SkycloakVerifiedFeatured

Register a hostname for CAPTCHA protection on a cluster.

Add a user to a realm group.

Grant a role to an application's service account. Provide role_client_id for a client role, or omit it for a realm role.

Assign a realm role to a user.

Cancel an in-progress cluster version upgrade. Set confirm=true to proceed.

Create an OIDC/SAML client (application) in a realm. Returns the client secret for confidential clients (store it; it is not retrievable later).

Provision a new Keycloak cluster. Asynchronous: the returned cluster starts in a provisioning state — poll skycloak_get_cluster until its status is 'available'. Requires --allow-writes.

Add a custom domain to a cluster. Returns the DNS records the customer must create to verify and route the domain.

Add a realm route to a custom domain.

Start a database export for a cluster. Asynchronous: poll skycloak_get_export until the status is 'completed' to obtain the download URL. Including credentials requires an encryption_password.

Create an OIDC identity provider (SSO connection) in a realm.

Create a new Keycloak realm in a cluster. Requires the server to be started with --allow-writes and a write-scoped API key.

Export a Keycloak realm to an encrypted archive. Asynchronous: poll skycloak_get_realm_export until status is 'completed'. The archive is always encrypted, so encryption_password is required, and the same password is needed to import it again. This is a realm export (one realm's configuration); skycloak_create_export is the separate whole-cluster database export.

Create a realm group, optionally nested under a parent group.

Import a Keycloak realm into a cluster from an uploaded archive or an existing realm export. Asynchronous: poll skycloak_get_realm_import. Creates a new realm: preflight refuses a name collision rather than overwriting, so an existing realm of the same name fails with 409. It does import users and their credentials, so set confirm=true to proceed.

Get a presigned URL to upload a realm archive to. PUT the archive to upload_url, then pass the returned s3_key to skycloak_create_realm_import as upload_s3_key. Not needed when importing an existing export: pass that export's ID as source_export_id instead.

Create a realm-scoped role.

Create a realm user with an initial temporary password.

Create a SIEM destination. Credentials are write-only and are not returned.

Create a webhook subscription. Signing secrets and authorization headers are write-only.

Delete an application (OIDC/SAML client) from a realm. Set confirm=true to proceed.

Permanently delete a Keycloak cluster and all of its realms and data. Irreversible. Set confirm=true to proceed.

Delete a cluster-specific maintenance window so the cluster follows the workspace default. Set confirm=true to proceed.

Remove a custom domain from a cluster. Set confirm=true to proceed.

Remove a realm route from a custom domain. Set confirm=true to proceed.

Revert email branding to defaults. Set confirm=true to proceed.

Delete a database export archive. Set confirm=true to proceed.

Delete a custom extension from the workspace catalog. Set confirm=true to proceed.

Delete an identity provider from a realm. Set confirm=true to proceed.

Revert login branding to defaults. Set confirm=true to proceed.

Permanently delete a realm and all of its users, clients and configuration. This is irreversible. Set confirm=true to proceed.

Delete a realm group. Set confirm=true to proceed.

Delete a realm role. Set confirm=true to proceed.

Delete a realm user. Set confirm=true to proceed.

Delete a SIEM destination. Set confirm=true to proceed.

Remove a realm's SMTP configuration. Set confirm=true to proceed.

Delete a custom theme. Set confirm=true to proceed.

Delete a webhook subscription. Set confirm=true to proceed.

Resolve an OIDC issuer's discovery document to obtain its authorization, token, and userinfo endpoints. Use the result when creating an identity provider.

Download a custom theme's content archive. Returns size and SHA-256 always, and the archive itself only when it is small enough to inline.

Export a cluster's events as a document and return its contents.

Get an application (OIDC/SAML client) by client ID.

Get a client's login-theme override (empty means the realm default).

Get full details for a single Keycloak cluster by its ID.

Get cluster analytics as a JSON document. type is one of: overview, authentication, events, performance, security.

Get a cluster-specific maintenance window. A 404 means the cluster follows the workspace default.

Get a cluster's edge-security configuration: IP allow-listing, rate limiting, WAF, geo-blocking, and bot management.

Get the recommended version-upgrade path for a cluster.

Get a custom domain by ID, including its DNS records and verification/SSL status.

Get a single realm route on a custom domain.

Get the email-template branding (colors, logo, footer) for a realm.

Get a database export job by ID, including its status, progress, and (once completed) the time-limited download URL.

Get an identity provider by provider ID.

Get the login-page branding (colors, logo, toggles) for a realm.

Read recent Keycloak server logs for a cluster, optionally filtered by level and a search string.

Get a realm by name.

Get a realm export job by ID. Poll this after skycloak_create_realm_export until status is 'completed'; the download URL only appears then and expires 24 hours later.

Get a realm group by ID.

Get a realm import job by ID. Poll this after skycloak_create_realm_import until status is 'completed' or 'failed'.

Get a realm role by name.

Get a realm user by ID.

Read recent security (WAF) logs for a cluster — blocked requests, attack types, source IPs.

Get a SIEM destination by ID.

Get a realm's SMTP configuration (secret values are never returned).

Get a custom theme by ID.

Get the active custom theme per Keycloak theme type (login, account, admin, email) for a realm.

Get a webhook subscription by ID.

Install a catalog extension on a cluster. Installation is asynchronous; poll skycloak_list_cluster_extensions until the status settles. Provide required parameters keyed by parameter name.

List the roles assigned to an application's service account.

List active user sessions for an application.

List the OIDC/SAML clients (applications) in a realm.

List hostnames registered for CAPTCHA protection on a cluster.

List the extensions currently installed on a cluster, with their version and upgrade status.

List the Keycloak feature flags available to tenant clusters.

List the deployment regions available to the workspace.

List the cluster types the workspace can provision.

List the version-upgrade history for a cluster.

List the Keycloak versions available for a cluster type.

List the Keycloak clusters in your Skycloak workspace, with their status, type, size, version and location.

List the realm routes configured on a custom domain.

List the custom domains configured on a cluster.

List the database export jobs for a cluster, with their status and expiry.

List the extension catalog available to the workspace (marketplace extensions that can be installed on a cluster).

List the pre-configured identity-provider templates. Use a template id when creating a provider.

List the identity providers (SSO connections) in a realm.

List the users that belong to a realm group.

List the top-level groups in a realm.

List the realm-scoped roles in a realm.

List the users in a realm.

List the Keycloak realms in a Skycloak cluster.

List SIEM destinations configured for the workspace.

List the custom themes uploaded to a cluster, with their IDs, status, and theme types.

List the groups a user belongs to.

List the realm roles assigned to a user.

List webhook event types. Optionally filter by source: platform or keycloak.

List webhook subscriptions. Optionally filter by source, cluster_id, and enabled.

Query Keycloak user and admin events for a cluster (logins, token grants, admin operations), filterable by category, realm, username and search.

Remove a role from an application's service account.

Remove a hostname from CAPTCHA protection on a cluster. Set confirm=true to proceed.

Remove a user from a realm group.

Remove a realm role from a user.

Regenerate an application's client secret and return the new value (shown only once).

Set a client's login-theme override. Pass a theme ID, or an empty string to reset to the realm default.

Create or replace a cluster-specific maintenance window.

Assign custom themes to a realm per Keycloak theme type. Pass a theme ID to activate it, or an empty string to reset that type to Keycloak's built-in default. Only the provided fields are changed.

Test connectivity to an identity provider, optionally overriding the client credentials for this test only.

Send a test event to a SIEM destination.

Send a test email through a realm's configured SMTP server to verify delivery.

Send a test event to a webhook subscription.

Uninstall an extension from a cluster. Set confirm=true to proceed.

Update an application's name, description, or redirect URIs.

Update a cluster's version (to trigger an upgrade) or size.

Update a cluster's edge-security configuration. Only the sections you provide are changed; CAPTCHA settings are preserved. Supports IP allow-listing, rate limiting, WAF, geo-blocking, and bot management.

Update a domain route's admin access and CORS origins.

Update a custom extension's name or description.

Update an identity provider's display name and enabled state.

Update a realm's display name and enabled state.

Rename a realm group.

Rename a realm role or change its description.

Update a realm user's profile (email, name, enabled, email_verified).

Update a SIEM destination. Only provided fields are changed; credentials remain write-only.

Update a theme's name, description, or version.

Update a webhook subscription. Use clear_authorization_header, clear_cluster_id, or clear_realm_id to remove nullable fields.

Upgrade an installed extension to the latest available version. Asynchronous.

Create or update email-template branding (color, logo, footer).

Create or update login-page branding (colors, logo, registration toggle).

Create or update a realm's SMTP configuration (basic auth).

Trigger DNS verification for a custom domain and return its updated status.