From ea2a25785c5a943e541b82a42b0d6cdaa0d5ee85 Mon Sep 17 00:00:00 2001 From: "Jens L." Date: Mon, 3 Aug 2026 20:46:20 +0100 Subject: [PATCH] core: Actors (#24353) * I think I'm happy with this structure Signed-off-by: Jens Langhammer * fixup Signed-off-by: Jens Langhammer * add api Signed-off-by: Jens Langhammer * fix missing engine mode Signed-off-by: Jens Langhammer * add ui Signed-off-by: Jens Langhammer * pull in the requests machinery Signed-off-by: Jens Langhammer * fixup and gen Signed-off-by: Jens Langhammer * gen Signed-off-by: Jens Langhammer * re-wire things up Signed-off-by: Jens Langhammer * re-add more web stuff Signed-off-by: Jens Langhammer * fix unrelated test issue Signed-off-by: Jens Langhammer * fix mixin Signed-off-by: Jens Langhammer * gen Signed-off-by: Jens Langhammer * plumb in flows Signed-off-by: Jens Langhammer * update ui Signed-off-by: Jens Langhammer * initial web Signed-off-by: Jens Langhammer * fix a couple things Signed-off-by: Jens Langhammer * fix api tests & schema Signed-off-by: Jens Langhammer * better pick request flow Signed-off-by: Jens Langhammer * fix perms Signed-off-by: Jens Langhammer * change method Signed-off-by: Jens Langhammer * fix perms Signed-off-by: Jens Langhammer * fix web lint Signed-off-by: Jens Langhammer * explicit perms Signed-off-by: Jens Langhammer * fix migrations Signed-off-by: Jens Langhammer * concrete m2m Signed-off-by: Jens Langhammer * fix perms Signed-off-by: Jens Langhammer * format Signed-off-by: Jens Langhammer * add some default config Signed-off-by: Jens Langhammer * fix permission check -> requesting user checks against rule bindings' policies Signed-off-by: Jens Langhammer * fix unrelated Signed-off-by: Jens Langhammer * fix api client Signed-off-by: Jens Langhammer * fix styling Signed-off-by: Jens Langhammer * fix more Signed-off-by: Jens Langhammer * add banner Signed-off-by: Jens Langhammer * attributes mixin prep for object attrs Signed-off-by: Jens Langhammer * fix tests Signed-off-by: Jens Langhammer * update tests Signed-off-by: Jens Langhammer * fix typo Signed-off-by: Jens Langhammer * fix unrelated test failure Signed-off-by: Jens Langhammer * ensure no self-approval Signed-off-by: Jens Langhammer * configurable expiry Signed-off-by: Jens Langhammer * add meta info to requestable target Signed-off-by: Jens Langhammer * add more events Signed-off-by: Jens Langhammer * only unique apps Signed-off-by: Jens Langhammer * initial app card impl Signed-off-by: Jens Langhammer * add entitlement modal Signed-off-by: Jens Langhammer * respect filters Signed-off-by: Jens Langhammer * re-migrate Signed-off-by: Jens Langhammer * improve ux Signed-off-by: Jens Langhammer * fix child bindings? Signed-off-by: Jens Langhammer * better ux for rule bindings Signed-off-by: Jens Langhammer * fix type check Signed-off-by: Jens Langhammer * initial dcr Signed-off-by: Jens Langhammer * re-migrate Signed-off-by: Jens Langhammer * handle error Signed-off-by: Jens Langhammer * format Signed-off-by: Jens Langhammer * init Signed-off-by: Jens Langhammer * rename Signed-off-by: Jens Langhammer * rename Signed-off-by: Jens Langhammer * self-service Signed-off-by: Jens Langhammer * wip Signed-off-by: Jens Langhammer * move to user view Signed-off-by: Jens Langhammer * always expire self Signed-off-by: Jens Langhammer * t Signed-off-by: Jens Langhammer * format Signed-off-by: Jens Langhammer * actor Signed-off-by: Jens Langhammer * cleanup Signed-off-by: Jens Langhammer * effective user early Signed-off-by: Jens Langhammer * extract agents Signed-off-by: Jens Langhammer * optimize Signed-off-by: Jens Langhammer * Apply suggestion from @rissson Co-authored-by: Marc 'risson' Schmitt Signed-off-by: Jens L. * fix Signed-off-by: Jens Langhammer --------- Signed-off-by: Jens Langhammer Signed-off-by: Jens L. Co-authored-by: Marc 'risson' Schmitt --- authentik/core/migrations/0063_actor.py | 66 ++ authentik/core/models.py | 74 ++ authentik/events/utils.py | 8 +- authentik/policies/engine.py | 78 +- .../policies/tests/test_engine_filter.py | 41 +- blueprints/schema.json | 1049 +++++++++++++++++ packages/client-ts/src/models/ModelEnum.ts | 1 + schema.yml | 1 + 8 files changed, 1312 insertions(+), 6 deletions(-) create mode 100644 authentik/core/migrations/0063_actor.py diff --git a/authentik/core/migrations/0063_actor.py b/authentik/core/migrations/0063_actor.py new file mode 100644 index 0000000000..6d150a0bcd --- /dev/null +++ b/authentik/core/migrations/0063_actor.py @@ -0,0 +1,66 @@ +# Generated by Django 5.2.16 on 2026-07-31 14:37 + +import django.db.models.deletion +from django.conf import settings +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ("authentik_core", "0062_userswitchingsession_and_more"), + ] + + operations = [ + migrations.CreateModel( + name="Actor", + fields=[ + ( + "user_ptr", + models.OneToOneField( + auto_created=True, + on_delete=django.db.models.deletion.CASCADE, + parent_link=True, + primary_key=True, + serialize=False, + to=settings.AUTH_USER_MODEL, + ), + ), + ("expires", models.DateTimeField(default=None, null=True)), + ("expiring", models.BooleanField(default=True)), + ( + "policy_behavior", + models.TextField( + choices=[ + ("mirror", "Mirror policy engine"), + ("copy", "Copy policy bindings"), + ("none", "Don't inherit any policy bindings"), + ] + ), + ), + ( + "parent", + models.ForeignKey( + default=None, + null=True, + on_delete=django.db.models.deletion.SET_DEFAULT, + related_name="actors", + to=settings.AUTH_USER_MODEL, + ), + ), + ], + options={ + "verbose_name": "Actor", + "verbose_name_plural": "Actors", + "abstract": False, + "indexes": [ + models.Index(fields=["expires"], name="authentik_c_expires_ce0be4_idx"), + models.Index(fields=["expiring"], name="authentik_c_expirin_fbf26f_idx"), + models.Index( + fields=["expiring", "expires"], name="authentik_c_expirin_b80614_idx" + ), + ], + }, + bases=("authentik_core.user", models.Model), + ), + ] diff --git a/authentik/core/models.py b/authentik/core/models.py index 7efaf36a02..73b51a16fb 100644 --- a/authentik/core/models.py +++ b/authentik/core/models.py @@ -1591,3 +1591,77 @@ class ObjectAttribute(SerializerModel, ManagedModel, CreatedUpdatedModel): verbose_name = _("Object Attribute") verbose_name_plural = _("Object Attributes") unique_together = (("object_type", "key", "enabled"),) + + +class ActorPolicyInheritance(models.TextChoices): + + MIRROR = "mirror", _("Mirror policy engine") + COPY = "copy", _("Copy policy bindings") + NONE = "none", _("Don't inherit any policy bindings") + + +class Actor(ExpiringModel, User): + """Generic actor which can either perform tasks by itself + or on behalf of a parent user.""" + + parent = models.ForeignKey( + User, on_delete=models.SET_DEFAULT, default=None, null=True, related_name="actors" + ) + policy_behavior = models.TextField(choices=ActorPolicyInheritance) + + class Meta(ExpiringModel.Meta): + verbose_name = _("Actor") + verbose_name_plural = _("Actors") + + def save(self, *args, **kwargs): + # policy_behavior determines how the actor derives access and may only be chosen at + # creation time; changing it afterwards is rejected. + if ( + not self._state.adding + and hasattr(self, "_original_policy_behavior") + and self._original_policy_behavior != self.policy_behavior + ): + raise ValidationError( + {"policy_behavior": _("Policy behavior cannot be changed after creation.")} + ) + super().save(*args, **kwargs) + self._original_policy_behavior = self.policy_behavior + + @classmethod + def from_db(cls, db, field_names, values): + instance = super().from_db(db, field_names, values) + instance._original_policy_behavior = instance.policy_behavior + return instance + + def copy_parent_policy_bindings(self): + """Snapshot the parent's directly-assigned policy bindings onto this actor. + + Unlike MIRROR (which defers to the parent live), COPY takes an independent snapshot at + creation: the actor holds its own PolicyBindings, so later changes to the parent don't + affect it. Only bindings that reference the parent as a *user* are copied -- access the + parent derives from group membership is not (use MIRROR, or add the actor to groups). + """ + from authentik.policies.models import PolicyBinding + + if not self.parent_id: + return + for binding in PolicyBinding.objects.filter(user_id=self.parent_id): + binding.pk = None + binding.policy_binding_uuid = uuid4() + binding._state.adding = True + binding.user = self + binding.save() + + @staticmethod + def actor_for(user: User | None, policy_behavior: ActorPolicyInheritance, **kwargs): + prefix = f"{user.username}" if user else "global" + actor = Actor.objects.create( + username=f"{prefix}-{generate_id()}", + parent=user, + policy_behavior=policy_behavior, + type=UserTypes.SERVICE_ACCOUNT, + **kwargs, + ) + actor.set_unusable_password() + actor.save() + return actor diff --git a/authentik/events/utils.py b/authentik/events/utils.py index 6551895b1d..c318d7e627 100644 --- a/authentik/events/utils.py +++ b/authentik/events/utils.py @@ -23,7 +23,7 @@ from guardian.conf import settings from guardian.shortcuts import get_anonymous_user from authentik.blueprints.v1.common import YAMLTag -from authentik.core.models import User +from authentik.core.models import User, UserTypes from authentik.events.context_processors.asn import ASN_CONTEXT_PROCESSOR from authentik.events.context_processors.geoip import GEOIP_CONTEXT_PROCESSOR from authentik.policies.types import PolicyRequest @@ -93,6 +93,12 @@ def get_user(user: User | AnonymousUser) -> dict[str, Any]: } if user.username == settings.ANONYMOUS_USER_NAME: user_data["is_anonymous"] = True + # Actions performed by an actor are recorded on behalf of its parent, so the + # audit log always ties the activity back to a responsible human. + if getattr(user, "type", None) == UserTypes.SERVICE_ACCOUNT and hasattr(user, "actor"): + user_data["is_agent"] = True + # FIXME: This will need to be adjusted for OAuth OBO + user_data["on_behalf_of"] = get_user(user.actor.parent) return user_data diff --git a/authentik/policies/engine.py b/authentik/policies/engine.py index 2bfbf1dff1..c05cc6c1ba 100644 --- a/authentik/policies/engine.py +++ b/authentik/policies/engine.py @@ -13,7 +13,7 @@ from django.utils.timezone import now from sentry_sdk import start_span from structlog.stdlib import BoundLogger, get_logger -from authentik.core.models import Group, User +from authentik.core.models import Actor, ActorPolicyInheritance, Group, User, UserTypes from authentik.lib.utils.reflection import class_to_path from authentik.policies.apps import HIST_POLICIES_ENGINE_TOTAL_TIME, HIST_POLICIES_EXECUTION_TIME from authentik.policies.exceptions import PolicyEngineException @@ -23,6 +23,36 @@ from authentik.policies.types import PolicyRequest, PolicyResult CURRENT_PROCESS = current_process() +# Actors are always service accounts, so a cheap type check keeps the hot policy path free of an +# extra query for ordinary (human) users. +_ACTOR_USER_TYPES = frozenset({UserTypes.SERVICE_ACCOUNT, UserTypes.INTERNAL_SERVICE_ACCOUNT}) + + +def _get_mirror_parent(user: User) -> User | None: + """Return the parent a MIRROR actor mirrors its policy from, or None. + + An actor with ``policy_behavior == MIRROR`` is evaluated as its parent: it passes a policy + exactly when the parent does. Detection resolves the multi-table-inheritance child, memoized + on the user instance. + """ + if getattr(user, "type", None) not in _ACTOR_USER_TYPES: + return None + if "_actor" not in user.__dict__: + user.__dict__["_actor"] = Actor.objects.filter(pk=user.pk).first() + actor: Actor | None = user.__dict__["_actor"] + if actor and actor.policy_behavior == ActorPolicyInheritance.MIRROR and actor.parent_id: + return actor.parent + return None + + +def effective_policy_user(user: User) -> User: + """Follow MIRROR actors up to the identity whose policy result they mirror.""" + seen = {user.pk} + while (parent := _get_mirror_parent(user)) is not None and parent.pk not in seen: + seen.add(parent.pk) + user = parent + return user + class PolicyProcessInfo: """Dataclass to hold all information and communication channels to a process""" @@ -185,6 +215,7 @@ class PolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): raise PolicyEngineException(f"{pbm} is not instance of PolicyBindingModel") if not user: raise PolicyEngineException("User must be set") + user = effective_policy_user(user) self.__pbm = pbm self.request = PolicyRequest(user) self.request.obj = pbm @@ -286,6 +317,8 @@ class FilterPolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): self._init_defaults(pbm) self.__pbm = pbm self.__users = users + self.__original_users = users + self.__mirror_of: dict = {} self.__http_request = request self.__result: QuerySet[User] | None = None @@ -293,6 +326,24 @@ class FilterPolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): """Get enabled bindings for the bound PBM""" return self._bindings_for(self.__pbm) + def _substitute_mirror_actors(self): + """Swap MIRROR actors in the user set for the identity they mirror, so they are + evaluated in the same pass as everyone else (`_finalize` maps the verdict back). Only + service accounts can be actors, so the scan is a cheap, targeted query, and parents that + are shared across actors are evaluated once. + """ + for actor in self.__original_users.filter(type__in=_ACTOR_USER_TYPES): + effective = effective_policy_user(actor) + if effective.pk != actor.pk: + self.__mirror_of[actor.pk] = effective + if not self.__mirror_of: + return + parent_pks = {parent.pk for parent in self.__mirror_of.values()} + self.__users = User.objects.filter( + Q(pk__in=self.__original_users.exclude(pk__in=self.__mirror_of.keys()).values("pk")) + | Q(pk__in=parent_pks) + ) + def build(self) -> FilterPolicyEngine: """Evaluate bindings against the user queryset""" with ( @@ -305,13 +356,14 @@ class FilterPolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): obj_pk=str(self.__pbm.pk), ).time(), ): + self._substitute_mirror_actors() bindings = list(self.bindings()) for binding in bindings: self._check_policy_type(binding) if not bindings: self.__result = self.__users if self.empty_result else self.__users.none() - return self + return self._finalize() dynamic_bindings = [binding for binding in bindings if binding.policy_id is not None] static_bindings = [ @@ -326,7 +378,7 @@ class FilterPolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): self.__result = self.__users if self.empty_result else self.__users.none() else: self.__result = self._filter_static(self.__users, static_bindings, self.mode) - return self + return self._finalize() # Slow path: real Policy objects can't be translated to SQL and need # per-user evaluation. Pre-compute the static verdict ONCE via SQL (reused @@ -362,7 +414,25 @@ class FilterPolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): if self._combine_results(self.mode, self.empty_result, all_results).passing: passing_pks.append(user.pk) self.__result = self.__users.filter(pk__in=passing_pks) + return self._finalize() + + def _finalize(self) -> FilterPolicyEngine: + """Map the effective-user verdicts back onto the original user set. + + `build()` evaluated the substituted set (parents standing in for their MIRROR actors), so + a substituted actor passes iff the identity it mirrors passes. No-op when nothing was + substituted -- `self.__result` already refers to the original users. + """ + if not self.__mirror_of: return self + passing = set(self.__result.values_list("pk", flat=True)) + final_pks = { + pk + for pk in self.__original_users.values_list("pk", flat=True) + if (self.__mirror_of[pk].pk if pk in self.__mirror_of else pk) in passing + } + self.__result = self.__original_users.filter(pk__in=final_pks) + return self def _prefetch_cache( self, candidates: list[User], dynamic_bindings: list[PolicyBinding] @@ -441,7 +511,7 @@ class ListPolicyEngine[T: PolicyBindingModel](_PolicyEngineBase): self.empty_result = True self.use_cache = True self.__objs = objs - self.__user = user + self.__user = effective_policy_user(user) self.__http_request = request self.__result: QuerySet[T] | None = None diff --git a/authentik/policies/tests/test_engine_filter.py b/authentik/policies/tests/test_engine_filter.py index de2192dc23..68e80d6fb5 100644 --- a/authentik/policies/tests/test_engine_filter.py +++ b/authentik/policies/tests/test_engine_filter.py @@ -9,7 +9,7 @@ from django.test import TestCase from django.test.utils import CaptureQueriesContext from django.utils.timezone import now -from authentik.core.models import Group, User +from authentik.core.models import Actor, ActorPolicyInheritance, Group, User, UserTypes from authentik.core.tests.utils import create_test_user from authentik.lib.generators import generate_id from authentik.policies.dummy.models import DummyPolicy @@ -360,3 +360,42 @@ class TestFilterPolicyEngine(TestCase): self.assertEqual(second, {self.user_a.pk, self.user_b.pk, self.user_c.pk}) mock_get_many.assert_called_once() + + def _mirror_actor(self, parent: User) -> Actor: + uid = generate_id() + return Actor.objects.create( + username=uid, + name=uid, + email=f"{uid}@goauthentik.io", + parent=parent, + policy_behavior=ActorPolicyInheritance.MIRROR, + type=UserTypes.SERVICE_ACCOUNT, + ) + + def test_mirror_actor_evaluated_as_parent(self): + """A MIRROR actor passes iff the identity it mirrors passes, folded into the same + evaluation -- no per-actor PolicyEngine is spawned on the static path.""" + actor_a = self._mirror_actor(self.user_a) # user_a is in group_a + actor_c = self._mirror_actor(self.user_c) # user_c is in no group + users = User.objects.filter(pk__in=[actor_a.pk, actor_c.pk, self.user_a.pk, self.user_c.pk]) + pbm = PolicyBindingModel.objects.create() + PolicyBinding.objects.create(target=pbm, group=self.group_a, order=0) + + with patch("authentik.policies.engine.PolicyEngine") as mock_engine: + result = set(FilterPolicyEngine(pbm, users).build().result.values_list("pk", flat=True)) + + # actor_a mirrors user_a (in group_a) -> passes; actor_c mirrors user_c -> denied. + self.assertEqual(result, {self.user_a.pk, actor_a.pk}) + self.assertEqual(mock_engine.call_count, 0) + + def test_mirror_actor_without_parent_in_set(self): + """The mirrored parent need not itself be in the queryset.""" + actor_a = self._mirror_actor(self.user_a) + users = User.objects.filter(pk__in=[actor_a.pk, self.user_c.pk]) + pbm = PolicyBindingModel.objects.create() + PolicyBinding.objects.create(target=pbm, group=self.group_a, order=0) + + engine = FilterPolicyEngine(pbm, users) + result = set(engine.build().result.values_list("pk", flat=True)) + # Only the actor passes (via user_a's membership); user_a itself is not in the result set. + self.assertEqual(result, {actor_a.pk}) diff --git a/blueprints/schema.json b/blueprints/schema.json index c30924fab3..6906d1b605 100644 --- a/blueprints/schema.json +++ b/blueprints/schema.json @@ -176,6 +176,46 @@ } } }, + { + "type": "object", + "required": [ + "model", + "identifiers" + ], + "properties": { + "model": { + "const": "authentik_core.actor" + }, + "id": { + "type": "string" + }, + "state": { + "type": "string", + "enum": [ + "absent", + "created", + "must_created", + "present" + ], + "default": "present" + }, + "conditions": { + "type": "array", + "items": { + "type": "boolean" + } + }, + "permissions": { + "$ref": "#/$defs/model_authentik_core.actor_permissions" + }, + "attrs": { + "$ref": "#/$defs/model_authentik_core.actor" + }, + "identifiers": { + "$ref": "#/$defs/model_authentik_core.actor" + } + } + }, { "type": "object", "required": [ @@ -5496,6 +5536,1006 @@ } } }, + "model_authentik_core.actor": { + "type": "object", + "properties": { + "username": { + "type": "string", + "maxLength": 150, + "minLength": 1, + "title": "Username" + }, + "name": { + "type": "string", + "title": "Name", + "description": "User's display name." + }, + "is_active": { + "type": "boolean", + "title": "Active", + "description": "Designates whether this user should be treated as active. Unselect this instead of deleting accounts." + }, + "last_login": { + "type": [ + "string", + "null" + ], + "format": "date-time", + "title": "Last login" + }, + "groups": { + "type": "array", + "items": { + "type": "string", + "format": "uuid" + }, + "title": "Groups" + }, + "roles": { + "type": "array", + "items": { + "type": "string", + "format": "uuid" + }, + "title": "Roles" + }, + "email": { + "type": "string", + "format": "email", + "maxLength": 254, + "title": "Email address" + }, + "attributes": { + "type": "object", + "additionalProperties": true, + "title": "Attributes" + }, + "path": { + "type": "string", + "minLength": 1, + "title": "Path" + }, + "type": { + "type": "string", + "enum": [ + "internal", + "external", + "service_account", + "internal_service_account" + ], + "title": "Type" + }, + "password": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "title": "Password" + }, + "password_hash": { + "type": [ + "string", + "null" + ], + "minLength": 1, + "title": "Password hash" + }, + "permissions": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "authentik_blueprints.add_blueprintinstance", + "authentik_blueprints.change_blueprintinstance", + "authentik_blueprints.delete_blueprintinstance", + "authentik_blueprints.view_blueprintinstance", + "authentik_brands.add_brand", + "authentik_brands.add_brandclientcertificate", + "authentik_brands.change_brand", + "authentik_brands.change_brandclientcertificate", + "authentik_brands.delete_brand", + "authentik_brands.delete_brandclientcertificate", + "authentik_brands.view_brand", + "authentik_brands.view_brandclientcertificate", + "authentik_core.add_actor", + "authentik_core.add_application", + "authentik_core.add_applicationentitlement", + "authentik_core.add_authenticatedsession", + "authentik_core.add_group", + "authentik_core.add_groupancestrynode", + "authentik_core.add_groupparentagenode", + "authentik_core.add_grouprole", + "authentik_core.add_groupsourceconnection", + "authentik_core.add_objectattribute", + "authentik_core.add_propertymapping", + "authentik_core.add_provider", + "authentik_core.add_providerpropertymapping", + "authentik_core.add_source", + "authentik_core.add_sourcegrouppropertymapping", + "authentik_core.add_sourceuserpropertymapping", + "authentik_core.add_token", + "authentik_core.add_user", + "authentik_core.add_user_to_group", + "authentik_core.add_usergroup", + "authentik_core.add_userrole", + "authentik_core.add_usersourceconnection", + "authentik_core.change_actor", + "authentik_core.change_application", + "authentik_core.change_applicationentitlement", + "authentik_core.change_authenticatedsession", + "authentik_core.change_group", + "authentik_core.change_groupancestrynode", + "authentik_core.change_groupparentagenode", + "authentik_core.change_grouprole", + "authentik_core.change_groupsourceconnection", + "authentik_core.change_objectattribute", + "authentik_core.change_propertymapping", + "authentik_core.change_provider", + "authentik_core.change_providerpropertymapping", + "authentik_core.change_source", + "authentik_core.change_sourcegrouppropertymapping", + "authentik_core.change_sourceuserpropertymapping", + "authentik_core.change_token", + "authentik_core.change_user", + "authentik_core.change_usergroup", + "authentik_core.change_userrole", + "authentik_core.change_usersourceconnection", + "authentik_core.delete_actor", + "authentik_core.delete_application", + "authentik_core.delete_applicationentitlement", + "authentik_core.delete_authenticatedsession", + "authentik_core.delete_group", + "authentik_core.delete_groupancestrynode", + "authentik_core.delete_groupparentagenode", + "authentik_core.delete_grouprole", + "authentik_core.delete_groupsourceconnection", + "authentik_core.delete_objectattribute", + "authentik_core.delete_propertymapping", + "authentik_core.delete_provider", + "authentik_core.delete_providerpropertymapping", + "authentik_core.delete_source", + "authentik_core.delete_sourcegrouppropertymapping", + "authentik_core.delete_sourceuserpropertymapping", + "authentik_core.delete_token", + "authentik_core.delete_user", + "authentik_core.delete_usergroup", + "authentik_core.delete_userrole", + "authentik_core.delete_usersourceconnection", + "authentik_core.disable_group_superuser", + "authentik_core.enable_group_superuser", + "authentik_core.impersonate", + "authentik_core.preview_user", + "authentik_core.remove_user_from_group", + "authentik_core.reset_user_password", + "authentik_core.set_token_key", + "authentik_core.view_actor", + "authentik_core.view_application", + "authentik_core.view_applicationentitlement", + "authentik_core.view_authenticatedsession", + "authentik_core.view_group", + "authentik_core.view_groupancestrynode", + "authentik_core.view_groupparentagenode", + "authentik_core.view_grouprole", + "authentik_core.view_groupsourceconnection", + "authentik_core.view_objectattribute", + "authentik_core.view_propertymapping", + "authentik_core.view_provider", + "authentik_core.view_providerpropertymapping", + "authentik_core.view_source", + "authentik_core.view_sourcegrouppropertymapping", + "authentik_core.view_sourceuserpropertymapping", + "authentik_core.view_token", + "authentik_core.view_token_key", + "authentik_core.view_user", + "authentik_core.view_user_applications", + "authentik_core.view_usergroup", + "authentik_core.view_userrole", + "authentik_core.view_usersourceconnection", + "authentik_crypto.add_certificatekeypair", + "authentik_crypto.change_certificatekeypair", + "authentik_crypto.delete_certificatekeypair", + "authentik_crypto.view_certificatekeypair", + "authentik_crypto.view_certificatekeypair_certificate", + "authentik_crypto.view_certificatekeypair_key", + "authentik_endpoints.add_connector", + "authentik_endpoints.add_device", + "authentik_endpoints.add_deviceaccessgroup", + "authentik_endpoints.add_deviceconnection", + "authentik_endpoints.add_devicefactsnapshot", + "authentik_endpoints.add_deviceuserbinding", + "authentik_endpoints.add_endpointstage", + "authentik_endpoints.change_connector", + "authentik_endpoints.change_device", + "authentik_endpoints.change_deviceaccessgroup", + "authentik_endpoints.change_deviceconnection", + "authentik_endpoints.change_devicefactsnapshot", + "authentik_endpoints.change_deviceuserbinding", + "authentik_endpoints.change_endpointstage", + "authentik_endpoints.delete_connector", + "authentik_endpoints.delete_device", + "authentik_endpoints.delete_deviceaccessgroup", + "authentik_endpoints.delete_deviceconnection", + "authentik_endpoints.delete_devicefactsnapshot", + "authentik_endpoints.delete_deviceuserbinding", + "authentik_endpoints.delete_endpointstage", + "authentik_endpoints.view_connector", + "authentik_endpoints.view_device", + "authentik_endpoints.view_deviceaccessgroup", + "authentik_endpoints.view_deviceconnection", + "authentik_endpoints.view_devicefactsnapshot", + "authentik_endpoints.view_deviceuserbinding", + "authentik_endpoints.view_endpointstage", + "authentik_endpoints_connectors_agent.add_agentconnector", + "authentik_endpoints_connectors_agent.add_agentconnectorjwtfederationprovider", + "authentik_endpoints_connectors_agent.add_agentdeviceconnection", + "authentik_endpoints_connectors_agent.add_agentdeviceuserbinding", + "authentik_endpoints_connectors_agent.add_appleindependentsecureenclave", + "authentik_endpoints_connectors_agent.add_applenonce", + "authentik_endpoints_connectors_agent.add_deviceauthenticationtoken", + "authentik_endpoints_connectors_agent.add_devicetoken", + "authentik_endpoints_connectors_agent.add_enrollmenttoken", + "authentik_endpoints_connectors_agent.change_agentconnector", + "authentik_endpoints_connectors_agent.change_agentconnectorjwtfederationprovider", + "authentik_endpoints_connectors_agent.change_agentdeviceconnection", + "authentik_endpoints_connectors_agent.change_agentdeviceuserbinding", + "authentik_endpoints_connectors_agent.change_appleindependentsecureenclave", + "authentik_endpoints_connectors_agent.change_applenonce", + "authentik_endpoints_connectors_agent.change_deviceauthenticationtoken", + "authentik_endpoints_connectors_agent.change_devicetoken", + "authentik_endpoints_connectors_agent.change_enrollmenttoken", + "authentik_endpoints_connectors_agent.delete_agentconnector", + "authentik_endpoints_connectors_agent.delete_agentconnectorjwtfederationprovider", + "authentik_endpoints_connectors_agent.delete_agentdeviceconnection", + "authentik_endpoints_connectors_agent.delete_agentdeviceuserbinding", + "authentik_endpoints_connectors_agent.delete_appleindependentsecureenclave", + "authentik_endpoints_connectors_agent.delete_applenonce", + "authentik_endpoints_connectors_agent.delete_deviceauthenticationtoken", + "authentik_endpoints_connectors_agent.delete_devicetoken", + "authentik_endpoints_connectors_agent.delete_enrollmenttoken", + "authentik_endpoints_connectors_agent.view_agentconnector", + "authentik_endpoints_connectors_agent.view_agentconnectorjwtfederationprovider", + "authentik_endpoints_connectors_agent.view_agentdeviceconnection", + "authentik_endpoints_connectors_agent.view_agentdeviceuserbinding", + "authentik_endpoints_connectors_agent.view_appleindependentsecureenclave", + "authentik_endpoints_connectors_agent.view_applenonce", + "authentik_endpoints_connectors_agent.view_deviceauthenticationtoken", + "authentik_endpoints_connectors_agent.view_devicetoken", + "authentik_endpoints_connectors_agent.view_enrollment_token_key", + "authentik_endpoints_connectors_agent.view_enrollmenttoken", + "authentik_endpoints_connectors_fleet.add_fleetconnector", + "authentik_endpoints_connectors_fleet.change_fleetconnector", + "authentik_endpoints_connectors_fleet.delete_fleetconnector", + "authentik_endpoints_connectors_fleet.view_fleetconnector", + "authentik_endpoints_connectors_google_chrome.add_googlechromeconnector", + "authentik_endpoints_connectors_google_chrome.change_googlechromeconnector", + "authentik_endpoints_connectors_google_chrome.delete_googlechromeconnector", + "authentik_endpoints_connectors_google_chrome.view_googlechromeconnector", + "authentik_enterprise.add_license", + "authentik_enterprise.add_licenseusage", + "authentik_enterprise.change_license", + "authentik_enterprise.change_licenseusage", + "authentik_enterprise.delete_license", + "authentik_enterprise.delete_licenseusage", + "authentik_enterprise.view_license", + "authentik_enterprise.view_licenseusage", + "authentik_events.add_event", + "authentik_events.add_notification", + "authentik_events.add_notificationrule", + "authentik_events.add_notificationrulenotificationtransport", + "authentik_events.add_notificationtransport", + "authentik_events.add_notificationwebhookmapping", + "authentik_events.change_event", + "authentik_events.change_notification", + "authentik_events.change_notificationrule", + "authentik_events.change_notificationrulenotificationtransport", + "authentik_events.change_notificationtransport", + "authentik_events.change_notificationwebhookmapping", + "authentik_events.delete_event", + "authentik_events.delete_notification", + "authentik_events.delete_notificationrule", + "authentik_events.delete_notificationrulenotificationtransport", + "authentik_events.delete_notificationtransport", + "authentik_events.delete_notificationwebhookmapping", + "authentik_events.view_event", + "authentik_events.view_notification", + "authentik_events.view_notificationrule", + "authentik_events.view_notificationrulenotificationtransport", + "authentik_events.view_notificationtransport", + "authentik_events.view_notificationwebhookmapping", + "authentik_flows.add_flow", + "authentik_flows.add_flowstagebinding", + "authentik_flows.add_flowtoken", + "authentik_flows.add_stage", + "authentik_flows.change_flow", + "authentik_flows.change_flowstagebinding", + "authentik_flows.change_flowtoken", + "authentik_flows.change_stage", + "authentik_flows.clear_flow_cache", + "authentik_flows.delete_flow", + "authentik_flows.delete_flowstagebinding", + "authentik_flows.delete_flowtoken", + "authentik_flows.delete_stage", + "authentik_flows.export_flow", + "authentik_flows.inspect_flow", + "authentik_flows.view_flow", + "authentik_flows.view_flow_cache", + "authentik_flows.view_flowstagebinding", + "authentik_flows.view_flowtoken", + "authentik_flows.view_stage", + "authentik_lifecycle.add_lifecycleiteration", + "authentik_lifecycle.add_lifecyclerule", + "authentik_lifecycle.add_lifecyclerulenotificationtransport", + "authentik_lifecycle.add_lifecyclerulereviewer", + "authentik_lifecycle.add_lifecyclerulereviewergroup", + "authentik_lifecycle.add_review", + "authentik_lifecycle.add_useroffboarding", + "authentik_lifecycle.change_lifecycleiteration", + "authentik_lifecycle.change_lifecyclerule", + "authentik_lifecycle.change_lifecyclerulenotificationtransport", + "authentik_lifecycle.change_lifecyclerulereviewer", + "authentik_lifecycle.change_lifecyclerulereviewergroup", + "authentik_lifecycle.change_review", + "authentik_lifecycle.change_useroffboarding", + "authentik_lifecycle.delete_lifecycleiteration", + "authentik_lifecycle.delete_lifecyclerule", + "authentik_lifecycle.delete_lifecyclerulenotificationtransport", + "authentik_lifecycle.delete_lifecyclerulereviewer", + "authentik_lifecycle.delete_lifecyclerulereviewergroup", + "authentik_lifecycle.delete_review", + "authentik_lifecycle.delete_useroffboarding", + "authentik_lifecycle.view_lifecycleiteration", + "authentik_lifecycle.view_lifecyclerule", + "authentik_lifecycle.view_lifecyclerulenotificationtransport", + "authentik_lifecycle.view_lifecyclerulereviewer", + "authentik_lifecycle.view_lifecyclerulereviewergroup", + "authentik_lifecycle.view_review", + "authentik_lifecycle.view_useroffboarding", + "authentik_outposts.add_dockerserviceconnection", + "authentik_outposts.add_kubernetesserviceconnection", + "authentik_outposts.add_outpost", + "authentik_outposts.add_outpostprovider", + "authentik_outposts.add_outpostserviceconnection", + "authentik_outposts.change_dockerserviceconnection", + "authentik_outposts.change_kubernetesserviceconnection", + "authentik_outposts.change_outpost", + "authentik_outposts.change_outpostprovider", + "authentik_outposts.change_outpostserviceconnection", + "authentik_outposts.delete_dockerserviceconnection", + "authentik_outposts.delete_kubernetesserviceconnection", + "authentik_outposts.delete_outpost", + "authentik_outposts.delete_outpostprovider", + "authentik_outposts.delete_outpostserviceconnection", + "authentik_outposts.view_dockerserviceconnection", + "authentik_outposts.view_kubernetesserviceconnection", + "authentik_outposts.view_outpost", + "authentik_outposts.view_outpostprovider", + "authentik_outposts.view_outpostserviceconnection", + "authentik_policies.add_policy", + "authentik_policies.add_policybinding", + "authentik_policies.add_policybindingmodel", + "authentik_policies.change_policy", + "authentik_policies.change_policybinding", + "authentik_policies.change_policybindingmodel", + "authentik_policies.clear_policy_cache", + "authentik_policies.delete_policy", + "authentik_policies.delete_policybinding", + "authentik_policies.delete_policybindingmodel", + "authentik_policies.view_policy", + "authentik_policies.view_policy_cache", + "authentik_policies.view_policybinding", + "authentik_policies.view_policybindingmodel", + "authentik_policies_dummy.add_dummypolicy", + "authentik_policies_dummy.change_dummypolicy", + "authentik_policies_dummy.delete_dummypolicy", + "authentik_policies_dummy.view_dummypolicy", + "authentik_policies_event_matcher.add_eventmatcherpolicy", + "authentik_policies_event_matcher.change_eventmatcherpolicy", + "authentik_policies_event_matcher.delete_eventmatcherpolicy", + "authentik_policies_event_matcher.view_eventmatcherpolicy", + "authentik_policies_expiry.add_passwordexpirypolicy", + "authentik_policies_expiry.change_passwordexpirypolicy", + "authentik_policies_expiry.delete_passwordexpirypolicy", + "authentik_policies_expiry.view_passwordexpirypolicy", + "authentik_policies_expression.add_expressionpolicy", + "authentik_policies_expression.change_expressionpolicy", + "authentik_policies_expression.delete_expressionpolicy", + "authentik_policies_expression.view_expressionpolicy", + "authentik_policies_geoip.add_geoippolicy", + "authentik_policies_geoip.change_geoippolicy", + "authentik_policies_geoip.delete_geoippolicy", + "authentik_policies_geoip.view_geoippolicy", + "authentik_policies_password.add_passwordpolicy", + "authentik_policies_password.change_passwordpolicy", + "authentik_policies_password.delete_passwordpolicy", + "authentik_policies_password.view_passwordpolicy", + "authentik_policies_reputation.add_reputation", + "authentik_policies_reputation.add_reputationpolicy", + "authentik_policies_reputation.change_reputation", + "authentik_policies_reputation.change_reputationpolicy", + "authentik_policies_reputation.delete_reputation", + "authentik_policies_reputation.delete_reputationpolicy", + "authentik_policies_reputation.view_reputation", + "authentik_policies_reputation.view_reputationpolicy", + "authentik_policies_unique_password.add_uniquepasswordpolicy", + "authentik_policies_unique_password.add_userpasswordhistory", + "authentik_policies_unique_password.change_uniquepasswordpolicy", + "authentik_policies_unique_password.change_userpasswordhistory", + "authentik_policies_unique_password.delete_uniquepasswordpolicy", + "authentik_policies_unique_password.delete_userpasswordhistory", + "authentik_policies_unique_password.view_uniquepasswordpolicy", + "authentik_policies_unique_password.view_userpasswordhistory", + "authentik_providers_google_workspace.add_googleworkspaceprovider", + "authentik_providers_google_workspace.add_googleworkspaceprovidergroup", + "authentik_providers_google_workspace.add_googleworkspaceprovidermapping", + "authentik_providers_google_workspace.add_googleworkspaceproviderpropertymappingsgroup", + "authentik_providers_google_workspace.add_googleworkspaceprovideruser", + "authentik_providers_google_workspace.change_googleworkspaceprovider", + "authentik_providers_google_workspace.change_googleworkspaceprovidergroup", + "authentik_providers_google_workspace.change_googleworkspaceprovidermapping", + "authentik_providers_google_workspace.change_googleworkspaceproviderpropertymappingsgroup", + "authentik_providers_google_workspace.change_googleworkspaceprovideruser", + "authentik_providers_google_workspace.delete_googleworkspaceprovider", + "authentik_providers_google_workspace.delete_googleworkspaceprovidergroup", + "authentik_providers_google_workspace.delete_googleworkspaceprovidermapping", + "authentik_providers_google_workspace.delete_googleworkspaceproviderpropertymappingsgroup", + "authentik_providers_google_workspace.delete_googleworkspaceprovideruser", + "authentik_providers_google_workspace.view_googleworkspaceprovider", + "authentik_providers_google_workspace.view_googleworkspaceprovidergroup", + "authentik_providers_google_workspace.view_googleworkspaceprovidermapping", + "authentik_providers_google_workspace.view_googleworkspaceproviderpropertymappingsgroup", + "authentik_providers_google_workspace.view_googleworkspaceprovideruser", + "authentik_providers_ldap.add_ldapprovider", + "authentik_providers_ldap.change_ldapprovider", + "authentik_providers_ldap.delete_ldapprovider", + "authentik_providers_ldap.search_full_directory", + "authentik_providers_ldap.view_ldapprovider", + "authentik_providers_microsoft_entra.add_microsoftentraprovider", + "authentik_providers_microsoft_entra.add_microsoftentraprovidergroup", + "authentik_providers_microsoft_entra.add_microsoftentraprovidermapping", + "authentik_providers_microsoft_entra.add_microsoftentraproviderpropertymappingsgroup", + "authentik_providers_microsoft_entra.add_microsoftentraprovideruser", + "authentik_providers_microsoft_entra.change_microsoftentraprovider", + "authentik_providers_microsoft_entra.change_microsoftentraprovidergroup", + "authentik_providers_microsoft_entra.change_microsoftentraprovidermapping", + "authentik_providers_microsoft_entra.change_microsoftentraproviderpropertymappingsgroup", + "authentik_providers_microsoft_entra.change_microsoftentraprovideruser", + "authentik_providers_microsoft_entra.delete_microsoftentraprovider", + "authentik_providers_microsoft_entra.delete_microsoftentraprovidergroup", + "authentik_providers_microsoft_entra.delete_microsoftentraprovidermapping", + "authentik_providers_microsoft_entra.delete_microsoftentraproviderpropertymappingsgroup", + "authentik_providers_microsoft_entra.delete_microsoftentraprovideruser", + "authentik_providers_microsoft_entra.view_microsoftentraprovider", + "authentik_providers_microsoft_entra.view_microsoftentraprovidergroup", + "authentik_providers_microsoft_entra.view_microsoftentraprovidermapping", + "authentik_providers_microsoft_entra.view_microsoftentraproviderpropertymappingsgroup", + "authentik_providers_microsoft_entra.view_microsoftentraprovideruser", + "authentik_providers_oauth2.add_accesstoken", + "authentik_providers_oauth2.add_authorizationcode", + "authentik_providers_oauth2.add_devicetoken", + "authentik_providers_oauth2.add_dynamicclientregistrationpropertymapping", + "authentik_providers_oauth2.add_oauth2dynamicclientregistration", + "authentik_providers_oauth2.add_oauth2provider", + "authentik_providers_oauth2.add_oauth2providerjwtfederationprovider", + "authentik_providers_oauth2.add_oauth2providerjwtfederationsource", + "authentik_providers_oauth2.add_refreshtoken", + "authentik_providers_oauth2.add_scopemapping", + "authentik_providers_oauth2.change_accesstoken", + "authentik_providers_oauth2.change_authorizationcode", + "authentik_providers_oauth2.change_devicetoken", + "authentik_providers_oauth2.change_dynamicclientregistrationpropertymapping", + "authentik_providers_oauth2.change_oauth2dynamicclientregistration", + "authentik_providers_oauth2.change_oauth2provider", + "authentik_providers_oauth2.change_oauth2providerjwtfederationprovider", + "authentik_providers_oauth2.change_oauth2providerjwtfederationsource", + "authentik_providers_oauth2.change_refreshtoken", + "authentik_providers_oauth2.change_scopemapping", + "authentik_providers_oauth2.delete_accesstoken", + "authentik_providers_oauth2.delete_authorizationcode", + "authentik_providers_oauth2.delete_devicetoken", + "authentik_providers_oauth2.delete_dynamicclientregistrationpropertymapping", + "authentik_providers_oauth2.delete_oauth2dynamicclientregistration", + "authentik_providers_oauth2.delete_oauth2provider", + "authentik_providers_oauth2.delete_oauth2providerjwtfederationprovider", + "authentik_providers_oauth2.delete_oauth2providerjwtfederationsource", + "authentik_providers_oauth2.delete_refreshtoken", + "authentik_providers_oauth2.delete_scopemapping", + "authentik_providers_oauth2.view_accesstoken", + "authentik_providers_oauth2.view_authorizationcode", + "authentik_providers_oauth2.view_devicetoken", + "authentik_providers_oauth2.view_dynamicclientregistrationpropertymapping", + "authentik_providers_oauth2.view_oauth2dynamicclientregistration", + "authentik_providers_oauth2.view_oauth2provider", + "authentik_providers_oauth2.view_oauth2providerjwtfederationprovider", + "authentik_providers_oauth2.view_oauth2providerjwtfederationsource", + "authentik_providers_oauth2.view_refreshtoken", + "authentik_providers_oauth2.view_scopemapping", + "authentik_providers_proxy.add_proxyprovider", + "authentik_providers_proxy.add_proxysession", + "authentik_providers_proxy.change_proxyprovider", + "authentik_providers_proxy.change_proxysession", + "authentik_providers_proxy.delete_proxyprovider", + "authentik_providers_proxy.delete_proxysession", + "authentik_providers_proxy.view_proxyprovider", + "authentik_providers_proxy.view_proxysession", + "authentik_providers_rac.add_connectiontoken", + "authentik_providers_rac.add_endpoint", + "authentik_providers_rac.add_endpointpropertymapping", + "authentik_providers_rac.add_racpropertymapping", + "authentik_providers_rac.add_racprovider", + "authentik_providers_rac.change_connectiontoken", + "authentik_providers_rac.change_endpoint", + "authentik_providers_rac.change_endpointpropertymapping", + "authentik_providers_rac.change_racpropertymapping", + "authentik_providers_rac.change_racprovider", + "authentik_providers_rac.delete_connectiontoken", + "authentik_providers_rac.delete_endpoint", + "authentik_providers_rac.delete_endpointpropertymapping", + "authentik_providers_rac.delete_racpropertymapping", + "authentik_providers_rac.delete_racprovider", + "authentik_providers_rac.view_connectiontoken", + "authentik_providers_rac.view_endpoint", + "authentik_providers_rac.view_endpointpropertymapping", + "authentik_providers_rac.view_racpropertymapping", + "authentik_providers_rac.view_racprovider", + "authentik_providers_radius.add_radiusprovider", + "authentik_providers_radius.add_radiusproviderpropertymapping", + "authentik_providers_radius.change_radiusprovider", + "authentik_providers_radius.change_radiusproviderpropertymapping", + "authentik_providers_radius.delete_radiusprovider", + "authentik_providers_radius.delete_radiusproviderpropertymapping", + "authentik_providers_radius.view_radiusprovider", + "authentik_providers_radius.view_radiusproviderpropertymapping", + "authentik_providers_saml.add_samlpropertymapping", + "authentik_providers_saml.add_samlprovider", + "authentik_providers_saml.add_samlsession", + "authentik_providers_saml.change_samlpropertymapping", + "authentik_providers_saml.change_samlprovider", + "authentik_providers_saml.change_samlsession", + "authentik_providers_saml.delete_samlpropertymapping", + "authentik_providers_saml.delete_samlprovider", + "authentik_providers_saml.delete_samlsession", + "authentik_providers_saml.view_samlpropertymapping", + "authentik_providers_saml.view_samlprovider", + "authentik_providers_saml.view_samlsession", + "authentik_providers_scim.add_scimmapping", + "authentik_providers_scim.add_scimprovider", + "authentik_providers_scim.add_scimprovidergroup", + "authentik_providers_scim.add_scimprovidergroupfilter", + "authentik_providers_scim.add_scimprovidergrouppropertymapping", + "authentik_providers_scim.add_scimprovideruser", + "authentik_providers_scim.change_scimmapping", + "authentik_providers_scim.change_scimprovider", + "authentik_providers_scim.change_scimprovidergroup", + "authentik_providers_scim.change_scimprovidergroupfilter", + "authentik_providers_scim.change_scimprovidergrouppropertymapping", + "authentik_providers_scim.change_scimprovideruser", + "authentik_providers_scim.delete_scimmapping", + "authentik_providers_scim.delete_scimprovider", + "authentik_providers_scim.delete_scimprovidergroup", + "authentik_providers_scim.delete_scimprovidergroupfilter", + "authentik_providers_scim.delete_scimprovidergrouppropertymapping", + "authentik_providers_scim.delete_scimprovideruser", + "authentik_providers_scim.view_scimmapping", + "authentik_providers_scim.view_scimprovider", + "authentik_providers_scim.view_scimprovidergroup", + "authentik_providers_scim.view_scimprovidergroupfilter", + "authentik_providers_scim.view_scimprovidergrouppropertymapping", + "authentik_providers_scim.view_scimprovideruser", + "authentik_providers_ssf.add_ssfprovider", + "authentik_providers_ssf.add_ssfprovideroidcauthprovider", + "authentik_providers_ssf.add_stream", + "authentik_providers_ssf.add_streamevent", + "authentik_providers_ssf.change_ssfprovider", + "authentik_providers_ssf.change_ssfprovideroidcauthprovider", + "authentik_providers_ssf.change_stream", + "authentik_providers_ssf.change_streamevent", + "authentik_providers_ssf.delete_ssfprovider", + "authentik_providers_ssf.delete_ssfprovideroidcauthprovider", + "authentik_providers_ssf.delete_stream", + "authentik_providers_ssf.delete_streamevent", + "authentik_providers_ssf.view_ssfprovider", + "authentik_providers_ssf.view_ssfprovideroidcauthprovider", + "authentik_providers_ssf.view_stream", + "authentik_providers_ssf.view_streamevent", + "authentik_providers_ws_federation.add_wsfederationprovider", + "authentik_providers_ws_federation.change_wsfederationprovider", + "authentik_providers_ws_federation.delete_wsfederationprovider", + "authentik_providers_ws_federation.view_wsfederationprovider", + "authentik_rbac.access_admin_interface", + "authentik_rbac.add_initialpermissions", + "authentik_rbac.add_initialpermissionspermission", + "authentik_rbac.add_role", + "authentik_rbac.assign_role_permissions", + "authentik_rbac.change_initialpermissions", + "authentik_rbac.change_initialpermissionspermission", + "authentik_rbac.change_role", + "authentik_rbac.delete_initialpermissions", + "authentik_rbac.delete_initialpermissionspermission", + "authentik_rbac.delete_role", + "authentik_rbac.edit_system_settings", + "authentik_rbac.manage_media_files", + "authentik_rbac.unassign_role_permissions", + "authentik_rbac.view_initialpermissions", + "authentik_rbac.view_initialpermissionspermission", + "authentik_rbac.view_media_files", + "authentik_rbac.view_role", + "authentik_rbac.view_system_info", + "authentik_rbac.view_system_settings", + "authentik_reports.add_dataexport", + "authentik_reports.change_dataexport", + "authentik_reports.delete_dataexport", + "authentik_reports.view_dataexport", + "authentik_requests.add_grantrequest", + "authentik_requests.add_grantrequestapproval", + "authentik_requests.add_grantrequesttarget", + "authentik_requests.add_requestrule", + "authentik_requests.add_requestrulebinding", + "authentik_requests.add_requestrulechildbinding", + "authentik_requests.add_requestrulenotificationtransport", + "authentik_requests.change_grantrequest", + "authentik_requests.change_grantrequestapproval", + "authentik_requests.change_grantrequesttarget", + "authentik_requests.change_requestrule", + "authentik_requests.change_requestrulebinding", + "authentik_requests.change_requestrulechildbinding", + "authentik_requests.change_requestrulenotificationtransport", + "authentik_requests.delete_grantrequest", + "authentik_requests.delete_grantrequestapproval", + "authentik_requests.delete_grantrequesttarget", + "authentik_requests.delete_requestrule", + "authentik_requests.delete_requestrulebinding", + "authentik_requests.delete_requestrulechildbinding", + "authentik_requests.delete_requestrulenotificationtransport", + "authentik_requests.fulfill_grantrequest", + "authentik_requests.request_grantrequest", + "authentik_requests.revoke_grantrequest", + "authentik_requests.view_grantrequest", + "authentik_requests.view_grantrequestapproval", + "authentik_requests.view_grantrequesttarget", + "authentik_requests.view_requestrule", + "authentik_requests.view_requestrulebinding", + "authentik_requests.view_requestrulechildbinding", + "authentik_requests.view_requestrulenotificationtransport", + "authentik_sources_kerberos.add_groupkerberossourceconnection", + "authentik_sources_kerberos.add_kerberossource", + "authentik_sources_kerberos.add_kerberossourcepropertymapping", + "authentik_sources_kerberos.add_userkerberossourceconnection", + "authentik_sources_kerberos.change_groupkerberossourceconnection", + "authentik_sources_kerberos.change_kerberossource", + "authentik_sources_kerberos.change_kerberossourcepropertymapping", + "authentik_sources_kerberos.change_userkerberossourceconnection", + "authentik_sources_kerberos.delete_groupkerberossourceconnection", + "authentik_sources_kerberos.delete_kerberossource", + "authentik_sources_kerberos.delete_kerberossourcepropertymapping", + "authentik_sources_kerberos.delete_userkerberossourceconnection", + "authentik_sources_kerberos.view_groupkerberossourceconnection", + "authentik_sources_kerberos.view_kerberossource", + "authentik_sources_kerberos.view_kerberossourcepropertymapping", + "authentik_sources_kerberos.view_userkerberossourceconnection", + "authentik_sources_ldap.add_groupldapsourceconnection", + "authentik_sources_ldap.add_ldapsource", + "authentik_sources_ldap.add_ldapsourcepropertymapping", + "authentik_sources_ldap.add_userldapsourceconnection", + "authentik_sources_ldap.change_groupldapsourceconnection", + "authentik_sources_ldap.change_ldapsource", + "authentik_sources_ldap.change_ldapsourcepropertymapping", + "authentik_sources_ldap.change_userldapsourceconnection", + "authentik_sources_ldap.delete_groupldapsourceconnection", + "authentik_sources_ldap.delete_ldapsource", + "authentik_sources_ldap.delete_ldapsourcepropertymapping", + "authentik_sources_ldap.delete_userldapsourceconnection", + "authentik_sources_ldap.view_groupldapsourceconnection", + "authentik_sources_ldap.view_ldapsource", + "authentik_sources_ldap.view_ldapsourcepropertymapping", + "authentik_sources_ldap.view_userldapsourceconnection", + "authentik_sources_oauth.add_groupoauthsourceconnection", + "authentik_sources_oauth.add_oauthsource", + "authentik_sources_oauth.add_oauthsourcepropertymapping", + "authentik_sources_oauth.add_useroauthsourceconnection", + "authentik_sources_oauth.change_groupoauthsourceconnection", + "authentik_sources_oauth.change_oauthsource", + "authentik_sources_oauth.change_oauthsourcepropertymapping", + "authentik_sources_oauth.change_useroauthsourceconnection", + "authentik_sources_oauth.delete_groupoauthsourceconnection", + "authentik_sources_oauth.delete_oauthsource", + "authentik_sources_oauth.delete_oauthsourcepropertymapping", + "authentik_sources_oauth.delete_useroauthsourceconnection", + "authentik_sources_oauth.view_groupoauthsourceconnection", + "authentik_sources_oauth.view_oauthsource", + "authentik_sources_oauth.view_oauthsourcepropertymapping", + "authentik_sources_oauth.view_useroauthsourceconnection", + "authentik_sources_plex.add_groupplexsourceconnection", + "authentik_sources_plex.add_plexsource", + "authentik_sources_plex.add_plexsourcepropertymapping", + "authentik_sources_plex.add_userplexsourceconnection", + "authentik_sources_plex.change_groupplexsourceconnection", + "authentik_sources_plex.change_plexsource", + "authentik_sources_plex.change_plexsourcepropertymapping", + "authentik_sources_plex.change_userplexsourceconnection", + "authentik_sources_plex.delete_groupplexsourceconnection", + "authentik_sources_plex.delete_plexsource", + "authentik_sources_plex.delete_plexsourcepropertymapping", + "authentik_sources_plex.delete_userplexsourceconnection", + "authentik_sources_plex.view_groupplexsourceconnection", + "authentik_sources_plex.view_plexsource", + "authentik_sources_plex.view_plexsourcepropertymapping", + "authentik_sources_plex.view_userplexsourceconnection", + "authentik_sources_saml.add_groupsamlsourceconnection", + "authentik_sources_saml.add_samlsource", + "authentik_sources_saml.add_samlsourcepropertymapping", + "authentik_sources_saml.add_usersamlsourceconnection", + "authentik_sources_saml.change_groupsamlsourceconnection", + "authentik_sources_saml.change_samlsource", + "authentik_sources_saml.change_samlsourcepropertymapping", + "authentik_sources_saml.change_usersamlsourceconnection", + "authentik_sources_saml.delete_groupsamlsourceconnection", + "authentik_sources_saml.delete_samlsource", + "authentik_sources_saml.delete_samlsourcepropertymapping", + "authentik_sources_saml.delete_usersamlsourceconnection", + "authentik_sources_saml.view_groupsamlsourceconnection", + "authentik_sources_saml.view_samlsource", + "authentik_sources_saml.view_samlsourcepropertymapping", + "authentik_sources_saml.view_usersamlsourceconnection", + "authentik_sources_scim.add_scimsource", + "authentik_sources_scim.add_scimsourcegroup", + "authentik_sources_scim.add_scimsourcepropertymapping", + "authentik_sources_scim.add_scimsourceuser", + "authentik_sources_scim.change_scimsource", + "authentik_sources_scim.change_scimsourcegroup", + "authentik_sources_scim.change_scimsourcepropertymapping", + "authentik_sources_scim.change_scimsourceuser", + "authentik_sources_scim.delete_scimsource", + "authentik_sources_scim.delete_scimsourcegroup", + "authentik_sources_scim.delete_scimsourcepropertymapping", + "authentik_sources_scim.delete_scimsourceuser", + "authentik_sources_scim.view_scimsource", + "authentik_sources_scim.view_scimsourcegroup", + "authentik_sources_scim.view_scimsourcepropertymapping", + "authentik_sources_scim.view_scimsourceuser", + "authentik_sources_telegram.add_grouptelegramsourceconnection", + "authentik_sources_telegram.add_telegramsource", + "authentik_sources_telegram.add_telegramsourcepropertymapping", + "authentik_sources_telegram.add_usertelegramsourceconnection", + "authentik_sources_telegram.change_grouptelegramsourceconnection", + "authentik_sources_telegram.change_telegramsource", + "authentik_sources_telegram.change_telegramsourcepropertymapping", + "authentik_sources_telegram.change_usertelegramsourceconnection", + "authentik_sources_telegram.delete_grouptelegramsourceconnection", + "authentik_sources_telegram.delete_telegramsource", + "authentik_sources_telegram.delete_telegramsourcepropertymapping", + "authentik_sources_telegram.delete_usertelegramsourceconnection", + "authentik_sources_telegram.view_grouptelegramsourceconnection", + "authentik_sources_telegram.view_telegramsource", + "authentik_sources_telegram.view_telegramsourcepropertymapping", + "authentik_sources_telegram.view_usertelegramsourceconnection", + "authentik_stages_account_lockdown.add_accountlockdownstage", + "authentik_stages_account_lockdown.change_accountlockdownstage", + "authentik_stages_account_lockdown.delete_accountlockdownstage", + "authentik_stages_account_lockdown.view_accountlockdownstage", + "authentik_stages_authenticator_duo.add_authenticatorduostage", + "authentik_stages_authenticator_duo.add_duodevice", + "authentik_stages_authenticator_duo.change_authenticatorduostage", + "authentik_stages_authenticator_duo.change_duodevice", + "authentik_stages_authenticator_duo.delete_authenticatorduostage", + "authentik_stages_authenticator_duo.delete_duodevice", + "authentik_stages_authenticator_duo.view_authenticatorduostage", + "authentik_stages_authenticator_duo.view_duodevice", + "authentik_stages_authenticator_email.add_authenticatoremailstage", + "authentik_stages_authenticator_email.add_emaildevice", + "authentik_stages_authenticator_email.change_authenticatoremailstage", + "authentik_stages_authenticator_email.change_emaildevice", + "authentik_stages_authenticator_email.delete_authenticatoremailstage", + "authentik_stages_authenticator_email.delete_emaildevice", + "authentik_stages_authenticator_email.view_authenticatoremailstage", + "authentik_stages_authenticator_email.view_emaildevice", + "authentik_stages_authenticator_endpoint_gdtc.add_authenticatorendpointgdtcstage", + "authentik_stages_authenticator_endpoint_gdtc.add_endpointdevice", + "authentik_stages_authenticator_endpoint_gdtc.add_endpointdeviceconnection", + "authentik_stages_authenticator_endpoint_gdtc.change_authenticatorendpointgdtcstage", + "authentik_stages_authenticator_endpoint_gdtc.change_endpointdevice", + "authentik_stages_authenticator_endpoint_gdtc.change_endpointdeviceconnection", + "authentik_stages_authenticator_endpoint_gdtc.delete_authenticatorendpointgdtcstage", + "authentik_stages_authenticator_endpoint_gdtc.delete_endpointdevice", + "authentik_stages_authenticator_endpoint_gdtc.delete_endpointdeviceconnection", + "authentik_stages_authenticator_endpoint_gdtc.view_authenticatorendpointgdtcstage", + "authentik_stages_authenticator_endpoint_gdtc.view_endpointdevice", + "authentik_stages_authenticator_endpoint_gdtc.view_endpointdeviceconnection", + "authentik_stages_authenticator_sms.add_authenticatorsmsstage", + "authentik_stages_authenticator_sms.add_smsdevice", + "authentik_stages_authenticator_sms.change_authenticatorsmsstage", + "authentik_stages_authenticator_sms.change_smsdevice", + "authentik_stages_authenticator_sms.delete_authenticatorsmsstage", + "authentik_stages_authenticator_sms.delete_smsdevice", + "authentik_stages_authenticator_sms.view_authenticatorsmsstage", + "authentik_stages_authenticator_sms.view_smsdevice", + "authentik_stages_authenticator_static.add_authenticatorstaticstage", + "authentik_stages_authenticator_static.add_staticdevice", + "authentik_stages_authenticator_static.add_statictoken", + "authentik_stages_authenticator_static.change_authenticatorstaticstage", + "authentik_stages_authenticator_static.change_staticdevice", + "authentik_stages_authenticator_static.change_statictoken", + "authentik_stages_authenticator_static.delete_authenticatorstaticstage", + "authentik_stages_authenticator_static.delete_staticdevice", + "authentik_stages_authenticator_static.delete_statictoken", + "authentik_stages_authenticator_static.view_authenticatorstaticstage", + "authentik_stages_authenticator_static.view_staticdevice", + "authentik_stages_authenticator_static.view_statictoken", + "authentik_stages_authenticator_totp.add_authenticatortotpstage", + "authentik_stages_authenticator_totp.add_totpdevice", + "authentik_stages_authenticator_totp.change_authenticatortotpstage", + "authentik_stages_authenticator_totp.change_totpdevice", + "authentik_stages_authenticator_totp.delete_authenticatortotpstage", + "authentik_stages_authenticator_totp.delete_totpdevice", + "authentik_stages_authenticator_totp.view_authenticatortotpstage", + "authentik_stages_authenticator_totp.view_totpdevice", + "authentik_stages_authenticator_validate.add_authenticatorvalidatestage", + "authentik_stages_authenticator_validate.add_authenticatorvalidatestageconfigurationstage", + "authentik_stages_authenticator_validate.add_authenticatorvalidatestagewebauthnalloweddevicetype", + "authentik_stages_authenticator_validate.change_authenticatorvalidatestage", + "authentik_stages_authenticator_validate.change_authenticatorvalidatestageconfigurationstage", + "authentik_stages_authenticator_validate.change_authenticatorvalidatestagewebauthnalloweddevicetype", + "authentik_stages_authenticator_validate.delete_authenticatorvalidatestage", + "authentik_stages_authenticator_validate.delete_authenticatorvalidatestageconfigurationstage", + "authentik_stages_authenticator_validate.delete_authenticatorvalidatestagewebauthnalloweddevicetype", + "authentik_stages_authenticator_validate.view_authenticatorvalidatestage", + "authentik_stages_authenticator_validate.view_authenticatorvalidatestageconfigurationstage", + "authentik_stages_authenticator_validate.view_authenticatorvalidatestagewebauthnalloweddevicetype", + "authentik_stages_authenticator_webauthn.add_authenticatorwebauthnstage", + "authentik_stages_authenticator_webauthn.add_authenticatorwebauthnstagedevicetyperestriction", + "authentik_stages_authenticator_webauthn.add_webauthndevice", + "authentik_stages_authenticator_webauthn.add_webauthndevicetype", + "authentik_stages_authenticator_webauthn.change_authenticatorwebauthnstage", + "authentik_stages_authenticator_webauthn.change_authenticatorwebauthnstagedevicetyperestriction", + "authentik_stages_authenticator_webauthn.change_webauthndevice", + "authentik_stages_authenticator_webauthn.change_webauthndevicetype", + "authentik_stages_authenticator_webauthn.delete_authenticatorwebauthnstage", + "authentik_stages_authenticator_webauthn.delete_authenticatorwebauthnstagedevicetyperestriction", + "authentik_stages_authenticator_webauthn.delete_webauthndevice", + "authentik_stages_authenticator_webauthn.delete_webauthndevicetype", + "authentik_stages_authenticator_webauthn.view_authenticatorwebauthnstage", + "authentik_stages_authenticator_webauthn.view_authenticatorwebauthnstagedevicetyperestriction", + "authentik_stages_authenticator_webauthn.view_webauthndevice", + "authentik_stages_authenticator_webauthn.view_webauthndevicetype", + "authentik_stages_captcha.add_captchastage", + "authentik_stages_captcha.change_captchastage", + "authentik_stages_captcha.delete_captchastage", + "authentik_stages_captcha.view_captchastage", + "authentik_stages_consent.add_consentstage", + "authentik_stages_consent.add_userconsent", + "authentik_stages_consent.change_consentstage", + "authentik_stages_consent.change_userconsent", + "authentik_stages_consent.delete_consentstage", + "authentik_stages_consent.delete_userconsent", + "authentik_stages_consent.view_consentstage", + "authentik_stages_consent.view_userconsent", + "authentik_stages_deny.add_denystage", + "authentik_stages_deny.change_denystage", + "authentik_stages_deny.delete_denystage", + "authentik_stages_deny.view_denystage", + "authentik_stages_dummy.add_dummystage", + "authentik_stages_dummy.change_dummystage", + "authentik_stages_dummy.delete_dummystage", + "authentik_stages_dummy.view_dummystage", + "authentik_stages_email.add_emailstage", + "authentik_stages_email.change_emailstage", + "authentik_stages_email.delete_emailstage", + "authentik_stages_email.view_emailstage", + "authentik_stages_identification.add_identificationstage", + "authentik_stages_identification.add_identificationstagesource", + "authentik_stages_identification.change_identificationstage", + "authentik_stages_identification.change_identificationstagesource", + "authentik_stages_identification.delete_identificationstage", + "authentik_stages_identification.delete_identificationstagesource", + "authentik_stages_identification.view_identificationstage", + "authentik_stages_identification.view_identificationstagesource", + "authentik_stages_invitation.add_invitation", + "authentik_stages_invitation.add_invitationstage", + "authentik_stages_invitation.change_invitation", + "authentik_stages_invitation.change_invitationstage", + "authentik_stages_invitation.delete_invitation", + "authentik_stages_invitation.delete_invitationstage", + "authentik_stages_invitation.view_invitation", + "authentik_stages_invitation.view_invitationstage", + "authentik_stages_mtls.add_mutualtlsstage", + "authentik_stages_mtls.add_mutualtlsstagecertificateauthority", + "authentik_stages_mtls.change_mutualtlsstage", + "authentik_stages_mtls.change_mutualtlsstagecertificateauthority", + "authentik_stages_mtls.delete_mutualtlsstage", + "authentik_stages_mtls.delete_mutualtlsstagecertificateauthority", + "authentik_stages_mtls.pass_outpost_certificate", + "authentik_stages_mtls.view_mutualtlsstage", + "authentik_stages_mtls.view_mutualtlsstagecertificateauthority", + "authentik_stages_password.add_passwordstage", + "authentik_stages_password.change_passwordstage", + "authentik_stages_password.delete_passwordstage", + "authentik_stages_password.view_passwordstage", + "authentik_stages_prompt.add_prompt", + "authentik_stages_prompt.add_promptstage", + "authentik_stages_prompt.add_promptstagefield", + "authentik_stages_prompt.add_promptstagevalidationpolicy", + "authentik_stages_prompt.change_prompt", + "authentik_stages_prompt.change_promptstage", + "authentik_stages_prompt.change_promptstagefield", + "authentik_stages_prompt.change_promptstagevalidationpolicy", + "authentik_stages_prompt.delete_prompt", + "authentik_stages_prompt.delete_promptstage", + "authentik_stages_prompt.delete_promptstagefield", + "authentik_stages_prompt.delete_promptstagevalidationpolicy", + "authentik_stages_prompt.view_prompt", + "authentik_stages_prompt.view_promptstage", + "authentik_stages_prompt.view_promptstagefield", + "authentik_stages_prompt.view_promptstagevalidationpolicy", + "authentik_stages_redirect.add_redirectstage", + "authentik_stages_redirect.change_redirectstage", + "authentik_stages_redirect.delete_redirectstage", + "authentik_stages_redirect.view_redirectstage", + "authentik_stages_source.add_sourcestage", + "authentik_stages_source.change_sourcestage", + "authentik_stages_source.delete_sourcestage", + "authentik_stages_source.view_sourcestage", + "authentik_stages_user_delete.add_userdeletestage", + "authentik_stages_user_delete.change_userdeletestage", + "authentik_stages_user_delete.delete_userdeletestage", + "authentik_stages_user_delete.view_userdeletestage", + "authentik_stages_user_login.add_userloginstage", + "authentik_stages_user_login.change_userloginstage", + "authentik_stages_user_login.delete_userloginstage", + "authentik_stages_user_login.view_userloginstage", + "authentik_stages_user_logout.add_userlogoutstage", + "authentik_stages_user_logout.change_userlogoutstage", + "authentik_stages_user_logout.delete_userlogoutstage", + "authentik_stages_user_logout.view_userlogoutstage", + "authentik_stages_user_write.add_userwritestage", + "authentik_stages_user_write.change_userwritestage", + "authentik_stages_user_write.delete_userwritestage", + "authentik_stages_user_write.view_userwritestage", + "authentik_tasks.retry_task", + "authentik_tasks.view_task", + "authentik_tasks_schedules.change_schedule", + "authentik_tasks_schedules.send_schedule", + "authentik_tasks_schedules.view_schedule", + "authentik_tenants.add_domain", + "authentik_tenants.add_tenant", + "authentik_tenants.change_domain", + "authentik_tenants.change_tenant", + "authentik_tenants.delete_domain", + "authentik_tenants.delete_tenant", + "authentik_tenants.view_domain", + "authentik_tenants.view_tenant" + ] + }, + "title": "Permissions" + } + }, + "required": [] + }, + "model_authentik_core.actor_permissions": { + "type": "array", + "items": { + "type": "object", + "required": [ + "permission" + ], + "properties": { + "permission": { + "type": "string", + "enum": [ + "add_actor", + "change_actor", + "delete_actor", + "view_actor" + ] + }, + "user": { + "type": "integer" + }, + "role": { + "type": "string" + } + } + } + }, "model_authentik_core.application": { "type": "object", "properties": { @@ -5987,6 +7027,7 @@ "authentik_brands.delete_brandclientcertificate", "authentik_brands.view_brand", "authentik_brands.view_brandclientcertificate", + "authentik_core.add_actor", "authentik_core.add_application", "authentik_core.add_applicationentitlement", "authentik_core.add_authenticatedsession", @@ -6008,6 +7049,7 @@ "authentik_core.add_usergroup", "authentik_core.add_userrole", "authentik_core.add_usersourceconnection", + "authentik_core.change_actor", "authentik_core.change_application", "authentik_core.change_applicationentitlement", "authentik_core.change_authenticatedsession", @@ -6028,6 +7070,7 @@ "authentik_core.change_usergroup", "authentik_core.change_userrole", "authentik_core.change_usersourceconnection", + "authentik_core.delete_actor", "authentik_core.delete_application", "authentik_core.delete_applicationentitlement", "authentik_core.delete_authenticatedsession", @@ -6055,6 +7098,7 @@ "authentik_core.remove_user_from_group", "authentik_core.reset_user_password", "authentik_core.set_token_key", + "authentik_core.view_actor", "authentik_core.view_application", "authentik_core.view_applicationentitlement", "authentik_core.view_authenticatedsession", @@ -9979,6 +11023,7 @@ "authentik_core.applicationentitlement", "authentik_core.token", "authentik_core.objectattribute", + "authentik_core.actor", "authentik_crypto.certificatekeypair", "authentik_endpoints.deviceuserbinding", "authentik_endpoints.deviceaccessgroup", @@ -12382,6 +13427,7 @@ "authentik_brands.delete_brandclientcertificate", "authentik_brands.view_brand", "authentik_brands.view_brandclientcertificate", + "authentik_core.add_actor", "authentik_core.add_application", "authentik_core.add_applicationentitlement", "authentik_core.add_authenticatedsession", @@ -12403,6 +13449,7 @@ "authentik_core.add_usergroup", "authentik_core.add_userrole", "authentik_core.add_usersourceconnection", + "authentik_core.change_actor", "authentik_core.change_application", "authentik_core.change_applicationentitlement", "authentik_core.change_authenticatedsession", @@ -12423,6 +13470,7 @@ "authentik_core.change_usergroup", "authentik_core.change_userrole", "authentik_core.change_usersourceconnection", + "authentik_core.delete_actor", "authentik_core.delete_application", "authentik_core.delete_applicationentitlement", "authentik_core.delete_authenticatedsession", @@ -12450,6 +13498,7 @@ "authentik_core.remove_user_from_group", "authentik_core.reset_user_password", "authentik_core.set_token_key", + "authentik_core.view_actor", "authentik_core.view_application", "authentik_core.view_applicationentitlement", "authentik_core.view_authenticatedsession", diff --git a/packages/client-ts/src/models/ModelEnum.ts b/packages/client-ts/src/models/ModelEnum.ts index 3b598d35a0..0b520f647d 100644 --- a/packages/client-ts/src/models/ModelEnum.ts +++ b/packages/client-ts/src/models/ModelEnum.ts @@ -24,6 +24,7 @@ export const ModelEnum = { AuthentikCoreApplicationentitlement: "authentik_core.applicationentitlement", AuthentikCoreToken: "authentik_core.token", AuthentikCoreObjectattribute: "authentik_core.objectattribute", + AuthentikCoreActor: "authentik_core.actor", AuthentikCryptoCertificatekeypair: "authentik_crypto.certificatekeypair", AuthentikEndpointsDeviceuserbinding: "authentik_endpoints.deviceuserbinding", AuthentikEndpointsDeviceaccessgroup: "authentik_endpoints.deviceaccessgroup", diff --git a/schema.yml b/schema.yml index 96768677a4..60270f0fc6 100644 --- a/schema.yml +++ b/schema.yml @@ -45013,6 +45013,7 @@ components: - authentik_core.applicationentitlement - authentik_core.token - authentik_core.objectattribute + - authentik_core.actor - authentik_crypto.certificatekeypair - authentik_endpoints.deviceuserbinding - authentik_endpoints.deviceaccessgroup