website/docs/releases/2025/v2025.4.md
RBAC: Initial Permissions :ak-preview Provides more flexible access control by assigning permissions to the user/role creating a new object in authentik. Use Initial Permissions as a pragmatic way to implement the principle of least privilege.
Password History Policy :ak-enterprise A new policy (the Password Uniqueness policy) can be implemented to prevent users from reusing previous passwords; admins are able to configure how many previous password hashes the system will store and evaluate. This new policy makes it easier to enforce password reuse requirements, such as for FedRAMP compliance.
Provider Sync Dry Run :ak-preview Add the option for dry-run syncs for SCIM, Google Workspace, and Microsoft Entra providers to preview the results of a sync without affecting live accounts.
Reputation score limit: The default values for the new upper and lower limits on Reputation score are -5 and 5. This could break custom policies that rely on the reputation scores decreasing or increasing beyond these limits. You can set your custom limits under System > Settings.
Deprecated and frozen :latest container image tag after 2025.2
Using the :latest tag with container images is not recommended as it can lead to unintentional updates and potentially broken setups.
The tag will not be removed, however it will also not be updated past 2025.2.
We strongly recommended the use of a specific version tag for authentik instances' container images, such as :2025.4.
Helm chart dependencies update: Following Bitnami's changes to only publish latest version of containers, the Helm chart dependencies (PostgreSQL and Redis) will now be updated with each release.
For this release:
15.8.0-debian-12-r18.For the next release:
17. This will require following PostgreSQL major upgrade steps, for which we provide documentation.For subsequent releases:
We encourage users to pin their PostgreSQL image version.
Previously, sessions were stored by default in the cache. Now, they are stored in the database. This allows for numerous other performance improvements. On high traffic instances, requests to old instances after the upgrade has started will fail to authenticate.
Remember me: Users can now choose to skip entering their usernames after their first login on the same device. This feature is optional and admins can enable it in the Identification stage.
RBAC: Initial Permissions
In hardened authentik installations, it is possible for a user to have permission to create an object type, but not to view/change/delete(/etc) objects of that type. Previously, this could result in a user creating an object and then not having any access to that object. InitialPermissions is a mechanism to automatically add permissions to any object on creation. Refer to our documentation for more details.
Reputation score limit
Reputation scores now have a configurable numerical limit in addition to the already existing temporal limit.
Password History Policy: See description under Highlights. Refer to our documentation.
Improve membership resolution for the LDAP Source: See description under Highlights. Refer to our documentation.
Provider Sync Dry Run: See description under Highlights.
Gateway API support :ak-preview
For Kubernetes users, authentik now supports the Gateway API. The Helm chart supports HTTPRoute. The Kubernetes outpost integrations supports creating HTTPRoute objects for Proxy providers. Refer to our documentation.
An integration is a how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added.
This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our Upgrade documentation.
:::warning When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommended that you always upgrade any outposts at the same time you upgrade your authentik instance. :::
To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:
wget -O docker-compose.yml https://goauthentik.io/version/2025.4/docker-compose.yml
docker compose up -d
The -O flag retains the downloaded file's name, overwriting any existing local file with the same name.
Upgrade the Helm Chart to the new version, using the following commands:
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.4
InitialPermissions (#13795)name to Permissions search (#14269)remember me feature to IdentificationStage (#10397)remember me feature to IdentificationStage (#10397)" (#14212)OldAuthenticatedSession content type (cherry-pick #14507) (#14509)add_user_to_group (cherry-pick #14312) (#14334)GET /policies/unique_password/POST /policies/unique_password/GET /policies/unique_password/{policy_uuid}/PUT /policies/unique_password/{policy_uuid}/DELETE /policies/unique_password/{policy_uuid}/PATCH /policies/unique_password/{policy_uuid}/GET /policies/unique_password/{policy_uuid}/used_by/GET /rbac/initial_permissions/POST /rbac/initial_permissions/GET /rbac/initial_permissions/{id}/PUT /rbac/initial_permissions/{id}/DELETE /rbac/initial_permissions/{id}/PATCH /rbac/initial_permissions/{id}/GET /rbac/initial_permissions/{id}/used_by/GET /sources/group_connections/all/GET /sources/group_connections/all/{id}/PUT /sources/group_connections/all/{id}/DELETE /sources/group_connections/all/{id}/PATCH /sources/group_connections/all/{id}/GET /sources/group_connections/all/{id}/used_by/GET /sources/group_connections/ldap/POST /sources/group_connections/ldap/GET /sources/group_connections/ldap/{id}/PUT /sources/group_connections/ldap/{id}/DELETE /sources/group_connections/ldap/{id}/PATCH /sources/group_connections/ldap/{id}/GET /sources/group_connections/ldap/{id}/used_by/GET /sources/user_connections/ldap/POST /sources/user_connections/ldap/GET /sources/user_connections/ldap/{id}/PUT /sources/user_connections/ldap/{id}/DELETE /sources/user_connections/ldap/{id}/PATCH /sources/user_connections/ldap/{id}/GET /sources/user_connections/ldap/{id}/used_by/POST /sources/group_connections/kerberos/POST /sources/group_connections/saml/GET /admin/settings/Changed response : 200 OK
application/json
Added property reputation_lower_limit (integer)
Reputation cannot decrease lower than this value. Zero or negative.
Added property reputation_upper_limit (integer)
Reputation cannot increase higher than this value. Zero or positive.
PUT /admin/settings/Changed content type : application/json
Added property reputation_lower_limit (integer)
Reputation cannot decrease lower than this value. Zero or negative.
Added property reputation_upper_limit (integer)
Reputation cannot increase higher than this value. Zero or positive.
Changed response : 200 OK
application/json
Added property reputation_lower_limit (integer)
Reputation cannot decrease lower than this value. Zero or negative.
Added property reputation_upper_limit (integer)
Reputation cannot increase higher than this value. Zero or positive.
PATCH /admin/settings/Changed content type : application/json
Added property reputation_lower_limit (integer)
Reputation cannot decrease lower than this value. Zero or negative.
Added property reputation_upper_limit (integer)
Reputation cannot increase higher than this value. Zero or positive.
Changed response : 200 OK
application/json
Added property reputation_lower_limit (integer)
Reputation cannot decrease lower than this value. Zero or negative.
Added property reputation_upper_limit (integer)
Reputation cannot increase higher than this value. Zero or positive.
GET /core/authenticated_sessions/{uuid}/Changed: uuid in path
Changed response : 200 OK
Changed content type : application/json
New required properties:
expireslast_user_agentChanged property last_ip (string)
Changed property last_user_agent (string)
Changed property expires (string)
DELETE /core/authenticated_sessions/{uuid}/Changed: uuid in path
GET /core/brands/{brand_uuid}/Changed response : 200 OK
application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
PUT /core/brands/{brand_uuid}/Changed content type : application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
Changed response : 200 OK
application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
PATCH /core/brands/{brand_uuid}/Changed content type : application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
Changed response : 200 OK
application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
GET /policies/event_matcher/{policy_uuid}/Changed response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyPUT /policies/event_matcher/{policy_uuid}/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyChanged response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyPATCH /policies/event_matcher/{policy_uuid}/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyChanged response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyGET /providers/scim/{id}/Changed response : 200 OK
application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Enum values:
defaultawsslackAdded property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
PUT /providers/scim/{id}/Changed content type : application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 200 OK
application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
PATCH /providers/scim/{id}/Changed content type : application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 200 OK
application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
GET /providers/scim_groups/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
attributesattributes (object)GET /providers/scim_users/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
attributesattributes (object)GET /core/authenticated_sessions/Added: session__last_ip in query
Added: session__last_user_agent in query
Deleted: last_ip in query
Deleted: last_user_agent in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > AuthenticatedSession Serializer
New required properties:
expireslast_user_agentChanged property last_ip (string)
Changed property last_user_agent (string)
Changed property expires (string)
GET /core/authenticated_sessions/{uuid}/used_by/Changed: uuid in path
POST /core/brands/Changed content type : application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
Changed response : 201 Created
application/json
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
GET /core/brands/Added: branding_default_flow_background in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Brand Serializer
Added property branding_custom_css (string)
Added property branding_default_flow_background (string)
GET /core/brands/current/Changed response : 200 OK
Changed content type : application/json
New required properties:
branding_custom_cssbranding_custom_css (string)GET /core/tokens/{identifier}/Changed response : 200 OK
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PUT /core/tokens/{identifier}/Changed response : 200 OK
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PATCH /core/tokens/{identifier}/Changed response : 200 OK
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /core/users/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
date_joineddate_joined (string)PUT /core/users/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
date_joineddate_joined (string)PATCH /core/users/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
date_joineddate_joined (string)GET /events/transports/{uuid}/Changed response : 200 OK
application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
PUT /events/transports/{uuid}/Changed content type : application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
Changed response : 200 OK
application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
PATCH /events/transports/{uuid}/Changed content type : application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
Changed response : 200 OK
application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
GET /policies/bindings/{policy_binding_uuid}/Changed response : 200 OK
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PUT /policies/bindings/{policy_binding_uuid}/Changed response : 200 OK
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PATCH /policies/bindings/{policy_binding_uuid}/Changed response : 200 OK
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)POST /policies/event_matcher/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyChanged response : 201 Created
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyGET /policies/event_matcher/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Event Matcher Policy Serializer
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.policies.unique_passwordChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyGET /providers/google_workspace/{id}/Changed response : 200 OK
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
PUT /providers/google_workspace/{id}/Changed content type : application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 200 OK
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
PATCH /providers/google_workspace/{id}/Changed content type : application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 200 OK
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
GET /providers/microsoft_entra/{id}/Changed response : 200 OK
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
PUT /providers/microsoft_entra/{id}/Changed content type : application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 200 OK
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
PATCH /providers/microsoft_entra/{id}/Changed content type : application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 200 OK
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
GET /providers/saml/{id}/Changed response : 200 OK
application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
PUT /providers/saml/{id}/Changed content type : application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
Changed response : 200 OK
application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
PATCH /providers/saml/{id}/Changed content type : application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
Changed response : 200 OK
application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
POST /providers/scim/Changed content type : application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 201 Created
application/json
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
GET /providers/scim/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SCIMProvider Serializer
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
POST /providers/scim_groups/Changed response : 201 Created
Changed content type : application/json
New required properties:
attributesattributes (object)GET /providers/scim_groups/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SCIMProviderGroup Serializer
New required properties:
attributesattributes (object)POST /providers/scim_users/Changed response : 201 Created
Changed content type : application/json
New required properties:
attributesattributes (object)GET /providers/scim_users/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SCIMProviderUser Serializer
New required properties:
attributesattributes (object)GET /providers/ssf/{id}/Changed response : 200 OK
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PUT /providers/ssf/{id}/Changed response : 200 OK
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PATCH /providers/ssf/{id}/Changed response : 200 OK
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)POST /rbac/permissions/assigned_by_roles/{uuid}/assign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyPATCH /rbac/permissions/assigned_by_roles/{uuid}/unassign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyPOST /rbac/permissions/assigned_by_users/{id}/assign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyPATCH /rbac/permissions/assigned_by_users/{id}/unassign/Changed content type : application/json
Changed property model (string)
Added enum values:
authentik_rbac.initialpermissionsauthentik_sources_ldap.userldapsourceconnectionauthentik_sources_ldap.groupldapsourceconnectionauthentik_policies_unique_password.uniquepasswordpolicyDELETE /sources/all/{slug}/GET /sources/group_connections/kerberos/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/group_connections/kerberos/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/group_connections/kerberos/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/group_connections/oauth/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/group_connections/oauth/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/group_connections/oauth/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/group_connections/plex/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/group_connections/plex/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/group_connections/plex/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/group_connections/saml/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/group_connections/saml/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/group_connections/saml/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/ldap/{slug}/Changed response : 200 OK
application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
PUT /sources/ldap/{slug}/Changed content type : application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
Changed response : 200 OK
application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
PATCH /sources/ldap/{slug}/Changed content type : application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
Changed response : 200 OK
application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
GET /sources/oauth/{slug}/Changed response : 200 OK
application/json
Added property authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
Enum values:
basic_authpost_bodyPUT /sources/oauth/{slug}/Changed content type : application/json
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
Changed response : 200 OK
application/json
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
PATCH /sources/oauth/{slug}/Changed content type : application/json
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
Changed response : 200 OK
application/json
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
GET /sources/saml/{slug}/Changed response : 200 OK
application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
PUT /sources/saml/{slug}/Changed content type : application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
Changed response : 200 OK
application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
PATCH /sources/saml/{slug}/Changed content type : application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
Changed response : 200 OK
application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
GET /sources/scim/{slug}/Changed response : 200 OK
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PUT /sources/scim/{slug}/Changed response : 200 OK
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)PATCH /sources/scim/{slug}/Changed response : 200 OK
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /sources/user_connections/all/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
identifierlast_updatedAdded property identifier (string)
Added property last_updated (string)
PUT /sources/user_connections/all/{id}/Changed content type : application/json
New required properties:
identifieridentifier (string)Changed response : 200 OK
Changed content type : application/json
New required properties:
identifierlast_updatedAdded property identifier (string)
Added property last_updated (string)
PATCH /sources/user_connections/all/{id}/Changed content type : application/json
identifier (string)Changed response : 200 OK
Changed content type : application/json
New required properties:
identifierlast_updatedAdded property identifier (string)
Added property last_updated (string)
DELETE /sources/user_connections/kerberos/{id}/GET /sources/user_connections/kerberos/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/user_connections/kerberos/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/user_connections/kerberos/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)DELETE /sources/user_connections/oauth/{id}/GET /sources/user_connections/oauth/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedAdded property last_updated (string)
Changed property identifier (string)
PUT /sources/user_connections/oauth/{id}/Changed content type : application/json
identifier (string)Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedAdded property last_updated (string)
Changed property identifier (string)
PATCH /sources/user_connections/oauth/{id}/Changed content type : application/json
identifier (string)Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedAdded property last_updated (string)
Changed property identifier (string)
DELETE /sources/user_connections/plex/{id}/GET /sources/user_connections/plex/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/user_connections/plex/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/user_connections/plex/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)DELETE /sources/user_connections/saml/{id}/GET /sources/user_connections/saml/{id}/Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PUT /sources/user_connections/saml/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)PATCH /sources/user_connections/saml/{id}/Changed content type : application/json
Changed response : 200 OK
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /ssf/streams/{uuid}/Changed response : 200 OK
application/json
Changed property provider_obj (object)
SSFProvider Serializer
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)POST /core/tokens/Changed response : 201 Created
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /core/tokens/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /core/user_consent/{id}/Changed response : 200 OK
application/json
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)POST /core/users/Changed response : 201 Created
Changed content type : application/json
New required properties:
date_joineddate_joined (string)GET /core/users/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > User Serializer
New required properties:
date_joineddate_joined (string)POST /events/transports/Changed content type : application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
Changed response : 201 Created
application/json
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
GET /events/transports/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > NotificationTransport Serializer
Added property webhook_mapping_body (string)
Customize the body of the request. Mapping should return data that is JSON-serializable.
Added property webhook_mapping_headers (string)
Configure additional headers to be sent. Mapping should return a dictionary of key-value pairs
Deleted property webhook_mapping (string)
POST /policies/bindings/Changed response : 201 Created
application/json
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /policies/bindings/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > PolicyBinding Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)POST /providers/google_workspace/Changed content type : application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 201 Created
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
GET /providers/google_workspace/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > GoogleWorkspaceProvider Serializer
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
POST /providers/google_workspace/{id}/sync/object/Changed content type : application/json
override_dry_run (boolean)POST /providers/microsoft_entra/Changed content type : application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Changed response : 201 Created
application/json
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
GET /providers/microsoft_entra/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > MicrosoftEntraProvider Serializer
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
POST /providers/microsoft_entra/{id}/sync/object/Changed content type : application/json
override_dry_run (boolean)POST /providers/saml/Changed content type : application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
Changed response : 201 Created
application/json
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
GET /providers/saml/Added: authn_context_class_ref_mapping in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SAMLProvider Serializer
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
POST /providers/scim/{id}/sync/object/Changed content type : application/json
override_dry_run (boolean)POST /providers/ssf/Changed response : 201 Created
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /providers/ssf/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SSFProvider Serializer
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /rbac/permissions/assigned_by_roles/Changed: model in query
GET /rbac/permissions/assigned_by_users/Changed: model in query
GET /sources/group_connections/kerberos/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Group Source Connection
New required properties:
last_updatedlast_updated (string)POST /sources/group_connections/oauth/Changed content type : application/json
Changed response : 201 Created
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/group_connections/oauth/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Group Source Connection
New required properties:
last_updatedlast_updated (string)POST /sources/group_connections/plex/Changed content type : application/json
Changed response : 201 Created
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/group_connections/plex/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Group Source Connection
New required properties:
last_updatedlast_updated (string)GET /sources/group_connections/saml/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Group Source Connection
New required properties:
last_updatedlast_updated (string)POST /sources/ldap/Changed content type : application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
Changed response : 201 Created
application/json
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
GET /sources/ldap/Added: lookup_groups_from_user in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > LDAP Source Serializer
lookup_groups_from_user (boolean)
Lookup group membership based on a user attribute instead of a group attribute. This allows nested group resolution on systems like FreeIPA and Active Directory
POST /sources/oauth/Changed content type : application/json
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
Changed response : 201 Created
application/json
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
GET /sources/oauth/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > OAuth Source Serializer
authorization_code_auth_method (object)
How to perform authentication during an authorization_code token request flow
POST /sources/saml/Changed content type : application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
Changed response : 201 Created
application/json
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
GET /sources/saml/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SAMLSource Serializer
Changed property sso_url (string)
URL that the initial Login request is sent to.
Changed property slo_url (string)
Optional URL if your IDP supports Single-Logout.
POST /sources/scim/Changed response : 201 Created
application/json
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /sources/scim/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SCIMSource Serializer
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /sources/user_connections/all/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > User source connection
New required properties:
identifierlast_updatedAdded property identifier (string)
Added property last_updated (string)
POST /sources/user_connections/kerberos/Changed content type : application/json
Changed response : 201 Created
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/user_connections/kerberos/Added: user in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > User source connection
New required properties:
last_updatedlast_updated (string)POST /sources/user_connections/oauth/Changed content type : application/json
identifier (string)Changed response : 201 Created
Changed content type : application/json
New required properties:
last_updatedAdded property last_updated (string)
Changed property identifier (string)
GET /sources/user_connections/oauth/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > User source connection
New required properties:
last_updatedAdded property last_updated (string)
Changed property identifier (string)
POST /sources/user_connections/plex/Changed content type : application/json
Changed response : 201 Created
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/user_connections/plex/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > User source connection
New required properties:
last_updatedlast_updated (string)POST /sources/user_connections/saml/Changed content type : application/json
Changed response : 201 Created
Changed content type : application/json
New required properties:
last_updatedlast_updated (string)GET /sources/user_connections/saml/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > User source connection
New required properties:
last_updatedlast_updated (string)GET /ssf/streams/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > SSFStream Serializer
Changed property provider_obj (object)
SSFProvider Serializer
Changed property token_obj (object)
Token Serializer
Changed property user_obj (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /stages/email/{stage_uuid}/Changed response : 200 OK
application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
PUT /stages/email/{stage_uuid}/Changed content type : application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
Changed response : 200 OK
application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
PATCH /stages/email/{stage_uuid}/Changed content type : application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
Changed response : 200 OK
application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
GET /stages/identification/{stage_uuid}/Changed response : 200 OK
application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
PUT /stages/identification/{stage_uuid}/Changed content type : application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
Changed response : 200 OK
application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
PATCH /stages/identification/{stage_uuid}/Changed content type : application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
Changed response : 200 OK
application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
GET /core/user_consent/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > UserConsent Serializer
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /flows/executor/{flow_slug}/Changed response : 200 OK
Changed content type : application/json
Updated ak-stage-identification component:
enable_remember_me (boolean)POST /flows/executor/{flow_slug}/Changed response : 200 OK
Changed content type : application/json
Updated ak-stage-identification component:
enable_remember_me (boolean)GET /oauth2/access_tokens/{id}/Changed response : 200 OK
application/json
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /oauth2/authorization_codes/{id}/Changed response : 200 OK
application/json
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /oauth2/refresh_tokens/{id}/Changed response : 200 OK
application/json
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)POST /stages/email/Changed content type : application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
Changed response : 201 Created
application/json
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
GET /stages/email/Changed: token_expiry in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > EmailStage Serializer
token_expiry (integer -> string)
Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).
POST /stages/identification/Changed content type : application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
Changed response : 201 Created
application/json
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
GET /stages/identification/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > IdentificationStage Serializer
enable_remember_me (boolean)
Show the user the 'Remember me on this device' toggle, allowing repeat users to skip straight to entering their password.
PUT /core/transactional/applications/Changed content type : application/json
Changed property provider (object)
Updated authentik_providers_microsoft_entra.microsoftentraprovider provider_model:
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Updated authentik_providers_scim.scimprovider provider_model:
Added property compatibility_mode (object)
Alter authentik behavior for vendor-specific SCIM implementations.
Added property dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Updated authentik_providers_google_workspace.googleworkspaceprovider provider_model:
dry_run (boolean)
When enabled, provider will not modify or create objects in the remote system.
Updated authentik_providers_saml.samlprovider provider_model:
Added property authn_context_class_ref_mapping (string)
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
Changed property acs_url (string)
GET /oauth2/access_tokens/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Serializer for BaseGrantModel and RefreshToken
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /oauth2/authorization_codes/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)GET /oauth2/refresh_tokens/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Serializer for BaseGrantModel and RefreshToken
Changed property user (object)
User Serializer
New required properties:
date_joineddate_joined (string)