openapi: 3.2.0
info:
  title: authentik Rac API
  version: 2026.11.0-rc1
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
  license:
    name: MIT
    url: https://github.com/goauthentik/authentik/blob/main/LICENSE
  x-source-url: https://api.goauthentik.io/schema.yml
  x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: rac
paths:
  /rac/connection_tokens/:
    get:
      operationId: rac_connection_tokens_list
      description: ConnectionToken Viewset
      parameters:
      - in: query
        name: endpoint
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - in: query
        name: provider
        schema:
          type: integer
      - $ref: '#/components/parameters/QuerySearch'
      - in: query
        name: session__user
        schema:
          type: integer
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedConnectionTokenList'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
  /rac/connection_tokens/{connection_token_uuid}/:
    get:
      operationId: rac_connection_tokens_retrieve
      description: ConnectionToken Viewset
      parameters:
      - in: path
        name: connection_token_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Connection token.
        required: true
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectionToken'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    put:
      operationId: rac_connection_tokens_update
      description: ConnectionToken Viewset
      parameters:
      - in: path
        name: connection_token_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Connection token.
        required: true
      tags:
      - rac
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectionTokenRequest'
        required: true
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectionToken'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    patch:
      operationId: rac_connection_tokens_partial_update
      description: ConnectionToken Viewset
      parameters:
      - in: path
        name: connection_token_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Connection token.
        required: true
      tags:
      - rac
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedConnectionTokenRequest'
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConnectionToken'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    delete:
      operationId: rac_connection_tokens_destroy
      description: ConnectionToken Viewset
      parameters:
      - in: path
        name: connection_token_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Connection token.
        required: true
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
  /rac/connection_tokens/{connection_token_uuid}/used_by/:
    get:
      operationId: rac_connection_tokens_used_by_list
      description: Get a list of all objects that use this object
      parameters:
      - in: path
        name: connection_token_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Connection token.
        required: true
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UsedBy'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
  /rac/endpoints/:
    get:
      operationId: rac_endpoints_list
      description: List accessible endpoints
      parameters:
      - $ref: '#/components/parameters/QueryName'
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - in: query
        name: provider
        schema:
          type: integer
      - $ref: '#/components/parameters/QuerySearch'
      - in: query
        name: superuser_full_list
        schema:
          type: boolean
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedEndpointList'
          description: ''
        '400':
          description: Bad request
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    post:
      operationId: rac_endpoints_create
      description: Endpoint Viewset
      tags:
      - rac
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EndpointRequest'
        required: true
      security:
      - authentik: []
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Endpoint'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
  /rac/endpoints/{pbm_uuid}/:
    get:
      operationId: rac_endpoints_retrieve
      description: Endpoint Viewset
      parameters:
      - in: path
        name: pbm_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Endpoint.
        required: true
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Endpoint'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    put:
      operationId: rac_endpoints_update
      description: Endpoint Viewset
      parameters:
      - in: path
        name: pbm_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Endpoint.
        required: true
      tags:
      - rac
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EndpointRequest'
        required: true
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Endpoint'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    patch:
      operationId: rac_endpoints_partial_update
      description: Endpoint Viewset
      parameters:
      - in: path
        name: pbm_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Endpoint.
        required: true
      tags:
      - rac
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedEndpointRequest'
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Endpoint'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    delete:
      operationId: rac_endpoints_destroy
      description: Endpoint Viewset
      parameters:
      - in: path
        name: pbm_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Endpoint.
        required: true
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
  /rac/endpoints/{pbm_uuid}/used_by/:
    get:
      operationId: rac_endpoints_used_by_list
      description: Get a list of all objects that use this object
      parameters:
      - in: path
        name: pbm_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this RAC Endpoint.
        required: true
      tags:
      - rac
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UsedBy'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
components:
  schemas:
    PatchedConnectionTokenRequest:
      type: object
      description: ConnectionToken Serializer
      properties:
        pk:
          type: string
          format: uuid
          title: Connection token uuid
        provider:
          type: integer
        endpoint:
          type: string
          format: uuid
    Pagination:
      type: object
      properties:
        next:
          type: number
        previous:
          type: number
        count:
          type: number
        current:
          type: number
        total_pages:
          type: number
        start_index:
          type: number
        end_index:
          type: number
      required:
      - count
      - current
      - end_index
      - next
      - previous
      - start_index
      - total_pages
    ProtocolEnum:
      enum:
      - rdp
      - vnc
      - ssh
      type: string
    Endpoint:
      type: object
      description: Endpoint Serializer
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Pbm uuid
        name:
          type: string
        provider:
          type: integer
        provider_obj:
          allOf:
          - $ref: '#/components/schemas/RACProvider'
          readOnly: true
        protocol:
          $ref: '#/components/schemas/ProtocolEnum'
        host:
          type: string
        settings:
          type: object
          additionalProperties: {}
        property_mappings:
          type: array
          items:
            type: string
            format: uuid
        auth_mode:
          $ref: '#/components/schemas/EndpointAuthModeEnum'
        launch_url:
          type:
          - string
          - 'null'
          description: 'Build actual launch URL (the provider itself does not have one, just

            individual endpoints)'
          readOnly: true
        maximum_connections:
          type: integer
          maximum: 2147483647
          minimum: -2147483648
      required:
      - auth_mode
      - host
      - launch_url
      - name
      - pk
      - protocol
      - provider
      - provider_obj
    EndpointAuthModeEnum:
      enum:
      - static
      - prompt
      type: string
    PaginatedConnectionTokenList:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/ConnectionToken'
        autocomplete:
          $ref: '#/components/schemas/Autocomplete'
      required:
      - autocomplete
      - pagination
      - results
    ConnectionTokenRequest:
      type: object
      description: ConnectionToken Serializer
      properties:
        pk:
          type: string
          format: uuid
          title: Connection token uuid
        provider:
          type: integer
        endpoint:
          type: string
          format: uuid
      required:
      - endpoint
      - provider
    PatchedEndpointRequest:
      type: object
      description: Endpoint Serializer
      properties:
        name:
          type: string
          minLength: 1
        provider:
          type: integer
        protocol:
          $ref: '#/components/schemas/ProtocolEnum'
        host:
          type: string
          minLength: 1
        settings:
          type: object
          additionalProperties: {}
        property_mappings:
          type: array
          items:
            type: string
            format: uuid
        auth_mode:
          $ref: '#/components/schemas/EndpointAuthModeEnum'
        maximum_connections:
          type: integer
          maximum: 2147483647
          minimum: -2147483648
    ValidationError:
      type: object
      description: Validation Error
      properties:
        non_field_errors:
          type: array
          items:
            type: string
        code:
          type: string
      additionalProperties: {}
    UsedByActionEnum:
      enum:
      - cascade
      - cascade_many
      - set_null
      - set_default
      - left_dangling
      type: string
    Autocomplete:
      type: object
      additionalProperties: {}
    EndpointRequest:
      type: object
      description: Endpoint Serializer
      properties:
        name:
          type: string
          minLength: 1
        provider:
          type: integer
        protocol:
          $ref: '#/components/schemas/ProtocolEnum'
        host:
          type: string
          minLength: 1
        settings:
          type: object
          additionalProperties: {}
        property_mappings:
          type: array
          items:
            type: string
            format: uuid
        auth_mode:
          $ref: '#/components/schemas/EndpointAuthModeEnum'
        maximum_connections:
          type: integer
          maximum: 2147483647
          minimum: -2147483648
      required:
      - auth_mode
      - host
      - name
      - protocol
      - provider
    PaginatedEndpointList:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/Endpoint'
        autocomplete:
          $ref: '#/components/schemas/Autocomplete'
      required:
      - autocomplete
      - pagination
      - results
    PartialUser:
      type: object
      description: Partial User Serializer, does not include child relations.
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        username:
          type: string
          description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
          pattern: ^[\w.@+-]+$
          maxLength: 150
        name:
          type: string
          description: User's display name.
        is_active:
          type: boolean
          title: Active
          description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
        last_login:
          type:
          - string
          - 'null'
          format: date-time
        email:
          type: string
          format: email
          title: Email address
          maxLength: 254
        attributes:
          type: object
          additionalProperties: {}
        uid:
          type: string
          readOnly: true
      required:
      - name
      - pk
      - uid
      - username
    RACProvider:
      type: object
      description: RACProvider Serializer
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        name:
          type: string
        authentication_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used for authentication when the associated application is accessed by an un-authenticated user.
        authorization_flow:
          type: string
          format: uuid
          description: Flow used when authorizing this provider.
        property_mappings:
          type: array
          items:
            type: string
            format: uuid
        component:
          type: string
          description: Get object component so that we know how to edit the object
          readOnly: true
        assigned_application_slug:
          type:
          - string
          - 'null'
          description: Internal application name, used in URLs.
          readOnly: true
        assigned_application_name:
          type:
          - string
          - 'null'
          description: Application's display Name.
          readOnly: true
        assigned_backchannel_application_slug:
          type:
          - string
          - 'null'
          description: Internal application name, used in URLs.
          readOnly: true
        assigned_backchannel_application_name:
          type:
          - string
          - 'null'
          description: Application's display Name.
          readOnly: true
        verbose_name:
          type: string
          description: Return object's verbose_name
          readOnly: true
        verbose_name_plural:
          type: string
          description: Return object's plural verbose_name
          readOnly: true
        meta_model_name:
          type: string
          description: Return internal model name
          readOnly: true
        settings:
          type: object
          additionalProperties: {}
        outpost_set:
          type: array
          items:
            type: string
          readOnly: true
        connection_expiry:
          type: string
          description: 'Determines how long a session lasts. Default of 0 means that the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)'
        delete_token_on_disconnect:
          type: boolean
          description: When set to true, connection tokens will be deleted upon disconnect.
      required:
      - assigned_application_name
      - assigned_application_slug
      - assigned_backchannel_application_name
      - assigned_backchannel_application_slug
      - authorization_flow
      - component
      - meta_model_name
      - name
      - outpost_set
      - pk
      - verbose_name
      - verbose_name_plural
    UsedBy:
      type: object
      description: A list of all objects referencing the queried object
      properties:
        app:
          type: string
        model_name:
          type: string
        pk:
          type: string
        name:
          type: string
        action:
          $ref: '#/components/schemas/UsedByActionEnum'
      required:
      - action
      - app
      - model_name
      - name
      - pk
    GenericError:
      type: object
      description: Generic API Error
      properties:
        detail:
          type: string
        code:
          type: string
      required:
      - detail
    ConnectionToken:
      type: object
      description: ConnectionToken Serializer
      properties:
        pk:
          type: string
          format: uuid
          title: Connection token uuid
        provider:
          type: integer
        provider_obj:
          allOf:
          - $ref: '#/components/schemas/RACProvider'
          readOnly: true
        endpoint:
          type: string
          format: uuid
        endpoint_obj:
          allOf:
          - $ref: '#/components/schemas/Endpoint'
          readOnly: true
        user:
          allOf:
          - $ref: '#/components/schemas/PartialUser'
          readOnly: true
      required:
      - endpoint
      - endpoint_obj
      - provider
      - provider_obj
      - user
  parameters:
    QueryPaginationOrdering:
      in: query
      name: ordering
      schema:
        type: string
      description: Which field to use when ordering the results.
    QuerySearch:
      in: query
      name: search
      schema:
        type: string
      description: A search term.
    QueryPaginationPage:
      in: query
      name: page
      schema:
        type: integer
      description: A page number within the paginated result set.
    QueryPaginationPageSize:
      in: query
      name: page_size
      schema:
        type: integer
      description: Number of results to return per page.
    QueryName:
      in: query
      name: name
      schema:
        type: string
  responses:
    GenericErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/GenericError'
      description: ''
    ValidationErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
      description: ''
  securitySchemes:
    authentik:
      type: http
      scheme: bearer
    authentik_device_auth:
      type: http
      scheme: bearer+agent
    authentik_device_enroll:
      type: http
      scheme: bearer
    authentik_device_federation:
      type: http
      scheme: bearer