How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Authelia API

The full first-party Authelia HTTP API — the portal, authorization, authentication, second factor, user information, session elevation, password reset/change and OpenID Connect 1.0 surfaces. Described by Authelia's own OpenAPI 3.2.0 contract (42 paths, 78 operations, 100 schemas), published in the Authelia repository at api/openapi.yml and served by each deployment. Authelia is self-hosted, so the base URL is the operator's own deployment host; auth.example.com is the default Authelia's own contract template uses.

Authelia API is one of 4 APIs that Authelia publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authentication, Authorization, MFA, OpenID Connect, and SSO. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and a GitHub repository.

This API exposes 78 operations across 42 paths, organized into 12 resource areas, and defines 100 schemas. It is described by OpenAPI 3.2.0, at version 1.0.0.

Requests are made against a single base URL, https://{authelia_host}.

78 operations 42 paths 100 schemas 8 DELETE23 GET5 HEAD2 OPTIONS2 PATCH29 POST7 PUT2 TRACE

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.0.0
Base URL
https://auth.example.com
Authentication
API Key, OpenID Connect
Contact
License
Resource Areas
12

Authentication & Security 2

Authelia API declares 2 security schemes for authenticating requests. An API key is passed in the cookie as authelia_session (authelia_auth). It supports OpenID Connect (openid) discovered at https://auth.example.com/.well-known/openid-configuration.

Paths & Operations 78

Across 42 paths, the API surfaces 78 operations — 8 DELETE, 23 GET, 5 HEAD, 2 OPTIONS, 2 PATCH, 29 POST, 7 PUT, 2 TRACE. They span 12 resource areas, including State, Authorization, First Factor, Utilities, Authentication, Password Change, Password Reset, User Information, and 4 more. Each is listed below with its method, path, parameters, and response codes.

State 5

Configuration, health and state endpoints

GET
/api/configuration
Application Configuration
getConfiguration → 200403
GET
/api/configuration/password-policy
Password Policy Configuration
getPasswordPolicyConfiguration → 200
HEAD
/api/health
Application Health
headHealth → 200
GET
/api/health
Application Health
getHealth → 200
GET
/api/state
User Application State
getState → 200
Authorization 20

Authorization endpoints

GET
/api/authz/auth-request
Authorization Verification (AuthRequest)
getAuthzAuthRequest 2 params → 200400401
HEAD
/api/authz/auth-request
Authorization Verification (AuthRequest)
headAuthzAuthRequest 2 params → 200400401
GET
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
getAuthzExtAuthz 6 params → 200302303400401
HEAD
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
headAuthzExtAuthz 6 params → 200302303400401
OPTIONS
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
optionsAuthzExtAuthz 6 params → 200302303400401
POST
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
postAuthzExtAuthz 6 params → 200302303400401
PUT
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
putAuthzExtAuthz 6 params → 200302303400401
PATCH
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
patchAuthzExtAuthz 6 params → 200302303400401
DELETE
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
deleteAuthzExtAuthz 6 params → 200302303400401
TRACE
/api/authz/ext-authz
Authorization Verification (ExtAuthz)
traceAuthzExtAuthz 6 params → 200302303400401
GET
/api/authz/forward-auth
Authorization Verification (ForwardAuth)
getAuthzForwardAuth 5 params → 200302303400401
HEAD
/api/authz/forward-auth
Authorization Verification (ForwardAuth)
headAuthzForwardAuth 5 params → 200302303400401
GET
/api/verify
Authorization Verification (Legacy)
getAuthzLegacy 7 params → 200302303401
HEAD
/api/verify
Authorization Verification (Legacy)
headAuthzLegacy 7 params → 200302303401
OPTIONS
/api/verify
Authorization Verification (Legacy)
optionsAuthzLegacy 7 params → 200302303401
POST
/api/verify
Authorization Verification (Legacy)
postAuthzLegacy 7 params → 200302303401
PUT
/api/verify
Authorization Verification (Legacy)
putAuthzLegacy 7 params → 200302303401
PATCH
/api/verify
Authorization Verification (Legacy)
patchAuthzLegacy 7 params → 200302303401
DELETE
/api/verify
Authorization Verification (Legacy)
deleteAuthzLegacy 7 params → 200302303401
TRACE
/api/verify
Authorization Verification (Legacy)
traceAuthzLegacy 7 params → 200302303401
First Factor 4

First Factor Authentication

POST
/api/firstfactor
Login
postFirstFactor body → 200401
POST
/api/firstfactor/reauthenticate
Reauthenticate
postFirstFactorReauthenticate body → 200401
GET
/api/firstfactor/passkey
First Factor Authentication - Passkey
getFirstFactorPasskey → 200403
POST
/api/firstfactor/passkey
First Factor Authentication - Passkey
postFirstFactorPasskey body → 200403
Utilities 1

General utilities used in several operations

POST
/api/checks/safe-redirection
Check whether URI is safe to redirect to.
postCheckSafeRedirection body → 200401
Authentication 1

Authentication endpoints

POST
/api/logout
Logout
postLogout body → 200
Password Change 1

Password change endpoint

POST
/api/change-password
Password Change
postChangePassword body → 200
Password Reset 4

Password reset endpoints

POST
/api/reset-password/identity/start
Identity Verification Token Creation
postResetPasswordIdentityStart body → 200429
POST
/api/reset-password/identity/finish
Identity Verification Token Validation
postResetPasswordIdentityFinish body → 200429
POST
/api/reset-password
Password Reset
postResetPassword body → 200429
DELETE
/api/reset-password
Password Reset
deleteResetPassword body → 200429
User Information 3

User configuration endpoints

GET
/api/user/info
User Configuration
getUserInfo → 200403
POST
/api/user/info
User Configuration
postUserInfo → 200403
POST
/api/user/info/2fa_method
User Configuration
postUserInfoSecondFactorMethod body → 200403
User Elevation 4

User session elevation endpoints

GET
/api/user/session/elevation
User Session Elevation
getUserSessionElevation → 200403
POST
/api/user/session/elevation
User Session Elevation
postUserSessionElevation → 200403429
PUT
/api/user/session/elevation
User Session Elevation
putUserSessionElevation body → 200400403429
DELETE
/api/user/session/elevation/{id}
User Session Elevation
deleteUserSessionElevation 1 param → 200
Second Factor 20

TOTP, WebAuthn and Duo endpoints

GET
/api/secondfactor/totp/register
TOTP Configuration Register
getSecondFactorTOTPRegistration → 200403
PUT
/api/secondfactor/totp/register
TOTP Configuration Register
putSecondFactorTOTPRegistration body → 200400403
POST
/api/secondfactor/totp/register
TOTP Configuration Register
postSecondFactorTOTPRegistration body → 200400403
DELETE
/api/secondfactor/totp/register
TOTP Configuration Register
deleteSecondFactorTOTPRegistration → 200403
GET
/api/secondfactor/totp
TOTP Configuration
getSecondFactorTOTPConfiguration → 200403404500
POST
/api/secondfactor/totp
Second Factor Authentication - TOTP
postSecondFactorTOTP body → 200403429
DELETE
/api/secondfactor/totp
Second Factor Authentication - TOTP
deleteSecondFactorTOTP → 200403
GET
/api/secondfactor/webauthn
Second Factor Authentication - WebAuthn
getSecondFactorWebAuthn → 200403
POST
/api/secondfactor/webauthn
Second Factor Authentication - WebAuthn
postSecondFactorWebAuthn body → 200403
GET
/api/secondfactor/webauthn/credentials
WebAuthn Credentials
getSecondFactorWebAuthnCredentials → 200403
PUT
/api/secondfactor/webauthn/credential/register
WebAuthn Credential Registration (Attestation)
putSecondFactorWebAuthnCredentialRegistration body → 200400403409
POST
/api/secondfactor/webauthn/credential/register
WebAuthn Credential Registration (Attestation)
postSecondFactorWebAuthnCredentialRegistration body → 201400403
DELETE
/api/secondfactor/webauthn/credential/register
WebAuthn Credential Registration (Attestation)
deleteSecondFactorWebAuthnCredentialRegistration → 200403
PUT
/api/secondfactor/webauthn/credential/{credentialID}
WebAuthn Credential
putSecondFactorWebAuthnCredential 1 param body → 200400403409
DELETE
/api/secondfactor/webauthn/credential/{credentialID}
WebAuthn Credential
deleteSecondFactorWebAuthnCredential 1 param → 200400403
GET
/api/secondfactor/duo
Second Factor Authentication - Duo Mobile Push
getSecondFactorDuo → 200403
POST
/api/secondfactor/duo
Second Factor Authentication - Duo Mobile Push
postSecondFactorDuo body → 200401429
GET
/api/secondfactor/duo_devices
Second Factor Authentication - Duo Mobile Push
getSecondFactorDuoDevices → 200401
POST
/api/secondfactor/duo_device
Second Factor Authentication - Duo Mobile Push
postSecondFactorDuoDevice body → 200401
POST
/api/secondfactor/password
Second Factor Authentication - Password
postSecondFactorPassword body → 200401
OpenID Connect 1.0 3

OpenID Connect 1.0 Endpoints

GET
/.well-known/openid-configuration
OpenID Connect Discovery 1.0 Document
getOpenIDConnectConfiguration → 200400500
GET
/api/oidc/userinfo
OpenID Connect 1.0 UserInfo Endpoint
getOpenIDConnectUserInfo 1 param → 200401403500
POST
/api/oidc/userinfo
OpenID Connect 1.0 UserInfo Endpoint
postOpenIDConnectUserInfo 1 param body → 200401403500
OAuth 2.0 12

OAuth 2.0 Endpoints

GET
/.well-known/oauth-authorization-server
OAuth 2.0 Authorization Server Metadata
getOAuth2AuthorizationServerMetadata → 200400500
GET
/jwks.json
OpenID Connect 1.0 JSON Web Key Set Document
getOpenIDConnectJSONWebKeySet → 200
GET
/api/oidc/authorization
OpenID Connect 1.0 Authorization Endpoint
getOpenIDConnectAuthorization 21 params → 200303400500
POST
/api/oidc/authorization
OpenID Connect 1.0 Authorization Endpoint
postOpenIDConnectAuthorization body → 200303400500
POST
/api/oidc/device-authorization
RFC8628 OAuth 2.0 Device Authorization Grant Endpoint
postOAuth2DeviceAuthorization body → 200400500
PUT
/api/oidc/device-authorization
RFC8628 OAuth 2.0 Device Authorization Grant Endpoint
putOAuth2DeviceAuthorization body → 200400500
POST
/api/oidc/pushed-authorization-request
OAuth 2.0 Pushed Authorization Endpoint
postOAuth2PushedAuthorizationRequest body → 200400413429500
POST
/api/oidc/token
OpenID Connect 1.0 Token Endpoint
postOpenIDConnectToken body → 200401403500
POST
/api/oidc/revocation
OAuth 2.0 Token Revocation Endpoint
postOAuth2Revocation body → 200401403500
POST
/api/oidc/introspection
OAuth 2.0 Token Introspection Endpoint
postOAuth2Introspection body → 200401403500
GET
/api/oidc/consent
OpenID Connect 1.0 Consent Information
getOpenIDConnectConsent 2 params → 200403
POST
/api/oidc/consent
OpenID Connect 1.0 Consent Response
postOpenIDConnectConsent body → 200403

Schemas 100

The contract defines 100 schemas that model the data the API accepts and returns. The most detailed are openid.spec.Metadata.OpenIDConfiguration (56 properties), openid.implementation.Claims.Object (30 properties), openid.spec.Metadata.OAuth2AuthorizationServer (27 properties), webauthn.Credential (22 properties). Each schema is shown below with its type and property counts.

handlers.checkURIWithinDomainRequestBody
object
1 property
handlers.checkURIWithinDomainResponseBody
object
1 property
handlers.configuration.ConfigurationBody
object
2 properties
handlers.configuration.PasswordPolicyConfigurationBody
object
2 properties
handlers.DuoDeviceBody
object
2 properties 2 required
handlers.DuoDevicesResponse
object
2 properties
handlers.bodyPasswordRequest
object
6 properties 1 required
handlers.bodyFirstFactorRequest
object
9 properties 2 required
handlers.bodyFirstFactorReauthenticateRequest
object
7 properties 1 required
handlers.logoutRequestBody
object
1 property
handlers.logoutResponseBody
object
2 properties
handlers.redirectResponse
object
2 properties
handlers.PasswordChangeRequestBody
object
3 properties 3 required
handlers.PasswordResetStep1RequestBody
object
1 property 1 required
handlers.PasswordResetStep2RequestBody
object
1 property 1 required
handlers.PasswordResetBodyDELETE
object
1 property 1 required
middlewares.IdentityVerificationFinishBody
object
1 property 1 required
handlers.bodySignDuoRequest
object
6 properties
handlers.StateResponse
object
2 properties
middlewares.Response.API
middlewares.Response.OK
object
2 properties 1 required
middlewares.Response.KO
object
2 properties 1 required
handlers.UserInfo
object
2 properties
handlers.UserInfo.MethodBody
object
1 property 1 required
handlers.ElevationStatus.Response
object
2 properties
handlers.ElevationStart.Response
object
2 properties
handlers.ElevationVerify.Request
object
1 property
handlers.TOTPOptions
object
2 properties
handlers.TOTPRegisterStartRequest
object
3 properties
handlers.TOTPRegisterStartResponse
object
2 properties
handlers.TOTPRegisterFinishRequest
object
1 property
handlers.TOTPConfiguration
object
2 properties
handlers.bodySignTOTPRequest
object
6 properties
webauthn.PublicKeyCredential
object
3 properties 3 required
webauthn.AuthenticatorResponse
object
1 property 1 required
webauthn.PublicKeyCredentialAttestation
The FIDO2 WebAuthn credential creation response as produced by the browser.
webauthn.PublicKeyCredentialAssertion
The FIDO2 WebAuthn credential assertion response as produced by the browser.
webauthn.CredentialAssertionResponse
object
6 properties 1 required
webauthn.PasskeyCredentialAssertionResponse
webauthn.CredentialUpdateRequest
object
1 property
webauthn.RegisterRequest
object
1 property
webauthn.CredentialsResponse
object
2 properties
webauthn.Credential
object
A WebAuthn credential registered by the user.
22 properties
webauthn.PublicKeyCredentialCreationOptions
object
2 properties
webauthn.PublicKeyCredentialRequestOptions
object
2 properties
webauthn.Transports
object
1 property
webauthn.UserVerification
object
1 property
webauthn.AttestationType
object
1 property
webauthn.AuthenticatorSelectionCriteria
object
1 property
webauthn.CredentialDescriptor
webauthn.CredentialEntity
object
3 properties 2 required
webauthn.CredentialRPEntity
object
1 property 1 required
webauthn.CredentialUserEntity
object
1 property 1 required
webauthn.AuthenticationExtensionsClientOutputs
object
1 property
openid.request.consent
object
2 properties
openid.request.consent.body
object
The consent decision submitted by the user during the consent workflow.
7 properties
openid.response.consent
object
2 properties
openid.spec.Metadata.OAuth2AuthorizationServer
object
27 properties 5 required
openid.spec.Metadata.OpenIDConfiguration
object
56 properties 12 required
openid.spec.IntrospectionResponse
object
12 properties 1 required
openid.implementation.Claims.Name
string
The name of an OpenID Connect 1.0 Claim.
openid.implementation.Claims.Object
object
OpenID Connect 1.0 User Claims.
30 properties
openid.implementation.Scopes.Object
string
The scope.
openid.spec.Scopes
string
openid.spec.ErrorResponseGeneric
object
An OpenID Connect 1.0 and OAuth 2.0 error response Note this is a generic error response and may describe a possible response for a given endpoint that is not…
6 properties 1 required
openid.spec.AccessServerTokenAssertionRequest
object
2 properties 1 required
openid.spec.AccessRequest.ClientAuth
The client authentication parameters included in the request body. Clients using the clientsecretbasic method authenticate via the Authorization header rather…
openid.spec.AccessRequest.ClientAuth.None
object
Client authentication for public clients registered with the 'none' client authentication method.
1 property 1 required
openid.spec.AccessRequest.ClientAuth.Secret
object
2 properties 2 required
openid.spec.AccessRequest.ClientAuth.JWT
object
3 properties 2 required
openid.spec.AccessRequest.AuthorizationCodeFlow
openid.spec.AccessRequest.DeviceCodeFlow
openid.spec.AccessRequest.RefreshTokenFlow
openid.spec.AccessRequest.ClientCredentialsFlow
openid.spec.AccessResponse
object
7 properties 3 required
openid.spec.AuthorizeRequest
object
18 properties 4 required
openid.spec.DeviceAuthorizeRequest
openid.spec.DeviceAuthorizeRequest.Parameters
object
5 properties 1 required
openid.spec.SubjectIdentifier
string
A Subject Identifier is a locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client.
openid.spec.ClientAuthMethod
string
The OAuth 2.0 / OpenID Connect 1.0 Client Authentication Method.
openid.spec.DisplayType
string
ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
openid.spec.Prompt
string
Not Supported: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentic…
openid.spec.ResponseType
string
The OAuth 2.0 / OpenID Connect 1.0 Response Type.
openid.spec.ResponseMode
string
Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint. This use of this parameter is NOT RECOMM…
openid.spec.GrantType
string
The OAuth 2.0 / OpenID Connect 1.0 Grant Type.
openid.spec.CodeChallengeMethod
string
The RFC7636 Code Challenge Verifier Method.
openid.spec.ClaimType
string
The representation of claims.
jose.spec.None
string
The JSON Web Signature Algorithm
jose.spec.JWS.None
string
The JSON Web Signature Algorithm
jose.spec.JWS
string
The JSON Web Signature Algorithm
jose.spec.JWE.alg
string
The JSON Web Encryption Algorithm (CEK)
jose.spec.JWE.enc
string
The JSON Web Encryption Algorithm (Claims)
jose.spec.JWK.base
object
7 properties
jose.spec.JWK.RSA
RSA Public Key in JSON Web Key format as defined by RFC7517 and RFC7518.
jose.spec.JWK.RSA.Private
RSA Private Key in JSON Web Key format as defined by RFC7517 and RFC7518.
jose.spec.JWK.EC
Elliptic Curve Public Key in JSON Web Key format as defined by RFC7517 and RFC7518.
jose.spec.JWK.EC.Private
Elliptic Curve Private Key in JSON Web Key format as defined by RFC7517 and RFC7518.
jose.spec.JWK.Symmetric
Symmetric Key in JSON Web Key format as defined by RFC7517 and RFC7518.
jose.spec.JWK
A key in the JSON Web Key format as defined by RFC7517.
jose.spec.JWKs
object
The JSON Web Key Sets Document as defined by RFC7517.
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

authelia-api-openapi.yml Raw ↑

Other APIs Authelia publishes across the network.

Authelia OpenID Connect 1.0 Provider
Authelia Discovery API
Authelia OIDC API
Where this information came from

This is an independent, third-party profile of Authelia API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.