## Resources

- [Entra ID Documentation - Register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app)

---

## Entra ID SCIM user and group provisioning

This guide explains how to provision users and groups from Entra ID to authentik by configuring Entra ID as a SCIM source.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## authentik configuration

To integrate authentik with Entra ID via SCIM, you need to create a SCIM source in authentik.

### Create SCIM source

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **SCIM Source**.
   - **Create SCIM Source**: provide a name and a slug.
   - All other configurations are optional.
3. Click **Finish**.
4. On the **Federation and Social login** page, click the name of the newly created SCIM source.
5. Take note of the **SCIM Base URL**. This value will be required in the next section.
6. Under **Token**, click **Click to copy token** and securely store the value. This value will also be required in the next section.

If authentik has the required browser permissions, the token will be copied to your clipboard after you click the **Click to copy token** button. However, some browsers do not allow this. In those cases, a notification will appear in the bottom-right corner with the token, and you need to copy it manually.

Microsoft requires that the authentik SCIM endpoint be accessible via TLS 1.2. If enforcing TLS 1.3, you may run into issues. For more information, refer to the [Microsoft SCIM endpoint documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups#security-requirements).

You can use the [Microsoft SCIM Validator](https://scimvalidator.microsoft.com/) to test connectivity to your authentik SCIM endpoint. Please note that the validator will always report approximately 13 errors. These can be safely ignored.

## Entra ID configuration

### Create a custom enterprise application

1. Log in to [Entra ID](https://entra.microsoft.com) using a [global administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-administrator) account.
2. Navigate to **Enterprise apps**, click **Create your own application**, and configure the following fields:
   - **Name**: provide a name for the application (e.g. `authentik-scim`).
   - Select `Integrate any other application you don't find in the gallery (Non-gallery)`.
3. Click **Create**.

### Configure provisioning

4. Navigate to **Provisioning**, click **New Configuration**, and configure the following fields:
   - **Tenant URL**: Set to the **SCIM Base URL** from authentik (e.g. `https://authentik.company/source/scim/entra-scim/v2`).
   - **Secret Token**: Set to the **Token** from authentik.
5. Click **Test connection** to validate that Entra ID can communicate with authentik.
6. If the connection is successful, click **Create** and **Save**. If the connection fails, ensure that your authentik **SCIM Base URL** is accessible from the internet.
7. In the left sidebar, under **Manage**, click **Provisioning**.

There are three options for determining which users and groups are provisioned to authentik:

- Set Entra ID to sync all users and groups.
- Set Entra ID to sync all users and groups with scopes that limit which users and groups are synced.
- Set Entra ID to sync only assigned users and groups. Group assignment is only available to Microsoft Entra Suite, Microsoft Entra ID Governance, and Microsoft Entra ID P2 customers.

#### Sync all users and groups

1. On the **Provisioning** page, expand the **Settings** section, and set **Scope** to `Sync all users and groups`.
2. Toggle **Provisioning status** to `On`.
3. At the top of the page, click **Save**.
4. Track provisioning progress via the **Overview** page.

#### Sync all users and groups with scopes

1. On the **Provisioning** page, expand the **Settings** section, and set **Scope** to `Sync all users and groups`.
2. At the top of the page, click **Save**.
3. Expand the **Mappings** section and then click **Provision Microsoft Entra ID Users**.
4. Under **Source Object Scope**, click **All records**.
5. Click **Add new filter group**, design the filters that you want applied to synced users and click **Apply**.
6. Optionally, configure **Target object actions** and modify the **Attribute Mappings**.
7. At the top of the page, click **Save**.
8. On the **Provisioning** page, expand the **Mappings** section and then click **Provision Microsoft Entra ID Groups** and repeat steps 4-7.
9. Back on the **Provisioning** page, toggle **Provisioning status** to `On`.
10. At the top of the page, click **Save**.
11. Track provisioning progress via the **Overview** page.

#### Sync only assigned users and groups

1. On the **Provisioning** page, expand the **Settings** section, and set **Scope** to `Sync only assigned users and groups`.
2. At the top of the page, click **Save**.
3. Under **Manage**, click **Users and groups** and then click **Add user/group**.
4. Select the users and groups that you want synced to authentik.
5. Click **Assign**.
6. On the **Provisioning** page, toggle **Provisioning status** to `On`.
7. At the top of the page, click **Save**.
8. Track provisioning progress via the **Overview** page.

Group assignment is only available for Microsoft Entra Suite, Microsoft Entra ID Governance and Microsoft Entra ID P2 subscribers.

## Confirm provisioning in authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login** and click the name of the SCIM source.
3. Open the **Provisioned Users** and **Provisioned Groups** tabs to confirm whether the correct users and groups have been provisioned from Entra ID.

---

## Google Cloud (with OAuth)

This source lets users authenticate with their Google credentials by configuring Google Cloud as a federated identity provider with OAuth 2.0.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.

## Google configuration

To integrate Google with authentik, you need to create a new project and OAuth credentials in the Google Developer Console.

1. Log in to the [Google Developer Console](https://console.developers.google.com/).
2. Click the project selector in the top bar, and then click **New Project**.

![](./googledeveloper1.png)

3. Set the following values:
   - **Project Name**: Provide a name
   - **Organization**: Leave as default if unsure
   - **Location**: Leave as default if unsure

4. Click **Create**.

5. Select your project from the drop-down at the top.

6. Click the **Credentials** menu icon on the left which looks like a key.

![](./googledeveloper2.png)

7. On the right side, click **Configure Consent Screen**.

![](./googledeveloper3.png)

8. Set the following required fields:
   - **User Type**: If you do not have a Google Workspace account, choose *External*. If you do have a Google Workspace account and want to limit access to users inside your organization, choose *Internal*.
   - **App Name**: `authentik`
   - **User Support Email**: Must have a value
   - **Authorized Domains**: authentik.company
   - **Developer Contact Info**: Must have a value
9. Click **Save and Continue**.
10. If you have special scopes configured for Google, enter them on this screen. If not, click **Save and Continue**.
11. If you want to create test users, enter them here. If not, click **Save and Continue**.
12. From the **Summary** page, click the **Credentials** menu icon on the left (the icon looks like a key).
13. Click **Create Credentials** on the top of the screen and select **OAuth Client ID**.
14. Set the following required fields:
    - **Application Type**: `Web Application`
    - **Name**: Provide a name
    - **Authorized redirect URIs**: `https://authentik.company/source/oauth/callback/google/`

![](./googledeveloper4.png)

15. Click **Create**.
16. Take note of the **Client ID** and **Client Secret**. These values will be required in the next section.

## authentik configuration

To support the integration of Google with authentik, you need to create a Google OAuth source in authentik.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login**, click **New Source**, and then configure the following settings:
   - **Select type**: select **Google OAuth Source** as the source type.
   - **Create Google OAuth Source**: provide a name, a slug that must match the slug used in the Google `Authorized redirect URI` field (e.g. `google`), and set the following required configurations:
     - **Protocol settings**
       - **Consumer key**: `<client_ID>`
       - **Consumer secret**: `<client_secret>`
       - **Scopes** *(optional)*: define any additional access scopes.
3. Click **Finish** to save your settings.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source/).

## Optional additional configuration

### Username mapping

Google does not provide a separate username. By default, authentik prompts new users to choose one. To use the Google email address as the username, add an OAuth source property mapping. This sets the username before authentik starts the enrollment flow.

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Customization** > **Property Mappings**.
3. Click **Create**, select **OAuth Source Property Mapping**, and then click **Next**.
4. Provide a name for the mapping and enter this expression:

```python
return {"username": info.get("email")}
```

5. Click **Finish**.
6. Navigate to **Directory** > **Federation and Social login** and edit the Google OAuth source.
7. Under **OAuth Attribute mapping** > **User Property Mappings**, add the mapping to **Selected User Property Mappings**.
8. Click **Update**.

The source's default `email` value remains unchanged. If Google does not return an email address, this mapping cannot set a username and the enrollment flow still asks the user for one.

This mapping also runs on later logins and can update an existing user's username. To control whether users can change their usernames themselves, see [Configuration](../../../../../sys-mgmt/settings.mdx#allow-users-to-change-username).

For other fields available to OAuth source mappings, see [OAuth source property mappings](../../../protocols/oauth/index.mdx#oauth-source-property-mappings).

---

## Google Workspace (with SAML)

This source lets users authenticate with their Google Workspace credentials by configuring Google Workspace as a federated identity provider with SAML.

## What is Google Workspace?

Google Workspace (formerly G Suite) is a collection of cloud-computing, productivity, and collaboration tools, software, and products developed and marketed by Google.

Organizations using Google Workspace allow their users to authenticate to applications using their company email addresses. This guide shows how to set up Security Assertion Markup Language (SAML) as the authentication method between Google Workspace and authentik.

## SAML authentication flow

This sequence diagram shows a high-level flow between user, authentik, Google Workspace, and the target application.

```mermaid
sequenceDiagram
    autonumber
    participant User
    participant authentik
    participant Google
    participant App

    User->>App: User navigates to app...
    App-->>authentik: ← Redirected to authentik
    Note over authentik: User chooses "Google Workspace"
    authentik-->>Google: Redirect to Google →
    Note over Google: Authenticate with email and password
    Google-->>authentik: ← Redirect to authentik
    authentik-->>App: Redirect to app →
```

In short, the user navigates to the application, is redirected to authentik, chooses Google Workspace as the authentication method, authenticates with Google, and is redirected back to the application.

The key characteristic of this IdP-to-IdP flow is that authentik acts as an intermediary identity provider, brokering trust between your application and Google Workspace.

## Preparation

The following placeholders are used in this guide:

- `authentik.company` is the FQDN of the authentik installation.
- `google-slug` is the slug to assign to the SAML source in authentik (for example, `google`).

## Google Workspace configuration

### Create a SAML application

1. Log in to the [Google Workspace Admin Console](https://admin.google.com/) as a super-admin.
2. Navigate to **Apps** > **Web and mobile apps**.
3. Expand the **Add app** dropdown and select **Add custom SAML app**.
4. Configure the following settings:
   - Set **Name** to `authentik`.
   - Set **Description** to `Single Sign-On for authentik`.
5. Click **Continue**.
6. Under **Option 2**, click **Download Certificate** to download the signing certificate.
7. Take note of the **SSO URL**. This will be required when configuring authentik.

authentik acts as both a service provider (SP) to Google and an identity provider (IdP) to your applications. Because only the SP configuration is needed, you can ignore the Entity ID provided by Google.

8. Click **Continue** to proceed to the service provider configuration.

### Configure service provider details

1. Configure the following settings:
   - Set **ACS URL** to `https://authentik.company/source/saml/<google-slug>/acs/`.
   - Set **Entity ID** to `https://authentik.company/source/saml/<google-slug>/metadata/`.
   - Set **Start URL** to `https://authentik.company`.
   - Enable **Signed response**.
   - Set **Name ID format** to `EMAIL`.
   - Set **Name ID** to `Basic Information > Primary Email`.
2. Click **Continue**.

### Configure attribute mapping

1. Click **Add Mapping** and configure the following settings:
   - Set **Google Directory attribute** to `Basic Information > Primary Email`.
   - Set **App attribute** to `email`.
2. Click **Finish**.

### Enable the application

1. Navigate to **Apps** > **Web and mobile apps** and click the SAML app you created.
2. Click **User access**.
3. Turn the application **ON** for everyone or for specific organizational units.
4. Click **Save**.

## authentik configuration

### Upload the Google Workspace certificate to authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **System** > **Certificates** and click **Import**.
3. Give it a name like `Google Workspace Signing Certificate`.
4. Paste the Google Workspace certificate you exported earlier into the **Certificate** field.
5. Click **Create**.

### Create a SAML source in authentik

1. Log in to authentik as an administrator and open the authentik Admin interface.
2. Navigate to **Directory** > **Federation and Social login** and click **New Source**.
3. Select **SAML Source** and configure the following settings:
   - Set **Name** to `Google Workspace`.
   - Set **Slug** to `google` (must match the slug used in Google Workspace ACS URL).
   - Set **SSO URL** to the SSO URL from Google Workspace.
   - Set **Issuer override** to `https://authentik.company/source/saml/<google-slug>/metadata/` (optional; the source defaults to this value).
   - Set **Verification Certificate** to the Google Workspace certificate you uploaded earlier.
     These verification settings expect Google Workspace to sign the SAML response. Make sure **Signed response** is enabled in the Google Workspace SAML app.
   - Disable **Verify Assertion Signature**.
   - Enable **Verify Response Signature**.
   - Enable **Allow IdP-initiated Login**.
   - Set **NameID Policy** to `Email address`.
4. Click **Finish**.

For instructions on how to display the new source on the authentik login page, refer to the [Add sources to default login page documentation](../../../index.mdx#add-sources-to-default-login-page).

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the [Source Stage documentation](../../../../../add-secure-apps/flows-stages/stages/source).

## Troubleshooting

- **`403 app_not_configured_for_user`**: Ensure the Entity ID matches between Google Workspace and authentik. The Entity ID must be identical in both configurations.
- **`403 app_not_enabled_for_user`**: Enable the application for your organization in the Google Workspace Admin Console under **Apps** > **Web and mobile apps**.
- **`Expected exactly one Signature in the Response element`**: Enable **Signed response** in the Google Workspace Admin Console under **Apps** > **Web and mobile apps** > your SAML app, for example `authentik`. If this option is disabled, Google Workspace signs only the SAML assertion instead of the outer SAML response.

## Resources

- [Google Workspace Admin Help — Set up your own custom SAML app](https://support.google.com/a/answer/6087519)
- [Google Workspace Admin Help — SAML app error messages](https://support.google.com/a/answer/6301076)