openapi: 3.2.0
info:
  title: authentik Ssf API
  version: 2026.11.0-rc1
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
  license:
    name: MIT
    url: https://github.com/goauthentik/authentik/blob/main/LICENSE
  x-source-url: https://api.goauthentik.io/schema.yml
  x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: ssf
paths:
  /ssf/streams/:
    get:
      operationId: ssf_streams_list
      description: SSFStream Viewset
      parameters:
      - in: query
        name: delivery_method
        schema:
          $ref: '#/components/schemas/DeliveryMethodEnum'
      - in: query
        name: endpoint_url
        schema:
          type: string
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - in: query
        name: provider
        schema:
          type: integer
      - $ref: '#/components/parameters/QuerySearch'
      tags:
      - ssf
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedSSFStreamList'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
  /ssf/streams/{uuid}/:
    get:
      operationId: ssf_streams_retrieve
      description: SSFStream Viewset
      parameters:
      - in: path
        name: uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this SSF Stream.
        required: true
      tags:
      - ssf
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SSFStream'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
    delete:
      operationId: ssf_streams_destroy
      description: SSFStream Viewset
      parameters:
      - in: path
        name: uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this SSF Stream.
        required: true
      tags:
      - ssf
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
components:
  parameters:
    QueryPaginationOrdering:
      in: query
      name: ordering
      schema:
        type: string
      description: Which field to use when ordering the results.
    QuerySearch:
      in: query
      name: search
      schema:
        type: string
      description: A search term.
    QueryPaginationPage:
      in: query
      name: page
      schema:
        type: integer
      description: A page number within the paginated result set.
    QueryPaginationPageSize:
      in: query
      name: page_size
      schema:
        type: integer
      description: Number of results to return per page.
  schemas:
    SSFStream:
      type: object
      description: SSFStream Serializer
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Uuid
        status:
          $ref: '#/components/schemas/SSFStreamStatusEnum'
        provider:
          type: integer
        provider_obj:
          allOf:
          - $ref: '#/components/schemas/SSFProvider'
          readOnly: true
        delivery_method:
          $ref: '#/components/schemas/DeliveryMethodEnum'
        endpoint_url:
          type:
          - string
          - 'null'
        events_requested:
          type: array
          items:
            $ref: '#/components/schemas/EventsRequestedEnum'
        format:
          type: string
        aud:
          type: array
          items:
            type: string
        iss:
          type: string
      required:
      - delivery_method
      - format
      - iss
      - pk
      - provider
      - provider_obj
    Token:
      type: object
      description: Token Serializer
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Token uuid
        managed:
          type:
          - string
          - 'null'
          title: Managed by authentik
          description: Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
        identifier:
          type: string
          maxLength: 255
          pattern: ^[-a-zA-Z0-9_]+$
        intent:
          $ref: '#/components/schemas/IntentEnum'
        user:
          type: integer
        user_obj:
          allOf:
          - $ref: '#/components/schemas/User'
          readOnly: true
        description:
          type: string
        expires:
          type:
          - string
          - 'null'
          format: date-time
        expiring:
          type: boolean
      required:
      - identifier
      - pk
      - user_obj
    Role:
      type: object
      description: Role serializer
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Uuid
        name:
          type: string
      required:
      - name
      - pk
    SSFProvider:
      type: object
      description: SSFProvider Serializer
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        name:
          type: string
        component:
          type: string
          description: Get object component so that we know how to edit the object
          readOnly: true
        verbose_name:
          type: string
          description: Return object's verbose_name
          readOnly: true
        verbose_name_plural:
          type: string
          description: Return object's plural verbose_name
          readOnly: true
        meta_model_name:
          type: string
          description: Return internal model name
          readOnly: true
        signing_key:
          type: string
          format: uuid
          description: Key used to sign the SSF Events.
        token_obj:
          allOf:
          - $ref: '#/components/schemas/Token'
          readOnly: true
        oidc_auth_providers:
          type: array
          items:
            type: integer
        oidc_auth_providers_obj:
          type: array
          items:
            $ref: '#/components/schemas/Provider'
          readOnly: true
        ssf_url:
          type:
          - string
          - 'null'
          readOnly: true
        event_retention:
          type: string
        push_verify_certificates:
          type: boolean
      required:
      - component
      - meta_model_name
      - name
      - oidc_auth_providers_obj
      - pk
      - signing_key
      - ssf_url
      - token_obj
      - verbose_name
      - verbose_name_plural
    Provider:
      type: object
      description: Provider Serializer
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        name:
          type: string
        authentication_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used for authentication when the associated application is accessed by an un-authenticated user.
        authorization_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used when authorizing this provider.
        invalidation_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used ending the session from a provider.
        property_mappings:
          type: array
          items:
            type: string
            format: uuid
        component:
          type: string
          description: Get object component so that we know how to edit the object
          readOnly: true
        assigned_application_slug:
          type:
          - string
          - 'null'
          description: Internal application name, used in URLs.
          readOnly: true
        assigned_application_name:
          type:
          - string
          - 'null'
          description: Application's display Name.
          readOnly: true
        assigned_backchannel_application_slug:
          type:
          - string
          - 'null'
          description: Internal application name, used in URLs.
          readOnly: true
        assigned_backchannel_application_name:
          type:
          - string
          - 'null'
          description: Application's display Name.
          readOnly: true
        verbose_name:
          type: string
          description: Return object's verbose_name
          readOnly: true
        verbose_name_plural:
          type: string
          description: Return object's plural verbose_name
          readOnly: true
        meta_model_name:
          type: string
          description: Return internal model name
          readOnly: true
      required:
      - assigned_application_name
      - assigned_application_slug
      - assigned_backchannel_application_name
      - assigned_backchannel_application_slug
      - component
      - meta_model_name
      - name
      - pk
      - verbose_name
      - verbose_name_plural
    EventsRequestedEnum:
      enum:
      - https://schemas.openid.net/secevent/caep/event-type/session-revoked
      - https://schemas.openid.net/secevent/caep/event-type/token-claims-change
      - https://schemas.openid.net/secevent/caep/event-type/credential-change
      - https://schemas.openid.net/secevent/caep/event-type/assurance-level-change
      - https://schemas.openid.net/secevent/caep/event-type/device-compliance-change
      - https://schemas.openid.net/secevent/caep/event-type/session-established
      - https://schemas.openid.net/secevent/caep/event-type/session-presented
      - https://schemas.openid.net/secevent/caep/event-type/risk-level-change
      - https://schemas.openid.net/secevent/ssf/event-type/verification
      type: string
    Pagination:
      type: object
      properties:
        next:
          type: number
        previous:
          type: number
        count:
          type: number
        current:
          type: number
        total_pages:
          type: number
        start_index:
          type: number
        end_index:
          type: number
      required:
      - count
      - current
      - end_index
      - next
      - previous
      - start_index
      - total_pages
    IntentEnum:
      enum:
      - verification
      - api
      - recovery
      - app_password
      type: string
    UserTypeEnum:
      enum:
      - internal
      - external
      - service_account
      - internal_service_account
      type: string
    User:
      type: object
      description: User Serializer
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        username:
          type: string
          maxLength: 150
        name:
          type: string
          description: User's display name.
        is_active:
          type: boolean
          title: Active
          description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
        last_login:
          type:
          - string
          - 'null'
          format: date-time
        date_joined:
          type: string
          format: date-time
          readOnly: true
        is_superuser:
          type: boolean
          readOnly: true
        groups:
          type: array
          items:
            type: string
            format: uuid
        groups_obj:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/PartialGroup'
          readOnly: true
        roles:
          type: array
          items:
            type: string
            format: uuid
        roles_obj:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/Role'
          readOnly: true
        email:
          type: string
          format: email
          title: Email address
          maxLength: 254
        avatar:
          type: string
          description: User's avatar, either a http/https URL or a data URI
          readOnly: true
        attributes:
          type: object
          additionalProperties: {}
        uid:
          type: string
          readOnly: true
        path:
          type: string
        type:
          $ref: '#/components/schemas/UserTypeEnum'
        uuid:
          type: string
          format: uuid
          readOnly: true
        password_change_date:
          type: string
          format: date-time
          readOnly: true
        last_updated:
          type: string
          format: date-time
          readOnly: true
      required:
      - avatar
      - date_joined
      - groups_obj
      - is_superuser
      - last_updated
      - name
      - password_change_date
      - pk
      - roles_obj
      - uid
      - username
      - uuid
    ValidationError:
      type: object
      description: Validation Error
      properties:
        non_field_errors:
          type: array
          items:
            type: string
        code:
          type: string
      additionalProperties: {}
    PaginatedSSFStreamList:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/SSFStream'
        autocomplete:
          $ref: '#/components/schemas/Autocomplete'
      required:
      - autocomplete
      - pagination
      - results
    SSFStreamStatusEnum:
      enum:
      - enabled
      - paused
      - disabled
      - disabled_deleted
      type: string
    Autocomplete:
      type: object
      additionalProperties: {}
    DeliveryMethodEnum:
      enum:
      - https://schemas.openid.net/secevent/risc/delivery-method/push
      - https://schemas.openid.net/secevent/risc/delivery-method/poll
      - urn:ietf:rfc:8935
      - urn:ietf:rfc:8936
      type: string
    PartialGroup:
      type: object
      description: Partial Group Serializer, does not include child relations.
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Group uuid
        num_pk:
          type: integer
          description: Get a numerical, int32 ID for the group
          readOnly: true
        name:
          type: string
        is_superuser:
          type: boolean
          description: Users added to this group will be superusers.
        attributes:
          type: object
          additionalProperties: {}
      required:
      - name
      - num_pk
      - pk
    GenericError:
      type: object
      description: Generic API Error
      properties:
        detail:
          type: string
        code:
          type: string
      required:
      - detail
  responses:
    GenericErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/GenericError'
      description: ''
    ValidationErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
      description: ''
  securitySchemes:
    authentik:
      type: http
      scheme: bearer
    authentik_device_auth:
      type: http
      scheme: bearer+agent
    authentik_device_enroll:
      type: http
      scheme: bearer
    authentik_device_federation:
      type: http
      scheme: bearer