Authentik Core API
Users, groups, applications, tokens, brands, application entitlements and authenticated sessions — the identity records and the objects users see.
Authentik Core API is one of 27 APIs that Authentik publishes on the APIs.io network, described by a machine-readable OpenAPI specification.
Tagged areas include Core. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an API reference, and a GitHub repository.
This API exposes 78 operations across 48 paths, and defines 114 schemas. It is described by OpenAPI 3.2.0, at version 2026.11.0-rc1.
Requests are made against a single base URL, /api/v3.
78 operations
48 paths
114 schemas
10 DELETE34 GET7 PATCH19 POST8 PUT
Metadata
The identity and technical contract details declared by the specification.
Authentication & Security 4
Authentik Core API declares
4 security schemes
for authenticating requests.
It accepts HTTP bearer tokens (authentik).
It uses HTTP bearer+agent authentication (authentik_device_auth).
It accepts HTTP bearer tokens (authentik_device_enroll).
It accepts HTTP bearer tokens (authentik_device_federation).
Paths & Operations 78
Across 48 paths, the API surfaces 78 operations — 10 DELETE, 34 GET, 7 PATCH, 19 POST, 8 PUT. Each is listed below with its method, path, parameters, and response codes.
core 78
GET
/core/application_entitlements/
ApplicationEntitlement Viewset
POST
/core/application_entitlements/
ApplicationEntitlement Viewset
GET
/core/application_entitlements/{pbm_uuid}/
ApplicationEntitlement Viewset
PUT
/core/application_entitlements/{pbm_uuid}/
ApplicationEntitlement Viewset
PATCH
/core/application_entitlements/{pbm_uuid}/
ApplicationEntitlement Viewset
DELETE
/core/application_entitlements/{pbm_uuid}/
ApplicationEntitlement Viewset
GET
/core/application_entitlements/{pbm_uuid}/used_by/
Get a list of all objects that use this object
GET
/core/application_entitlements/requestable/
List application entitlements which the current user can request access to
GET
/core/applications/
Custom list method that checks Policy based access instead of guardian
POST
/core/applications/
Application Viewset
GET
/core/applications/{slug}/
Application Viewset
PUT
/core/applications/{slug}/
Application Viewset
PATCH
/core/applications/{slug}/
Application Viewset
DELETE
/core/applications/{slug}/
Application Viewset
GET
/core/applications/{slug}/check_access/
Check access to a single application by slug
GET
/core/applications/{slug}/used_by/
Get a list of all objects that use this object
GET
/core/applications/requestable/
List applications which the current user can request access to
GET
/core/authenticated_sessions/
AuthenticatedSession Viewset
GET
/core/authenticated_sessions/{uuid}/
AuthenticatedSession Viewset
DELETE
/core/authenticated_sessions/{uuid}/
AuthenticatedSession Viewset
GET
/core/authenticated_sessions/{uuid}/used_by/
Get a list of all objects that use this object
DELETE
/core/authenticated_sessions/bulk_delete/
Bulk revoke all sessions for multiple users
GET
/core/brands/
Brand Viewset
POST
/core/brands/
Brand Viewset
GET
/core/brands/{brand_uuid}/
Brand Viewset
PUT
/core/brands/{brand_uuid}/
Brand Viewset
PATCH
/core/brands/{brand_uuid}/
Brand Viewset
DELETE
/core/brands/{brand_uuid}/
Brand Viewset
GET
/core/brands/{brand_uuid}/used_by/
Get a list of all objects that use this object
GET
/core/brands/current/
Get current brand
GET
/core/groups/
Group Viewset
POST
/core/groups/
Group Viewset
GET
/core/groups/{group_uuid}/
Group Viewset
PUT
/core/groups/{group_uuid}/
Group Viewset
PATCH
/core/groups/{group_uuid}/
Group Viewset
DELETE
/core/groups/{group_uuid}/
Group Viewset
POST
/core/groups/{group_uuid}/add_user/
Add user to group
POST
/core/groups/{group_uuid}/remove_user/
Remove user from group
GET
/core/groups/{group_uuid}/used_by/
Get a list of all objects that use this object
GET
/core/object_attributes/
POST
/core/object_attributes/
GET
/core/object_attributes/{attribute_id}/
PUT
/core/object_attributes/{attribute_id}/
PATCH
/core/object_attributes/{attribute_id}/
DELETE
/core/object_attributes/{attribute_id}/
GET
/core/tokens/
Token Viewset
POST
/core/tokens/
Token Viewset
GET
/core/tokens/{identifier}/
Token Viewset
PUT
/core/tokens/{identifier}/
Token Viewset
PATCH
/core/tokens/{identifier}/
Token Viewset
DELETE
/core/tokens/{identifier}/
Token Viewset
POST
/core/tokens/{identifier}/set_key/
Set token key. Action is logged as event. authentikcore.settokenkey permission is required.
GET
/core/tokens/{identifier}/used_by/
Get a list of all objects that use this object
GET
/core/tokens/{identifier}/view_key/
Return token key and log access
PUT
/core/transactional/applications/
Convert data into a blueprint, validate it and apply it
GET
/core/user_consent/
UserConsent Viewset
GET
/core/user_consent/{id}/
UserConsent Viewset
DELETE
/core/user_consent/{id}/
UserConsent Viewset
GET
/core/user_consent/{id}/used_by/
Get a list of all objects that use this object
GET
/core/users/
User Viewset
POST
/core/users/
User Viewset
GET
/core/users/{id}/
User Viewset
PUT
/core/users/{id}/
User Viewset
PATCH
/core/users/{id}/
User Viewset
DELETE
/core/users/{id}/
User Viewset
POST
/core/users/{id}/impersonate/
Impersonate a user
POST
/core/users/{id}/recovery/
Create a temporary link that a user can use to recover their account
POST
/core/users/{id}/recovery_email/
Send an email with a temporary link that a user can use to recover their account
POST
/core/users/{id}/set_password/
Set password for user
POST
/core/users/{id}/set_password_hash/
Set a user's password from a pre-hashed Django password value. Submit the Django password hash in the shared password request field. This updates authentik's local password verifier only. It does not…
GET
/core/users/{id}/used_by/
Get a list of all objects that use this object
POST
/core/users/account_lockdown/
Choose the target account, then return a flow link.
POST
/core/users/export/
Create a data export for this data type. Note that the export is generated asynchronously: this method returns a DataExport object that will initially have completed=false as well as the permanent UR…
GET
/core/users/impersonate_end/
End Impersonation a user
GET
/core/users/me/
Get information about current user
GET
/core/users/paths/
Get all user paths
POST
/core/users/service_account/
Create a new user account that is marked as a service account
POST
/core/users/switch/
Start browser user switching.
Schemas 114
The contract defines 114 schemas that model the data the API accepts and returns. The most detailed are SAMLProviderRequest (28 properties), OAuth2ProviderRequest (23 properties), Brand (22 properties), PatchedBrandRequest (21 properties). Each schema is shown below with its type and property counts.
PatchedApplicationRequest
object
Application Serializer
12 properties
Role
object
Role serializer
2 properties
2 required
Token
object
Token Serializer
9 properties
3 required
Link
object
Returns a single link
1 property
1 required
ProxyMode
string
PaginatedBrandList
object
3 properties
3 required
BrandRequest
object
Brand Serializer
21 properties
1 required
WSFedSAMLVersionEnum
string
LogLevelEnum
string
RelatedGroup
object
Stripped down group serializer to show relevant children/parents for groups
5 properties
3 required
ThemedUrls
object
Themed URLs - maps theme names to URLs for light and dark themes
2 properties
SAMLBindingsEnum
string
User
object
User Serializer
20 properties
12 required
DigestAlgorithmEnum
string
Autocomplete
object
UiThemeEnum
string
TokenRequest
object
Token Serializer
7 properties
1 required
UserSwitchActionEnum
string
SessionUser
object
Response for the /user/me endpoint, returns the currently active user (as user property) and, if this user is being impersonated, the original user in the orig…
3 properties
2 required
UserConsent
object
UserConsent Serializer
6 properties
3 required
GoogleWorkspaceProviderRequest
object
GoogleWorkspaceProvider Serializer
15 properties
4 required
UserSwitchRequest
object
Request to add or switch users in the current browser.
2 properties
WSFederationProviderRequest
object
WSFederationProvider Serializer
20 properties
5 required
TransactionApplicationRequest
object
Serializer for creating a provider and an application in one transaction
4 properties
3 required
OAuth2ProviderRequest
object
OAuth2Provider Serializer
23 properties
4 required
PaginatedUserConsentList
object
3 properties
3 required
MicrosoftEntraProviderRequest
object
MicrosoftEntraProvider Serializer
14 properties
4 required
RedirectURITypeEnum
string
UserSwitchResponse
object
Redirect returned after planning a user switch.
1 property
1 required
ApplicationEntitlementRequest
object
ApplicationEntitlement Serializer
3 properties
2 required
SSFProviderRequest
object
SSFProvider Serializer
5 properties
2 required
PaginatedApplicationEntitlementList
object
3 properties
3 required
TransactionPolicyBindingRequest
object
PolicyBindingSerializer which does not require target as target is set implicitly
8 properties
1 required
PaginatedAuthenticatedSessionList
object
3 properties
3 required
UserSelfRoles
object
2 properties
2 required
PatchedGroupRequest
object
Group Serializer
6 properties
RequestableTarget
object
Generic representation of a single request target: whatever was actually requested (an Application, an Application Entitlement, ...), always paired with the pa…
6 properties
6 required
AuthenticatedSession
object
AuthenticatedSession Serializer
10 properties
9 required
Pagination
object
7 properties
7 required
PaginatedRequestableTargetList
object
3 properties
3 required
MatchingModeEnum
string
UserTypeEnum
string
SCIMAuthenticationModeEnum
string
LDAPProviderRequest
object
LDAPProvider Serializer
13 properties
3 required
UserServiceAccountRequest
object
Payload to create a service account
4 properties
1 required
ProxyProviderRequest
object
ProxyProvider Serializer
20 properties
4 required
SignatureAlgorithmEnum
string
SAMLProviderRequest
object
SAMLProvider Serializer
28 properties
4 required
ApplicationRequest
object
Application Serializer
12 properties
2 required
ContentType
object
5 properties
5 required
PolicyEngineMode
string
UserAccountLockdownRequest
object
Choose the target account before starting the lockdown flow.
1 property
LogEvent
object
Single log message with all context logged.
5 properties
5 required
Group
object
Group Serializer
14 properties
9 required
PartialUser
object
Partial User Serializer, does not include child relations.
8 properties
4 required
GroupRequest
object
Group Serializer
6 properties
1 required
Brand
object
Brand Serializer
22 properties
2 required
PolicyTestResult
object
result of a policy test
3 properties
3 required
UserPasswordSetRequest
object
Payload to set a users' password directly
1 property
1 required
PartialGroup
object
Partial Group Serializer, does not include child relations.
5 properties
3 required
UserPasswordHashSetRequest
object
Payload to set a users' password hash directly
1 property
1 required
RACProviderRequest
object
RACProvider Serializer
7 properties
2 required
TokenView
object
Show token's current key
1 property
1 required
PaginatedTokenList
object
3 properties
3 required
Provider
object
Provider Serializer
14 properties
10 required
UserServiceAccountResponse
object
5 properties
4 required
TransactionApplicationResponse
object
Transactional creation response
2 properties
2 required
PatchedObjectAttributeRequest
object
10 properties
SCIMProviderRequest
object
SCIMProvider Serializer
17 properties
2 required
UsedByActionEnum
string
DataExport
object
Mixin to validate that a valid enterprise license exists before allowing to save the object
7 properties
7 required
PatchedUserRequest
object
User Serializer
10 properties
UserRecoveryEmailRequest
object
Payload to create and email a recovery link
2 properties
1 required
ObjectAttribute
object
14 properties
8 required
PaginatedGroupList
object
3 properties
3 required
PatchedBrandRequest
object
Brand Serializer
21 properties
PatchedApplicationEntitlementRequest
object
ApplicationEntitlement Serializer
3 properties
OutgoingSyncDeleteAction
string
LDAPAPIAccessMode
string
modelRequest
UsedBy
object
A list of all objects referencing the queried object
5 properties
5 required
PaginatedUserList
object
3 properties
3 required
FooterLink
object
Links returned in Config API
2 properties
2 required
SubModeEnum
string
PatchedTokenRequest
object
Token Serializer
7 properties
OAuth2ProviderLogoutMethodEnum
string
RedirectURIRequest
object
A single allowed redirect URI entry
3 properties
2 required
IssuerModeEnum
string
ImpersonationRequest
object
1 property
1 required
ClientTypeEnum
string
IntentEnum
string
SAMLNameIDPolicyEnum
string
Application
object
Application Serializer
19 properties
9 required
CurrentBrand
object
Partial brand information for styling
21 properties
12 required
ObjectAttributeTypeEnum
string
ValidationError
object
Validation Error
2 properties
UserSelfGroups
object
2 properties
2 required
SAMLLogoutMethods
string
UserPath
object
1 property
1 required
CompatibilityModeEnum
string
GrantTypeEnum
string
ProviderModelEnum
string
UserRecoveryLinkRequest
object
Payload to create a recovery link
1 property
UserSelf
object
User Serializer for information a user can retrieve about themselves
14 properties
12 required
ObjectAttributeRequest
object
10 properties
4 required
PaginatedApplicationList
object
3 properties
3 required
UserRequest
object
User Serializer
10 properties
2 required
RadiusProviderRequest
object
RadiusProvider Serializer
9 properties
3 required
BulkDeleteSessionResponse
object
1 property
1 required
ApplicationEntitlement
object
ApplicationEntitlement Serializer
4 properties
3 required
GenericError
object
Generic API Error
2 properties
1 required
UserAccountRequest
object
Account adding/removing operations
1 property
1 required
TokenSetKeyRequest
object
Set token's key
1 property
1 required
PaginatedObjectAttributeList
object
3 properties
3 required
Specification
The full machine-readable OpenAPI contract behind this narrative.
Source
More from Authentik 12
Other APIs Authentik publishes across the network.
Authentik Crypto API
Authentik Events API
Authentik Flows API
Authentik Policies API
Authentik Providers API
Authentik RBAC API
Authentik Schema API
Authentik Sources API
Authentik Stages API
Authentik Admin API
Authentik Agents API
Authentik Authenticators API
#Core
Where this information came from
This is an independent, third-party profile of Authentik Core API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.