website/docs/releases/2025/v2025.6.md
mTLS Stage: :ak-enterprise The Mutual TLS stage provides support for mTLS, a standard protocol that uses certificates for mutual authentication between a client and a server.
Email verification compatibility with link scanners: We have improved compatibility for environments that have automated scanning software that inadvertently invalidated one-time links sent by authentik.
LDAP source sync forward deletions: This option synchronizes the deletion of users and groups from LDAP sources to authentik.
Helm chart dependencies upgrades:
Deprecated and frozen :latest container image tag after 2025.2
Using the :latest tag with container images is not recommended as it can lead to unintentional updates and potentially broken setups. The tag will not be removed, however it will also not be updated past 2025.2. We strongly recommended the use of a specific version tag for authentik instances' container images, such as :2025.6.
CSS: We’ve made some improvements to our theming system. If your authentik instance uses custom CSS, you might need to review flow and user interfaces for any visual changes.
An integration is how authentik connects to third-party applications, directories, and other identity providers. The following integration guides were recently added to our documentation:
This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our Upgrade documentation.
:::warning When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommended that you always upgrade any outposts at the same time you upgrade your authentik instance. :::
To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:
wget -O docker-compose.yml https://goauthentik.io/version/2025.6/docker-compose.yml
docker compose up -d
The -O flag retains the downloaded file's name, overwriting any existing local file with the same name.
Upgrade the Helm Chart to the new version, using the following commands:
helm repo update
helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.6
OldAuthenticatedSession content type (#14507)name to Permissions search (#14269)add_user_to_group (#14312)GET /stages/mtls/POST /stages/mtls/GET /stages/mtls/{stage_uuid}/PUT /stages/mtls/{stage_uuid}/DELETE /stages/mtls/{stage_uuid}/PATCH /stages/mtls/{stage_uuid}/GET /stages/mtls/{stage_uuid}/used_by/GET /core/brands/{brand_uuid}/Changed response : 200 OK
application/json
Added property client_certificates (array)
Certificates used for client authentication.
Items (string):
PUT /core/brands/{brand_uuid}/Changed content type : application/json
client_certificates (array)
Certificates used for client authentication.
Changed response : 200 OK
application/json
client_certificates (array)
Certificates used for client authentication.
PATCH /core/brands/{brand_uuid}/Changed content type : application/json
client_certificates (array)
Certificates used for client authentication.
Changed response : 200 OK
application/json
client_certificates (array)
Certificates used for client authentication.
GET /policies/event_matcher/{policy_uuid}/Changed response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstagePUT /policies/event_matcher/{policy_uuid}/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstageChanged response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstagePATCH /policies/event_matcher/{policy_uuid}/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstageChanged response : 200 OK
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstagePOST /core/brands/Changed content type : application/json
client_certificates (array)
Certificates used for client authentication.
Changed response : 201 Created
application/json
client_certificates (array)
Certificates used for client authentication.
GET /core/brands/Added: client_certificates in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Brand Serializer
client_certificates (array)
Certificates used for client authentication.
POST /policies/event_matcher/Changed content type : application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstageChanged response : 201 Created
application/json
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstageGET /policies/event_matcher/Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > Event Matcher Policy Serializer
Changed property app (string)
Match events created by selected application. When left empty, all applications are matched.
Added enum value:
authentik.enterprise.stages.mtlsChanged property model (string)
Match events created by selected model. When left empty, all models are matched. When an app is selected, all the application's models are matched.
Added enum value:
authentik_stages_mtls.mutualtlsstagePOST /rbac/permissions/assigned_by_roles/{uuid}/assign/Changed content type : application/json
Changed property model (string)
Added enum value:
authentik_stages_mtls.mutualtlsstagePATCH /rbac/permissions/assigned_by_roles/{uuid}/unassign/Changed content type : application/json
Changed property model (string)
Added enum value:
authentik_stages_mtls.mutualtlsstagePOST /rbac/permissions/assigned_by_users/{id}/assign/Changed content type : application/json
Changed property model (string)
Added enum value:
authentik_stages_mtls.mutualtlsstagePATCH /rbac/permissions/assigned_by_users/{id}/unassign/Changed content type : application/json
Changed property model (string)
Added enum value:
authentik_stages_mtls.mutualtlsstageGET /sources/ldap/{slug}/Changed response : 200 OK
application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
PUT /sources/ldap/{slug}/Changed content type : application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
Changed response : 200 OK
application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
PATCH /sources/ldap/{slug}/Changed content type : application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
Changed response : 200 OK
application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
GET /rbac/permissions/assigned_by_roles/Changed: model in query
GET /rbac/permissions/assigned_by_users/Changed: model in query
POST /sources/ldap/Changed content type : application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
Changed response : 201 Created
application/json
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.
GET /sources/ldap/Added: delete_not_found_objects in query
Changed response : 200 OK
application/json
Changed property results (array)
Changed items (object): > LDAP Source Serializer
delete_not_found_objects (boolean)
Delete authentik users and groups which were previously supplied by this source, but are now missing from it.