Skycloak

Import a Keycloak realm into a cluster from an uploaded archive or an existing realm export. Asynchronous: poll skycloak_get_realm_import. Creates a new realm: preflight refuses a name collision rather than overwriting, so an existing realm of the same name fails with 409. It does import users and their credentials, so set confirm=true to proceed.

Get a presigned URL to upload a realm archive to. PUT the archive to upload_url, then pass the returned s3_key to skycloak_create_realm_import as upload_s3_key. Not needed when importing an existing export: pass that export's ID as source_export_id instead.

Create a realm-scoped role.

Create a realm user with an initial temporary password.

Create a SIEM destination. Credentials are write-only and are not returned.

Create a webhook subscription. Signing secrets and authorization headers are write-only.

Delete an application (OIDC/SAML client) from a realm. Set confirm=true to proceed.

Delete a role from an application. Every user and group holding it loses it. Set confirm=true to proceed.

Permanently delete a Keycloak cluster and all of its realms and data. Irreversible. Set confirm=true to proceed.

Delete a cluster-specific maintenance window so the cluster follows the workspace default. Set confirm=true to proceed.

Remove a custom domain from a cluster. Set confirm=true to proceed.

Remove a realm route from a custom domain. Set confirm=true to proceed.

Revert email branding to defaults. Set confirm=true to proceed.

Delete a database export archive. Set confirm=true to proceed.

Delete a custom extension from the workspace catalog. Set confirm=true to proceed.

Delete an identity provider from a realm. Set confirm=true to proceed.

Revert login branding to defaults. Set confirm=true to proceed.

Permanently delete a realm and all of its users, clients and configuration. This is irreversible. Set confirm=true to proceed.

Delete a realm group. Set confirm=true to proceed.

Delete a realm role. Set confirm=true to proceed.

Delete a realm user. Set confirm=true to proceed.

Delete a SIEM destination. Set confirm=true to proceed.

Remove a realm's SMTP configuration. Set confirm=true to proceed.

Delete a custom theme. Set confirm=true to proceed. To change an existing theme's files, use skycloak_update_theme_content instead: deleting a theme that is still assigned returns 409, and re-uploading it gives a new ID.

Delete a webhook subscription. Set confirm=true to proceed.

Resolve an OIDC issuer's discovery document to obtain its authorization, token, and userinfo endpoints. Use the result when creating an identity provider.

Download a custom theme's content archive. Returns size and SHA-256 always, and the archive itself only when it is small enough to inline.

Export a cluster's events as a document and return its contents.

Get an application (OIDC/SAML client) by client ID.

Get one role defined on an application, with its description and Keycloak identifiers.

Get a client's login-theme override (empty means the realm default).

Get full details for a single Keycloak cluster by its ID.

Get a cluster's Keycloak automation client credentials for OAuth2 client_credentials. Needs a key with the clusters:credentials:read scope, which is not granted by default.

Get cluster analytics as a JSON document. type is one of: overview, authentication, events, performance, security.

Get a cluster-specific maintenance window. A 404 means the cluster follows the workspace default.

Get a cluster's edge-security configuration: IP allow-listing, rate limiting, WAF, geo-blocking, and bot management.

Get the recommended version-upgrade path for a cluster.

Get a custom domain by ID, including its DNS records and verification/SSL status.

Get a single realm route on a custom domain.

Get the email-template branding (colors, logo, footer) for a realm.

Get a database export job by ID, including its status, progress, and (once completed) the time-limited download URL.

Get an identity provider by provider ID.

Get the login-page branding (colors, logo, toggles) for a realm.

Read recent Keycloak server logs for a cluster, optionally filtered by level and a search string.

Get a realm by name.

Get a realm export job by ID. Poll this after skycloak_create_realm_export until status is 'completed'; the download URL only appears then and expires 24 hours later.

Get a realm group by ID.

Get a realm import job by ID. Poll this after skycloak_create_realm_import until status is 'completed' or 'failed'.

Get a realm role by name.

Get a realm user by ID.

Read recent security (WAF) logs for a cluster — blocked requests, attack types, source IPs.

Get a SIEM destination by ID.

Get a realm's SMTP configuration (secret values are never returned).

Get a custom theme by ID. restart_required is true when the theme's content was replaced under its exact name (see skycloak_get_theme_settings) and Keycloak has not restarted since, so the previous content may still be live; use skycloak_restart_cluster_instances to apply it.

Get the active custom theme per Keycloak theme type (login, account, admin, email) for a realm.

Get the workspace's theme naming policy: whether exact_theme_names is on. When on, every theme in the workspace is served from a folder named exactly like the theme, and that name never changes across content replaces. When off (the default), the served folder changes on each content replace, unless the theme was created by a platform migration.

Get a webhook subscription by ID.

Install a catalog extension on a cluster. Installation is asynchronous; poll skycloak_list_cluster_extensions until the status settles. Provide required parameters keyed by parameter name.

List the roles assigned to an application's service account.

List active user sessions for an application.

List the OIDC/SAML clients (applications) in a realm.

List hostnames registered for CAPTCHA protection on a cluster.

List the extensions currently installed on a cluster, with their installed version, the version available for the cluster's Keycloak, and upgrade status.

List the Keycloak feature flags available to tenant clusters.

List the deployment regions available to the workspace.

List the cluster types the workspace can provision.

List the version-upgrade history for a cluster.

List the Keycloak versions available for a cluster type.

List the Keycloak clusters in your Skycloak workspace, with their status, type, size, version and location.

List the realm routes configured on a custom domain.

List the custom domains configured on a cluster.

List the database export jobs for a cluster, with their status and expiry.

List the extension catalog available to the workspace (marketplace extensions that can be installed on a cluster).

List the pre-configured identity-provider templates. Use a template id when creating a provider.

List the identity providers (SSO connections) in a realm. Omit realm to cover every realm, and cluster_id to cover every cluster, so one call can answer an SSO question across the whole fleet.

List the users that belong to a realm group.

List the top-level groups in a realm.

List the realm-scoped roles in a realm.

List the users in a realm.

List the Keycloak realms in a Skycloak cluster.

List SIEM destinations configured for the workspace.

List the custom themes uploaded to a cluster, with their IDs, status, and theme types. restart_required is true on a theme whose replaced content is not live yet; see skycloak_get_theme_settings and skycloak_restart_cluster_instances.

List the groups a user belongs to.

List the realm roles assigned to a user.

List webhook event types. Optionally filter by source: platform or keycloak.

List webhook subscriptions. Optionally filter by source, cluster_id, and enabled.

Description is built at runtime.

Remove a role from an application's service account.

Remove a hostname from CAPTCHA protection on a cluster. Set confirm=true to proceed.

Remove a user from a realm group.

Remove a realm role from a user.

Restart a cluster's Keycloak instances, disrupting live traffic on it. Use this after skycloak_update_theme_settings turns exact_theme_names on: a theme whose content was replaced under its exact name only serves the new content once Keycloak restarts (see restart_required on skycloak_get_theme / skycloak_list_themes). Applies immediately unless the workspace latches disruptive changes to the maintenance window, in which case the result reports deferred=true and, when known, next_window (RFC3339). Returns a conflict when the cluster cannot restart right now: already busy with a restart or othe…

Regenerate an application's client secret and return the new value (shown only once).

Set a client's login-theme override. Pass a theme ID, or an empty string to reset to the realm default.

Create or replace a cluster-specific maintenance window.

Assign custom themes to a realm per Keycloak theme type. Pass a theme ID to activate it, or an empty string to reset that type to Keycloak's built-in default. Only the provided fields are changed.

Test connectivity to an identity provider, optionally overriding the client credentials for this test only.

Send a test event to a SIEM destination.

Send a test email through a realm's configured SMTP server to verify delivery.

Send a test event to a webhook subscription.

Uninstall an extension from a cluster. Set confirm=true to proceed.

Update an application's name, description, or redirect URIs.

Rename an application role or change its description. Fields you omit keep their current value.

Update a cluster's version (to trigger an upgrade) or size.

Update a cluster's edge-security configuration. Only the sections you provide are changed; CAPTCHA settings are preserved. Supports IP allow-listing, rate limiting, WAF, geo-blocking, and bot management.

Update a domain route's admin access and CORS origins.

Update a custom extension's name or description.

Update an identity provider's display name and enabled state.

Update a realm's display name and enabled state.

Rename a realm group.

Rename a realm role or change its description.

Update a realm user's profile (email, name, enabled, email_verified).

Update a SIEM destination. Only provided fields are changed; credentials remain write-only.

Update a theme's name, description, or version. Metadata only: use skycloak_update_theme_content to replace the theme's archive.

Replace an existing theme's archive with a new one, in place. The theme keeps its ID, its name and every realm and application assignment, and the new content deploys immediately, so this is the way to edit a theme: deleting and re-uploading detaches it and leaves the sign-in page unbranded in between. Pass the ZIP or Keycloakify JAR base64-encoded in content_base64. Set confirm=true to proceed: the archive being replaced is not recoverable afterwards. The replacement must still contain every theme type the theme provides today, or the API rejects it; a theme created by a platform migration ha…

Turn the workspace's exact_theme_names policy on or off. The caller's API key must have been minted for a workspace owner or admin; any other role, including a cluster admin, gets 403 even with themes:write. Turning it on moves every existing theme in the workspace to its exact served name in the background, not blocking this call; a theme that cannot move right away (its cluster is busy updating, say) moves on its next content replace instead. Turning it off changes nothing immediately: each theme keeps its current served folder until its next content replace, after which the folder changes o…

Update a webhook subscription. Use clear_authorization_header, clear_cluster_id, or clear_realm_id to remove nullable fields.

Upgrade an installed extension to the latest available version. Asynchronous.

Create or update email-template branding: color, light and dark logos, company URL and footer text. Fields you omit keep their current value.

Create or update login-page branding: colors, logo, favicon, font, terms and privacy links, the registration, remember-me, forgot-password and Powered by Skycloak toggles. Fields you omit keep their current value.

Create or update a realm's SMTP configuration (basic auth).

Trigger DNS verification for a custom domain and return its updated status.