core_transactional_applications_update

PUT /api/v3//core/transactional/applications/

Convert data into a blueprint, validate it and apply it

Request

application/json

Body

required

app

object

required

provider_model ProviderModelEnum (string)required

Possible values: [authentik_providers_google_workspace.googleworkspaceprovider, authentik_providers_ldap.ldapprovider, authentik_providers_microsoft_entra.microsoftentraprovider, authentik_providers_oauth2.oauth2provider, authentik_providers_proxy.proxyprovider, authentik_providers_rac.racprovider, authentik_providers_radius.radiusprovider, authentik_providers_saml.samlprovider, authentik_providers_scim.scimprovider]

provider

object

required

oneOf

GoogleWorkspaceProvider Serializer

name stringrequired

Possible values: non-empty

property_mappings uuid[]

property_mappings_group uuid[]

Property mappings used for group creation/updating.

delegated_subject emailrequired

Possible values: non-empty and <= 254 characters

credentials required

scopes string

Possible values: non-empty

exclude_users_service_account boolean

filter_group uuidnullable

user_delete_action OutgoingSyncDeleteAction (string)

Possible values: [do_nothing, delete, suspend]

group_delete_action OutgoingSyncDeleteAction (string)

Possible values: [do_nothing, delete, suspend]

default_group_email_domain stringrequired

Possible values: non-empty

LDAPProvider Serializer

name stringrequired

Possible values: non-empty

authentication_flow uuidnullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flow uuidrequired

Flow used when authorizing this provider.

invalidation_flow uuidrequired

Flow used ending the session from a provider.

property_mappings uuid[]

base_dn string

DN under which objects are accessible.

Possible values: non-empty

certificate uuidnullable

tls_server_name string

uid_start_number integer

The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber

Possible values: >= -2147483648 and <= 2147483647

gid_start_number integer

The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber

Possible values: >= -2147483648 and <= 2147483647

search_mode LDAPAPIAccessMode (string)

Possible values: [direct, cached]

bind_mode LDAPAPIAccessMode (string)

Possible values: [direct, cached]

mfa_support boolean

When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.

MicrosoftEntraProvider Serializer

name stringrequired

Possible values: non-empty

property_mappings uuid[]

property_mappings_group uuid[]

Property mappings used for group creation/updating.

client_id stringrequired

Possible values: non-empty

client_secret stringrequired

Possible values: non-empty

tenant_id stringrequired

Possible values: non-empty

exclude_users_service_account boolean

filter_group uuidnullable

user_delete_action OutgoingSyncDeleteAction (string)

Possible values: [do_nothing, delete, suspend]

group_delete_action OutgoingSyncDeleteAction (string)

Possible values: [do_nothing, delete, suspend]

OAuth2Provider Serializer

name stringrequired

Possible values: non-empty

authentication_flow uuidnullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flow uuidrequired

Flow used when authorizing this provider.

invalidation_flow uuidrequired

Flow used ending the session from a provider.

property_mappings uuid[]

client_type ClientTypeEnum (string)

Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable

Possible values: [confidential, public]

client_id string

Possible values: non-empty and <= 255 characters

client_secret string

Possible values: <= 255 characters

access_code_validity string

Access codes not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

access_token_validity string

Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

refresh_token_validity string

Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

include_claims_in_id_token boolean

Include User claims from scopes in the id_token, for applications that don't access the userinfo endpoint.

signing_key uuidnullable

Key used to sign the tokens.

encryption_key uuidnullable

Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.

redirect_uris

object[]

required

sub_mode SubModeEnum (string)

Configure what data should be used as unique User Identifier. For most cases, the default should be fine.

Possible values: [hashed_user_id, user_id, user_uuid, user_username, user_email, user_upn]

issuer_mode IssuerModeEnum (string)

Configure how the issuer field of the ID Token should be filled.

Possible values: [global, per_provider]

jwks_sources uuid[]

ProxyProvider Serializer

name stringrequired

Possible values: non-empty

authentication_flow uuidnullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flow uuidrequired

Flow used when authorizing this provider.

invalidation_flow uuidrequired

Flow used ending the session from a provider.

property_mappings uuid[]

internal_host uri

external_host urirequired

Possible values: non-empty

internal_host_ssl_validation boolean

Validate SSL Certificates of upstream servers

certificate uuidnullable

skip_path_regex string

Regular expressions for which authentication is not required. Each new line is interpreted as a new Regular Expression.

basic_auth_enabled Set HTTP-Basic Authentication (boolean)

Set a custom HTTP-Basic Authentication header based on values from authentik.

basic_auth_password_attribute HTTP-Basic Password Key (string)

User/Group Attribute used for the password part of the HTTP-Basic Header.

basic_auth_user_attribute HTTP-Basic Username Key (string)

User/Group Attribute used for the user part of the HTTP-Basic Header. If not set, the user's Email address is used.

mode ProxyMode (string)

Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.

Possible values: [proxy, forward_single, forward_domain]

intercept_header_auth boolean

When enabled, this provider will intercept the authorization header and authenticate requests based on its value.

cookie_domain string

jwks_sources uuid[]

access_token_validity string

Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

refresh_token_validity string

Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

RACProvider Serializer

name stringrequired

Possible values: non-empty

authentication_flow uuidnullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flow uuidrequired

Flow used when authorizing this provider.

property_mappings uuid[]

settings

connection_expiry string

Determines how long a session lasts. Default of 0 means that the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)

Possible values: non-empty

delete_token_on_disconnect boolean

When set to true, connection tokens will be deleted upon disconnect.

RadiusProvider Serializer

name stringrequired

Possible values: non-empty

authentication_flow uuidnullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flow uuidrequired

Flow used when authorizing this provider.

invalidation_flow uuidrequired

Flow used ending the session from a provider.

property_mappings uuid[]

client_networks string

List of CIDRs (comma-separated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.

Possible values: non-empty

shared_secret string

Shared secret between clients and server to hash packets.

Possible values: non-empty

mfa_support boolean

SAMLProvider Serializer

name stringrequired

Possible values: non-empty

authentication_flow uuidnullable

Flow used for authentication when the associated application is accessed by an un-authenticated user.

authorization_flow uuidrequired

Flow used when authorizing this provider.

invalidation_flow uuidrequired

Flow used ending the session from a provider.

property_mappings uuid[]

acs_url urirequired

Possible values: non-empty and <= 200 characters

audience string

Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.

issuer string

Also known as EntityID

Possible values: non-empty

assertion_valid_not_before string

Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).

Possible values: non-empty

assertion_valid_not_on_or_after string

Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

session_valid_not_on_or_after string

Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).

Possible values: non-empty

name_id_mapping uuidnullable

Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered

digest_algorithm DigestAlgorithmEnum (string)

Possible values: [http://www.w3.org/2000/09/xmldsig#sha1, http://www.w3.org/2001/04/xmlenc#sha256, http://www.w3.org/2001/04/xmldsig-more#sha384, http://www.w3.org/2001/04/xmlenc#sha512]

signature_algorithm SignatureAlgorithmEnum (string)

Possible values: [http://www.w3.org/2000/09/xmldsig#rsa-sha1, http://www.w3.org/2001/04/xmldsig-more#rsa-sha256, http://www.w3.org/2001/04/xmldsig-more#rsa-sha384, http://www.w3.org/2001/04/xmldsig-more#rsa-sha512, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512, http://www.w3.org/2000/09/xmldsig#dsa-sha1]

signing_kp uuidnullable

Keypair used to sign outgoing Responses going to the Service Provider.

verification_kp uuidnullable

When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.

encryption_kp uuidnullable

When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.

sign_assertion boolean

sign_response boolean

sp_binding SpBindingEnum (string)

This determines how authentik sends the response back to the Service Provider.

Possible values: [redirect, post]

default_relay_state string

Default relay_state value for IDP-initiated logins

SCIMProvider Serializer

name stringrequired

Possible values: non-empty

property_mappings uuid[]

property_mappings_group uuid[]

Property mappings used for group creation/updating.

url stringrequired

Base URL to SCIM requests, usually ends in /v2

Possible values: non-empty

verify_certificates boolean

token stringrequired

Authentication token

Possible values: non-empty

exclude_users_service_account boolean

filter_group uuidnullable

Responses

application/json

Schema
Example (from schema)

Schema

applied booleanrequired

logs string[]required

{
  "applied": true,
  "logs": [
    "string"
  ]
}

application/json

Schema
Example (from schema)

Schema

non_field_errors string[]

code string

property name* any

Validation Error

{
  "non_field_errors": [
    "string"
  ],
  "code": "string"
}

application/json

Schema
Example (from schema)

Schema

detail stringrequired

code string

{
  "detail": "string",
  "code": "string"
}

Authorization: http

name: authentiktype: httpscheme: bearer

HTTPCLIENT
RESTSHARP

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Put, "/api/v3/core/transactional/applications/");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("Authorization", "Bearer <TOKEN>");
var content = new StringContent("{\n  \"app\": {\n    \"name\": \"string\",\n    \"slug\": \"string\",\n    \"provider\": 0,\n    \"backchannel_providers\": [\n      0\n    ],\n    \"open_in_new_tab\": true,\n    \"meta_launch_url\": \"string\",\n    \"meta_description\": \"string\",\n    \"meta_publisher\": \"string\",\n    \"policy_engine_mode\": \"all\",\n    \"group\": \"string\"\n  },\n  \"provider_model\": \"authentik_providers_google_workspace.googleworkspaceprovider\",\n  \"provider\": {\n    \"name\": \"string\",\n    \"property_mappings\": [\n      \"3fa85f64-5717-4562-b3fc-2c963f66afa6\"\n    ],\n    \"property_mappings_group\": [\n      \"3fa85f64-5717-4562-b3fc-2c963f66afa6\"\n    ],\n    \"delegated_subject\": \"[email protected]\",\n    \"credentials\": {},\n    \"scopes\": \"string\",\n    \"exclude_users_service_account\": true,\n    \"filter_group\": \"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\n    \"user_delete_action\": \"do_nothing\",\n    \"group_delete_action\": \"do_nothing\",\n    \"default_group_email_domain\": \"string\"\n  }\n}", null, "application/json");
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Base URL

/api/v3

Auth

Bearer Token

Body required

{
  "app": {
    "name": "string",
    "slug": "string",
    "provider": 0,
    "backchannel_providers": [
      0
    ],
    "open_in_new_tab": true,
    "meta_launch_url": "string",
    "meta_description": "string",
    "meta_publisher": "string",
    "policy_engine_mode": "all",
    "group": "string"
  },
  "provider_model": "authentik_providers_google_workspace.googleworkspaceprovider",
  "provider": {
    "name": "string",
    "property_mappings": [
      "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    ],
    "property_mappings_group": [
      "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    ],
    "delegated_subject": "[email protected]",
    "credentials": {},
    "scopes": "string",
    "exclude_users_service_account": true,
    "filter_group": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "user_delete_action": "do_nothing",
    "group_delete_action": "do_nothing",
    "default_group_email_domain": "string"
  }
}

core_transactional_applications_update

/api/v3//core/transactional/applications/

Request​

Body

Responses​

Authorization: http

Request

Responses