authentik's [LDAP Provider](../../providers/ldap/index.md) now supports StartTLS in addition to supporting SSL. The StartTLS is a more modern method of encrypting LDAP traffic. With this added support, the LDAP [Outpost](../../outposts/index.mdx) can now support multiple certificates.
In addition to the StartTLS support, the schema support in the LDAP provider has been drastically overhauled. This will improve support with applications and clients relying on the schema to parse data received. Additionally, the base DN is no longer required to be set when binding, as the outpost now finds the correct provider based on the bind DN.
- Event matcher policy can now match on individual models
Previously the _Event matcher policy_ was only able to match on event actions, client IPs and apps, which made it a requirement to use expression policies to match only on certain model actions.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
New required properties:
-`managed`
* Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
New required properties:
-`managed`
* Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /propertymappings/ldap/{pm_uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PUT` /propertymappings/ldap/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PATCH` /propertymappings/ldap/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /propertymappings/saml/{pm_uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PUT` /propertymappings/saml/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PATCH` /propertymappings/saml/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /propertymappings/scim/{pm_uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PUT` /propertymappings/scim/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PATCH` /propertymappings/scim/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /propertymappings/scope/{pm_uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PUT` /propertymappings/scope/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `PATCH` /propertymappings/scope/{pm_uuid}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
##### `PUT` /providers/oauth2/{id}/
###### Request:
Changed content type : `application/json`
- Changed property `sub_mode` (string)
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
##### `PATCH` /providers/oauth2/{id}/
###### Request:
Changed content type : `application/json`
- Changed property `sub_mode` (string)
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `user_obj` (object)
> User Serializer
New optional properties:
-`groups`
##### `PUT` /core/tokens/{identifier}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `user_obj` (object)
> User Serializer
New optional properties:
-`groups`
##### `PATCH` /core/tokens/{identifier}/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `user_obj` (object)
> User Serializer
New optional properties:
-`groups`
##### `GET` /core/users/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
New optional properties:
-`groups`
##### `PUT` /core/users/{id}/
###### Request:
Changed content type : `application/json`
New optional properties:
-`groups`
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
New optional properties:
-`groups`
##### `PATCH` /core/users/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
New optional properties:
-`groups`
##### `POST` /crypto/certificatekeypairs/
###### Request:
Changed content type : `application/json`
- Deleted property `managed` (string)
> Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
New required properties:
-`managed`
* Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /flows/instances/{slug}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /flows/instances/{slug}/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PATCH` /flows/instances/{slug}/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /outposts/instances/{uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
- Changed property `application_slug` (string)
> Prioritise backchannel slug over direct application slug
- Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
- Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `POST` /propertymappings/ldap/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `POST` /propertymappings/saml/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `POST` /propertymappings/scim/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /propertymappings/scim/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > SCIMMapping Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `POST` /propertymappings/scope/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
##### `GET` /propertymappings/scope/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > ScopeMapping Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
* Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
* Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
##### `PUT` /providers/ldap/{id}/
###### Request:
Changed content type : `application/json`
- Added property `mfa_support` (boolean)
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
- Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
- Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
* Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
* Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
##### `PATCH` /providers/ldap/{id}/
###### Request:
Changed content type : `application/json`
- Added property `mfa_support` (boolean)
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
- Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
- Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
* Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
* Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
##### `POST` /providers/oauth2/
###### Request:
Changed content type : `application/json`
- Changed property `sub_mode` (string)
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
##### `GET` /providers/oauth2/
###### Parameters:
Changed: `sub_mode` in `query`
> Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
>
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Changed items (string): > _ `can_save_media` - Can Save Media > _ `can_geo_ip` - Can Geo Ip > _ `can_impersonate` - Can Impersonate > _ `can_debug` - Can Debug > \* `is_enterprise` - Is Enterprise
Added enum value:
-`is_enterprise`
##### `GET` /sources/all/{slug}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/ldap/{slug}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/ldap/{slug}/
###### Request:
Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PATCH` /sources/ldap/{slug}/
###### Request:
Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/oauth/{slug}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
##### `PUT` /sources/oauth/{slug}/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
##### `PATCH` /sources/oauth/{slug}/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
##### `GET` /sources/plex/{slug}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/plex/{slug}/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PATCH` /sources/plex/{slug}/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/saml/{slug}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/saml/{slug}/
###### Request:
Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PATCH` /sources/saml/{slug}/
###### Request:
Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/all/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/user_connections/all/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PATCH` /sources/user_connections/all/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/oauth/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/user_connections/oauth/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/plex/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/user_connections/plex/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/saml/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /sources/user_connections/saml/{id}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `user_obj` (object)
> User Serializer
New optional properties:
-`groups`
##### `GET` /core/tokens/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > Token Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
- Changed property `user` (object)
> User Serializer
New optional properties:
-`groups`
##### `POST` /outposts/instances/
###### Request:
Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
- Changed property `application_slug` (string)
> Prioritise backchannel slug over direct application slug
- Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
- Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
- Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
- Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
* Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
* Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
* Changed property `uid_start_number` (integer)
> The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
* Changed property `gid_start_number` (integer)
> The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /sources/ldap/
###### Request:
Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/ldap/
###### Parameters:
Added: `client_certificate` in `query`
Added: `sni` in `query`
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > LDAP Source Serializer
- Added property `client_certificate` (string)
> Client certificate to authenticate against the LDAP Server's Certificate.
- Added property `sni` (boolean)
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /sources/oauth/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
##### `GET` /sources/oauth/
###### Parameters:
Changed: `policy_engine_mode` in `query`
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
>
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > OAuth Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
- Changed property `provider_type` (string)
> - `apple` - Apple
> - `azuread` - Azure AD
> - `discord` - Discord
> - `facebook` - Facebook
> - `github` - GitHub
> - `google` - Google
> - `mailcow` - Mailcow
> - `openidconnect` - OpenID Connect
> - `okta` - Okta
> - `patreon` - Patreon
> - `reddit` - Reddit
> - `twitch` - Twitch
> - `twitter` - Twitter
Added enum value:
-`patreon`
##### `POST` /sources/plex/
###### Request:
Changed content type : `application/json`
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/plex/
###### Parameters:
Changed: `policy_engine_mode` in `query`
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
>
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > Plex Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /sources/saml/
###### Request:
Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/saml/
###### Parameters:
Added: `verification_kp` in `query`
Changed: `policy_engine_mode` in `query`
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
>
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > SAMLSource Serializer
- Added property `verification_kp` (string)
> When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `signing_kp` (string)
> Keypair used to sign outgoing Responses going to the Identity Provider.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/all/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > OAuth Source Serializer
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /sources/user_connections/oauth/
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/oauth/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > OAuth Source Serializer
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /sources/user_connections/plex/
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /sources/user_connections/saml/
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /sources/user_connections/saml/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > SAML Source Serializer
- Changed property `source` (object)
> Source Serializer
- Changed property `managed` (string)
> Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /stages/all/{stage_uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
- Changed property `user` (object)
> User Serializer
New optional properties:
-`groups`
##### `GET` /oauth2/authorization_codes/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > Serializer for BaseGrantModel and ExpiringBaseGrant
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
- Changed property `user` (object)
> User Serializer
New optional properties:
-`groups`
##### `GET` /oauth2/refresh_tokens/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > Serializer for BaseGrantModel and RefreshToken
> - `hashed_user_id` - Based on the Hashed User ID
> - `user_id` - Based on user ID
> - `user_uuid` - Based on user UUID
> - `user_username` - Based on the username
> - `user_email` - Based on the User's Email. This is recommended over the UPN method.
> - `user_upn` - Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.
Added enum value:
-`user_uuid`
- Changed property `user` (object)
> User Serializer
New optional properties:
-`groups`
##### `GET` /stages/all/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /stages/authenticator/duo/
###### Request:
Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /stages/prompt/prompts/{prompt_uuid}/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `PUT` /stages/prompt/prompts/{prompt_uuid}/
###### Request:
Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /stages/prompt/prompts/preview/
###### Request:
Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `fields` (array)
Changed items (object): > Serializer for a single Prompt field
New required properties:
-`initial_value`
* Added property `initial_value` (string)
##### `POST` /stages/prompt/stages/
###### Request:
Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /stages/prompt/stages/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > PromptStage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /stages/user_delete/
###### Request:
Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `POST` /stages/prompt/prompts/
###### Request:
Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
###### Return Type:
Changed response : **201 Created**
- Changed content type : `application/json`
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
- Changed property `policy_engine_mode` (string)
> - `all` - all, all policies must pass
> - `any` - any, any policy must pass
##### `GET` /stages/prompt/prompts/
###### Return Type:
Changed response : **200 OK**
- Changed content type : `application/json`
- Changed property `results` (array)
Changed items (object): > Prompt Serializer
- Added property `initial_value` (string)
> Optionally pre-fill the input with an initial value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple default choices.
> Optionally provide a short hint that describes the expected input value. When creating a fixed choice field, enable interpreting as expression and return a list to return multiple choices.
- Changed property `promptstage_set` (array)
Changed items (object): > Stage Serializer
- Changed property `flow_set` (array)
Changed items (object): > Stripped down flow serializer
