Field note

What it does

Sections: Keycloak Admin REST API | Overview | Version information | URI scheme | OpenAPI Definitions | Resources | Attack Detection | DELETE /admin/realms/{realm}/attack-detection/brute-force/users | DELETE /admin/realms/{realm}/attack-detection/brute-force/users/{userId} | GET /admin/realms/{realm}/attack-detection/brute-force/users/{userId} | Authentication Management | GET /admin/realms/{realm}/authentication/authenticator-providers | GET /admin/realms/{realm}/authentication/client-authenticator-providers | GET /admin/realms/{realm}/authentication/config-description/{providerId} | DELETE /admin/realms/{realm}/authentication/config/{id} | GET /admin/realms/{realm}/authentication/config/{id} | PUT /admin/realms/{realm}/authentication/config/{id} | POST /admin/realms/{realm}/authentication/config | GET /admin/realms/{realm}/authentication/executions/{executionId}/config/{id} | POST /admin/realms/{realm}/authentication/executions/{executionId}/config | DELETE /admin/realms/{realm}/authentication/executions/{executionId} | GET /admin/realms/{realm}/authentication/executions/{executionId} | POST /admin/realms/{realm}/authentication/executions/{executionId}/lower-priority | POST /admin/realms/{realm}/authentication/executions/{executionId}/raise-priority | POST /admin/realms/{realm}/authentication/executions | POST /admin/realms/{realm}/authentication/flows/{flowAlias}/copy | POST /admin/realms/{realm}/authentication/flows/{flowAlias}/executions/execution | POST /admin/realms/{realm}/authentication/flows/{flowAlias}/executions/flow | GET /admin/realms/{realm}/authentication/flows/{flowAlias}/executions | PUT /admin/realms/{realm}/authentication/flows/{flowAlias}/executions | GET /admin/realms/{realm}/authentication/flows | DELETE /admin/realms/{realm}/authentication/flows/{id} | GET /admin/realms/{realm}/authentication/flows/{id} | PUT /admin/realms/{realm}/authentication/flows/{id} | POST /admin/realms/{realm}/authentication/flows | GET /admin/realms/{realm}/authentication/form-action-providers | GET /admin/realms/{realm}/authentication/form-providers | GET /admin/realms/{realm}/authentication/per-client-config-description | POST /admin/realms/{realm}/authentication/register-required-action | DELETE /admin/realms/{realm}/authentication/required-actions/{alias}/config | GET /admin/realms/{realm}/authentication/required-actions/{alias}/config-description | GET /admin/realms/{realm}/authentication/required-actions/{alias}/config | PUT /admin/realms/{realm}/authentication/required-actions/{alias}/config | DELETE /admin/realms/{realm}/authentication/required-actions/{alias} | GET /admin/realms/{realm}/authentication/required-actions/{alias} | POST /admin/realms/{realm}/authentication/required-actions/{alias}/lower-priority | PUT /admin/realms/{realm}/authentication/required-actions/{alias} | POST /admin/realms/{realm}/authentication/required-actions/{alias}/raise-priority | GET /admin/realms/{realm}/authentication/required-actions | GET /admin/realms/{realm}/authentication/unregistered-required-actions | Client Attribute Certificate | POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download | POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download | POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate | GET /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr} | POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload-certificate | POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload | POST /admin/realms/{realm}/identity-provider/upload-certificate | Client Initial Access | GET /admin/realms/{realm}/clients-initial-access | DELETE /admin/realms/{realm}/clients-initial-access/{id} | POST /admin/realms/{realm}/clients-initial-access | Client Registration Policy | GET /admin/realms/{realm}/client-registration-policy/providers | Client Role Mappings | GET /admin/realms/{realm}/groups/{group-id}/role-mapping Server Developer Guide Server Developer Guide Table of Contents Preface Container Images Example Listings Admin REST API Examples of using CURL Authenticating with a username and password Authenticating with a service account Additional resources Identity Brokering APIs Retrieving external IDP tokens Identity brokering API V1 Identity brokering API V2 Integration with client policies Client initiated account linking Refreshing external tokens Legacy client initiated account linking Service Provider Interfaces (SPI) Implementing an SPI Override built-in providers Show info from your SPI implementation in the Admin Console Use available providers Registering provider implementations Disabling a provider JavaScript providers Authenticator OpenID Connect Protocol Mapper Create a JAR with the scripts to deploy Deploy t Sections: Release Notes | Keycloak 26.7.0 | Security and Standards | Stronger security for the Identity Brokering API | Progress on Verifiable Credentials (OID4VCI) (experimental) | Cross-domain token exchange with Identity Assertion JWT Grant (experimental) | Automate user provisioning with the SCIM API (preview) | Real-time security signals to downstream applications (experimental) | Standardized authorization decisions with AuthZen (experimental) | Authorize AI tools and MCP servers | Delegate access across services with Token Exchange Delegation (experimental) | Step-up authentication for SAML clients | Administration | Declarative client management with Admin API v2 (experimental) | Fine-grained delegation for organization administration | Automatic role inheritance through organization groups | Better passkey compatibility with new WebAuthn policy options | Easier realm discovery by display name search | Type-safe validation for parameterized scopes (experimental) | Additional datasources may be excluded from health checks | Configuring and Running | Enhanced reverse proxy guides with blueprints for HAProxy and Traefik | Simplified multi-cluster high availability without external caches (preview) | Keycloak Operator kustomize installation | Cluster-wide install mode for the Keycloak Operator (preview) | Keycloak 26.6.0 | JWT Authorization Grant (supported) | Federated client authentication (supported) | New guide about Demonstrating Proof-of-Possession (DPoP) | Identity Brokering APIs V2 (preview) | Step-up authentication for SAML (preview) | OAuth Client ID Metadata Document (experimental) | Workflows (supported) | Organization groups | New Groups scope for user membership changes | Looking up client secrets via the Vault SPI | Forcing password change for LDAP users | Java 25 support | Zero-downtime patch releases (supported) | Installation instructions for CloudNativePG | Simplified database operations | Graceful shutdown of HTTP stack | New KCRAW_ prefix for environment variables to preserve literal values | Automatic reload of lists with disallowed passwords | Automatic truststore initialization on Kubernetes and OpenShift | Client certificate lookup providers for Traefik and Envoy | Configurable Kubernetes Service name and port in the Keycloak Operator | Sensitive information is not displayed in the HTTP Access log | Configurable log file rotation | HTTP access logs in a dedicated file | Customizable service fields in JSON log output | New and updated translations | Right-to-left language support in the Account UI | Observability | Telemetry configuration via the Keycloak CR | Custom request headers for OpenTelemetry | Service Monitor annotations and labels via the Keycloak CR | Extension Development | Keycloak Test Framework (supported) | Keycloak 26.5.0 | JWT Authorization Grant (preview) | Using Keycloak as an authorization server for Model Context Protocol (MCP) servers | CORS enhancements | Logout confirmation page | Hiding OpenID Connect scopes from the discovery endpoint | Workflows (preview) | Federated client authentication (preview) | Organization invitation management | New event USER_SESSION_D

Keycloak Server Container Image

What it does

Available capabilities

Tags

Ways to use it