Keycloak Admin REST API

Name: Keycloak Admin REST API
Brand: Keycloak Admin REST API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationbearer281 Endpoints

For Agents

Administer realms, clients, users, groups, roles, identity providers, and authentication flows on a self-hosted Keycloak server through 281 bearer-authenticated endpoints.

Install Jentic One Beta

Connect the Keycloak Admin REST API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Keycloak Admin REST API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Keycloak Admin REST API.

List, create, update, and delete realms and inspect realm-level admin events

Manage clients, client scopes, and client role mappings inside a realm

Manage users, groups, and the role mappings that control their access

GET STARTED

Start building with Keycloak Admin REST API

Explore with Jentic

View OpenAPI Document

This is a Keycloak Admin REST API spec sourced from a community-maintained Keycloak OpenAPI definition (the ccouzens/keycloak-openapi project, capturing Keycloak 10.x). The 281 endpoints cover realm administration, client and client-scope management, users and groups, role mappings, identity providers, authentication flows, and brute-force attack detection. Authentication is bearer-token via Keycloak's own access_token security scheme — the same access tokens issued by Keycloak's OIDC endpoints are reused to call the admin API. The base URL points at a Keycloak instance's /auth/admin/realms/ root, which varies per deployment.

Use Cases

Patterns agents use Keycloak Admin REST API for, with concrete tasks.

★ Provision Realms and Clients Programmatically

Stand up a new tenant by creating a realm and the clients it needs through the admin API rather than clicking through the Keycloak admin console. The realm and client endpoints support full create, read, update, and delete, so a provisioning script can produce a tenant in one call sequence. Using the API rather than the console makes tenant creation reproducible and reviewable.

POST /{realm} to create the realm, then POST clients under it for each application that needs to authenticate against it

User and Role Mapping Audits

Audit which users and groups hold which roles by walking the realm's user list and pulling role mappings per record. The admin API exposes the full role-mapping graph so an audit job can build a flattened report. Combined with the realm admin-events endpoint, an auditor can also see who granted each mapping and when.

List realm users, then for each user GET their role mappings and join with the admin-events stream to identify recent role changes

Brute-Force Lockout Operations

Build an ops tool that lets support engineers safely clear a brute-force lockout on a single user without touching everyone else in the realm. The /attack-detection/brute-force/users/{userId} endpoint reads and resets the lockout state for one user, while the realm-wide endpoint clears the entire bucket when needed. Both flows are gated on the bearer token, so audit trails capture who took the action.

GET /{realm}/attack-detection/brute-force/users/{userId} to confirm the lockout, then DELETE the same path to reset it

AI Agent Identity Operations

An AI agent that helps an SRE team manage Keycloak uses Jentic to discover the right admin endpoint for each request — clearing a lockout, listing identity providers in a realm, or fetching admin events for a window. Because the surface is large (281 endpoints) and Keycloak's UI does not expose a search-by-intent path, the agent benefits from Jentic's intent-based discovery layer.

Through Jentic, search for 'unlock a keycloak user', load DELETE /{realm}/attack-detection/brute-force/users/{userId}, and execute it for the supplied userId

Key Endpoints

281 endpoints — this is a keycloak admin rest api spec sourced from a community-maintained keycloak openapi definition (the ccouzens/keycloak-openapi project, capturing keycloak 10.

METHOD

PATH

DESCRIPTION

GET

/{realm}

Read a realm by ID

POST

Create a new realm

DELETE

/{realm}

Delete a realm

GET

/{realm}/admin-events

Read realm admin events

GET

/{realm}/authentication/authenticator-providers

List authenticator providers

GET

/{realm}/attack-detection/brute-force/users/{userId}

Read brute-force state for a user

DELETE

/{realm}/attack-detection/brute-force/users/{userId}

Clear brute-force lockout for a user

DELETE

/{realm}/attack-detection/brute-force/users

Clear brute-force lockout for the realm

GET

/{realm}

Read a realm by ID

POST

Create a new realm

DELETE

/{realm}

Delete a realm

GET

/{realm}/admin-events

Read realm admin events

GET

/{realm}/authentication/authenticator-providers

List authenticator providers

GET

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Keycloak admin client_id, client_secret, and admin credentials are stored encrypted in the Jentic vault. Jentic exchanges them at the OIDC token endpoint and supplies the bearer per call, so secrets never enter the agent's context.

Intent-based discovery

Agents search by intent (e.g. 'unlock a keycloak user' or 'create a keycloak realm') and Jentic returns the matching admin operation with its schema, so the agent does not have to walk a 281-endpoint surface.

Time to first call

Direct Keycloak admin integration: 2-5 days for OIDC token handling, pagination, and resource modelling. Through Jentic: under 1 hour — search, load, execute.

FAQs

Specific to using Keycloak Admin REST API through Jentic.

What authentication does the Keycloak Admin REST API use?

Bearer access tokens issued by Keycloak's own OIDC token endpoint. Send the token in the Authorization header on every admin call. Through Jentic, the client_id, client_secret, and admin credentials live in the encrypted vault and Jentic mints the bearer per call.

Can I create a new realm with the Keycloak Admin REST API?

Yes. POST to the root endpoint with the realm representation in the body. After creation, GET /{realm} returns the realm record so you can confirm it exists, and subsequent calls under /{realm} configure clients, users, and roles inside it.

What are the rate limits for the Keycloak Admin REST API?

Rate limits are deployment-specific. Self-hosted Keycloak does not enforce a fixed numeric limit out of the box — throughput is bounded by the JVM and database behind your instance. If you run admin tooling at scale, batch reads and avoid hot-looping on /{realm}/admin-events.

How do I clear a brute-force lockout for one user via Jentic?

Search Jentic for 'clear keycloak brute force lockout' to find DELETE /{realm}/attack-detection/brute-force/users/{userId}, load its schema, and execute it with the realm and userId. The Jentic flow is pip install jentic, then client.search, client.load, and client.execute.

Does this Keycloak spec cover all admin endpoints?

It exposes 281 admin endpoints — realms, clients, client scopes, users, groups, roles, identity providers, authentication flows, components, and attack detection. The base path is the deployed Keycloak instance's /auth/admin/realms root, so you must configure the host on your Jentic execution context.

Is this spec the official Keycloak OpenAPI definition?

It is sourced from the community ccouzens/keycloak-openapi project, which captures Keycloak 10.x. Keycloak itself has more recently shipped first-party OpenAPI output; for newer Keycloak versions check whether your deployment exposes its own spec at the admin API root.

Keycloak Admin REST API

Connect the Keycloak Admin REST API to your agent

Capabilities

Start building with Keycloak Admin REST API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs