Authentik MCP Server

Delete an application by its slug. This action is irreversible.

Get a single application by its slug.

List applications with optional filters for name, slug, group, search, and more.

Set an application's icon to an external URL (sets the meta_icon field), or clear the current icon. Provide either icon_url to set the icon, or clear: true to remove it.

Update an existing application. Only provided fields are modified (partial update).

Create or update an application and its provider in a single atomic transaction. Useful for setting up an application with a new provider.

Delete an authenticator device by type and ID (admin view). This action is irreversible.

Get a single authenticator device by type and ID (admin view). Use numeric id for most types, uuid string for endpoint type.

List authenticator devices of a specific type (admin view). Supports: duo, email, endpoint, sms, static, totp, webauthn.

List all authenticator devices across all types for the current user.

List authenticator devices of a specific type for the current user. Supports: duo, email, endpoint, sms, static, totp, webauthn.

Apply a blueprint instance, executing its configuration. This may create, update, or delete objects.

List all available blueprint files that can be used to create blueprint instances.

Create a new managed blueprint instance.

Delete a blueprint instance by its UUID. This action is irreversible.

Get a single blueprint instance by its UUID.

List managed blueprint instances with optional filters.

Update an existing blueprint instance. Only provided fields are modified (partial update).

Create a new brand with domain, branding settings, flow assignments, and optional attributes.

Get the brand configuration for the current domain.

Delete a brand by its UUID. This action is irreversible.

Get a single brand by its UUID.

List brands with optional filters for UUID, domain, and search.

Update an existing brand. Only provided fields are modified (partial update).

Create a new certificate keypair from PEM-encoded certificate and optional private key data.

Delete a certificate keypair by its UUID. This action is irreversible.

Generate a new self-signed certificate keypair.

Get a single certificate keypair by its UUID.

List certificate keypairs with optional filters.

Update an existing certificate keypair. Only provided fields are modified (partial update).

View the PEM-encoded certificate data for a keypair. Access is logged.

View the PEM-encoded private key data for a keypair. Access is logged. Sensitive operation.

Create a new endpoint agent connector.

Delete an agent connector by its UUID. This is irreversible.

Retrieve a single agent connector by its UUID.

List endpoint agent connectors with optional filtering by name, enabled state, search, and ordering.

Update an agent connector. Only provided fields are modified (partial update).

Delete an endpoint connector by its UUID from the generic registry. This is irreversible.

Retrieve a single endpoint connector by its UUID from the generic registry.

List all endpoint connectors across types (generic registry view) with optional search and ordering.

Create a new device access group. Device access groups bundle devices for policy targeting.

Delete a device access group by its UUID. This is irreversible.

Retrieve a single device access group by its UUID.

List device access groups with optional filtering by name, search, and ordering.

Update a device access group. Only provided fields are modified (partial update).

Create a new device binding linking a policy, group, or user to a target with an evaluation order.

Delete a device binding by its UUID. This is irreversible.

Retrieve a single device binding by its UUID.

List device-to-user policy bindings with optional filtering by policy, target, enabled state, search, and ordering.

Update a device binding. Only provided fields are modified (partial update).

Delete an endpoint device by its UUID. This is irreversible.

Retrieve a single endpoint device by its UUID.

List managed endpoint devices with optional filtering by name or identifier, search, and ordering.

Retrieve aggregate summary statistics about managed endpoint devices.

Update an endpoint device. Only provided fields are modified (partial update).

Create a new agent enrollment token bound to a connector. Used to enroll devices.

Delete an enrollment token by its UUID. This is irreversible.

Retrieve a single enrollment token by its UUID.

List agent enrollment tokens with optional filtering by connector, search, and ordering.

Update an enrollment token. Only provided fields are modified (partial update).

Create a new Fleet connector pointing at a Fleet device-management instance.

Delete a Fleet connector by its UUID. This is irreversible.

Retrieve a single Fleet connector by its UUID.

List Fleet device-management connectors with optional filtering by name, search, and ordering.

Update a Fleet connector. Only provided fields are modified (partial update).

Create a new Google Chrome connector with service-account credentials.

Delete a Google Chrome connector by its UUID. This is irreversible.

Retrieve a single Google Chrome connector by its UUID.

List Google Chrome device-management connectors with optional filtering by name, search, and ordering.

Update a Google Chrome connector. Only provided fields are modified (partial update).

Delete an ISE-PSSO agent by its UUID. This is irreversible.

Retrieve a single ISE-PSSO agent by its UUID.

List Apple Independent Secure Enclave (ISE-PSSO) agents with optional filtering by user, search, and ordering.

Get the authentik installation ID (used for license generation).

Install a new enterprise license key.

Delete an enterprise license by its UUID. This action is irreversible.

Forecast how many users will be required in a year based on current growth.

Get a single enterprise license by its UUID.

List enterprise licenses with optional filters.

Get the total enterprise license status summary.

Update an existing enterprise license. Only provided fields are modified (partial update).

List all available event action types.

Create a new audit event.

Trigger an export of events, producing a downloadable export artifact. Optional filters narrow which events are included.

Get a single audit event by its UUID.

List audit events with optional filters for action, username, client IP, and more.

Delete a notification by its UUID. This action is irreversible.

List notifications for the current user with optional filters.

Mark all notifications as seen for the current user.

Update a notification, typically to mark it as seen or unseen.

Create a new notification rule.

Delete a notification rule by its UUID. This action is irreversible.

Get a single notification rule by its UUID.

List notification rules with optional filters.

Update an existing notification rule. Only provided fields are modified (partial update).

Get aggregated event statistics bucketed by the provided count steps, optionally filtered.

Get the top N events grouped by user count.

Create a new notification transport.

Delete a notification transport by its UUID. This action is irreversible.

Get a single notification transport by its UUID.

List notification transports with optional filters.

Send a test notification using the specified transport.

Update an existing notification transport. Only provided fields are modified (partial update).

Get event volume data for specified filters and timeframe.

Create a new flow stage binding to attach a stage to a flow.

Delete a flow stage binding by its UUID. This action is irreversible.

Get a single flow stage binding by its UUID.

List flow stage bindings with optional filters.

Update an existing flow stage binding. Only provided fields are modified.

Clear the flow cache.

Get information about cached flows.

Create a new flow with name, slug, title, and designation.

Delete a flow by its slug. This action is irreversible.

Get a visual diagram of a flow showing its stages and bindings.

Export a flow as YAML. Returns the YAML content as text.

Get a single flow by its slug.

Import a flow/blueprint from YAML content via the managed blueprints import endpoint (replaces the removed flow import). Note: this merges/upserts into existing objects — it does NOT wipe existing flows first. The previous clear/wipe-before-import option is no longer available in the authentik API.

List flows with optional filters for search, designation, and ordering.

Update an existing flow. Only provided fields are modified (partial update).

Add a user to a group by group UUID and user ID.

Create a new group with optional parent, superuser status, users, and custom attributes.

Delete a group by its UUID. This action is irreversible.

Get a single group by its UUID.

List groups with optional filters for name, superuser status, members, and search.

Remove a user from a group by group UUID and user ID.

Update an existing group. Only provided fields are modified (partial update).

Create a new invitation.

Delete an invitation by its UUID. This action is irreversible.

Get a single invitation by its UUID.

List invitations with optional filters.

Send an invitation email to one or more recipients for an existing invitation.

Update an existing invitation. Only provided fields are modified.

Delete (revoke) an OAuth2 access token by its ID. This action is irreversible.

Get a single OAuth2 access token by its numeric ID.

List OAuth2 access tokens with optional filters. Tokens are system-managed.

Delete an OAuth2 authorization code by its ID. This action is irreversible.

Get a single OAuth2 authorization code by its numeric ID.

List OAuth2 authorization codes with optional filters. Codes are system-managed.

Delete (revoke) an OAuth2 refresh token by its ID. This action is irreversible.

Get a single OAuth2 refresh token by its numeric ID.

List OAuth2 refresh tokens with optional filters. Tokens are system-managed.

Create a new outpost instance.

Get the global default outpost configuration.

Delete an outpost instance by its UUID. This action is irreversible.

Create a new Docker service connection.

Update an existing Docker service connection. Only provided fields are modified (partial update).

Get a single outpost instance by its UUID.

Get the current health status of an outpost.

Create a new Kubernetes service connection.

Update an existing Kubernetes service connection. Only provided fields are modified (partial update).

List outpost instances with optional filters.

Delete a service connection by its UUID. This action is irreversible.

List all service connections (Docker and Kubernetes) with optional filters.

Get the current state of a service connection.

List all available service connection types that can be created.

Update an existing outpost instance. Only provided fields are modified (partial update).

Create a new policy of a specific type. Pass type-specific fields in the config object.

Delete a policy of a specific type by its UUID. This action is irreversible.

Get a single policy of a specific type by its UUID.

List policies of a specific type with optional filters.

Update an existing policy of a specific type. Pass type-specific fields in the config object.

Clear the policy cache.

Get information about cached policies.

Delete a policy by its UUID (cross-type). This action is irreversible.

Get a single policy by its UUID (cross-type).

List all policies across all types with optional filters.

Test a policy against a specific user to see if it passes or fails.

List all available policy types.

Create a new policy binding to attach a policy to a target (flow, stage, etc.).

Delete a policy binding by its UUID. This action is irreversible.

Get a single policy binding by its UUID.

List policy bindings with optional filters.

Update an existing policy binding. Only provided fields are modified.

Create a new prompt field definition.

Delete a prompt field definition by its UUID. This action is irreversible.

Get a single prompt field definition by its UUID.

List prompt field definitions with optional filters.

Update an existing prompt field definition. Only provided fields are modified.

Description is built at runtime.

Description is built at runtime.

Description is built at runtime.

Description is built at runtime.

Description is built at runtime.

Delete a property mapping by its UUID. This action is irreversible.

Get a single property mapping by its UUID (cross-type).

List all property mappings across all types.

Test a property mapping by UUID. Optionally provide user, context, and format_result.

List all available property mapping types that can be created.

Create a new provider of a specific type. Pass type-specific fields in the config object.

Delete a provider of a specific type by its numeric ID. This action is irreversible.

Get a single provider of a specific type by its numeric ID.

List providers of a specific type with optional filters.

Update an existing provider of a specific type. Pass type-specific fields in the config object.

Delete a provider by its numeric ID (cross-type). This action is irreversible.

Get a single provider by its numeric ID (cross-type).

List all providers across all types with optional filters.

Get OAuth2 provider setup URLs (authorize, token, userinfo, etc.).

Get SAML provider metadata XML.

List all available provider types.

Get WS-Federation provider metadata XML.

Preview the property-mapping output a WS-Federation provider would generate for a user.

Delete a RAC connection token by its UUID. This action is irreversible.

Get a single RAC connection token by its UUID.

List RAC connection tokens with optional filters. Tokens are system-managed (no create).

Create a new RAC endpoint for remote access.

Delete a RAC endpoint by its UUID. This action is irreversible.

Get a single RAC endpoint by its UUID.

List RAC (Remote Access Control) endpoints with optional filters.

Update an existing RAC endpoint. Only provided fields are modified (partial update).

Assign permission(s) to a role. When object_pk is set, permissions are only assigned to the specific object.

List object permissions assigned to a specific model, filterable by role.

Unassign permission(s) from a role. When object_pk is set, permissions are only unassigned from the specific object.

List all available permissions, filterable by model and app.

Add a user to a role by role UUID and user ID. Permissions are granted via roles.

Create a new RBAC role.

Delete an RBAC role by its UUID. This action is irreversible.

Get a single RBAC role by its UUID.

List RBAC roles with optional filters.

Remove a user from a role by role UUID and user ID.

Update an existing RBAC role. Only provided fields are modified (partial update).

Delete a data export by its ID. This action is irreversible.

Retrieve a single data export by its ID, including its content type, query parameters, file URL, and completion status.

List data exports with optional search and ordering. Each export records who requested it, when, the content type, and whether the file is ready for download.

Delete a reputation score by its UUID. This action is irreversible.

List reputation scores with optional filters.

Get root configuration including capabilities, error reporting settings, and UI configuration.

Description is built at runtime.

Description is built at runtime.

Description is built at runtime.

Description is built at runtime.

Description is built at runtime.

Delete a source by its slug. This action is irreversible.

Get a single source by its slug (cross-type).

List all sources across all types (OAuth, SAML, LDAP, Plex, Kerberos, SCIM).

Connect a user to a Telegram source using Telegram authentication data (login widget payload).

List all available source types that can be created.

List user-source connections across all source types.

Delete a Shared Signals Framework (SSF) event stream by its UUID. This action is irreversible.

Get a single SSF event stream by its UUID. Read-only.

List Shared Signals Framework (SSF) event streams with optional filters. Read-only.

Create a new stage of a specific type. Pass type-specific fields in the config object.

Delete a stage of a specific type by its UUID. This action is irreversible.

Get a single stage of a specific type by its UUID.

List stages of a specific type with optional filters.

Update an existing stage of a specific type. Pass type-specific fields in the config object.

Delete a stage by its UUID (cross-type). This action is irreversible.

Get a single stage by its UUID (cross-type).

List all stages across all types with optional filters.

List all available stage types.

Get details of a specific task by its message ID.

List background tasks with optional filters by actor name, queue, state, or search.

Retry a failed task by its message ID.

Create a new tenant.

Create an admin group for a tenant and add a user to it.

Create a recovery key for a user in a tenant.

Delete a tenant by its UUID. This action is irreversible and removes all tenant data.

Create a new domain for a tenant.

Delete a tenant domain by its numeric ID. This action is irreversible.

List tenant domains with optional filters.

Get a single tenant by its UUID.

List tenants with optional filters.

Update an existing tenant. Only provided fields are modified (partial update).

Create a new token with an identifier, optional intent, description, and expiration settings.

Delete a token by its identifier. This action is irreversible.

Get a single token by its identifier.

List tokens with optional filters for identifier, intent, managed status, and search.

Set a custom key value for a token. Requires authentik_core.set_token_key permission.

Update an existing token. Only provided fields are modified (partial update).

View the raw key value of a token. This is a privileged operation that is logged.

Lock down a user account, deactivating it and terminating its active sessions.

Create a new user. Use authentik_users_set_password to set the password after creation.

Create a new service account user with an optional associated group and token.

Delete a user by their numeric ID. This action is irreversible.

Trigger an export of users, producing a downloadable export artifact. Optional filters narrow which users are included.

Generate a temporary recovery link for a user to regain account access.

Get a single user by their numeric ID.

List users with optional filters for username, email, name, active status, superuser status, path, groups, and search.

List all user paths configured in the system.

Get information about the currently authenticated user.

Send a recovery email to a user using a specified email stage.

Set a new password for a user.

Update an existing user. Only provided fields are modified (partial update).