Query Reference

The queryable vocabulary of every entity, one section per schema. Read Query Language first: it defines the parameters, the operators and the rules under which a key here is honoured or silently dropped.

Generated from release 1.0.0-beta.65, registry fingerprint e724e285f003ffb606eeacb2d59c4bc9882e4e5dfa0ca12d32ada2d8dd34f2fe. GET /schemas reports both values back under meta, so a deployment that has drifted from this page can be recognised without diffing anything.

Every list below is the static upper bound. A caller is additionally subject to its own permissions: a relation it may not read is stripped from the include, and a gated column is redacted, both without an error.

client

Collection: GET /clients, GET /realms/{realmId}/clients

Record: GET /clients/{id}, GET /realms/{realmId}/clients/{id}

Parameter	Accepted keys
fields	id, active, builtIn, name, displayName, description, secretHashed, secretEncrypted, baseUrl, redirectUri, postLogoutRedirectUri, backchannelLogoutUri, grantTypes, authMethod, tokenBindingMethod, accessPolicyId, realmId, updatedAt, createdAt, secret
filter	id, name, displayName, realmId, active, builtIn
sort	id, createdAt, updatedAt
include	realm, accessPolicy (policy)
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned except secret, which has to be asked for by name.

Index prefixes: id · name, realmId · displayName · realmId · active · builtIn · createdAt · updatedAt

clientPermission

Collection: GET /client-permissions

Record: GET /client-permissions/{id}

Parameter	Accepted keys
fields	id, policyId, realmScope, permissionId, permissionRealmId, clientId, clientRealmId, createdAt, updatedAt
filter	clientId, permissionId, id, clientRealmId, permissionRealmId, policyId
sort	id, createdAt, updatedAt
include	client, permission
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · clientId, permissionId · permissionId · clientRealmId · permissionRealmId · policyId · createdAt · updatedAt

clientRole

Collection: GET /client-roles

Record: GET /client-roles/{id}

Parameter	Accepted keys
fields	id, clientId, clientRealmId, roleId, roleRealmId, createdAt, updatedAt
filter	clientId, roleId, id, clientRealmId, roleRealmId
sort	id, createdAt, updatedAt
include	client, role
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · roleId, clientId · clientId · clientRealmId · roleRealmId · createdAt · updatedAt

clientScope

Collection: GET /client-scopes

Record: GET /client-scopes/{id}

Parameter	Accepted keys
fields	id, default, clientId, clientRealmId, scopeId, scopeRealmId, createdAt, updatedAt
filter	clientId, scopeId, default, id, clientRealmId, scopeRealmId
sort	id, default, clientId, clientRealmId, scopeId, scopeRealmId, createdAt, updatedAt
include	client, scope
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · clientId, scopeId · scopeId · default · clientRealmId · scopeRealmId · createdAt · updatedAt

consent

Collection: GET /consents, GET /realms/{realmId}/consents

Record: GET /consents/{id}, GET /realms/{realmId}/consents/{id}

Parameter	Accepted keys
fields	id, clientId, realmId, userId, sub, subKind, scope, expiresAt, createdAt, updatedAt
filter	id, clientId, realmId, sub, subKind, scope, userId
sort	createdAt, updatedAt, scope
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · clientId, sub, subKind, scope · sub · subKind · scope · realmId · userId · createdAt · updatedAt

event

Collection: GET /events, GET /realms/{realmId}/events

Record: GET /events/{id}, GET /realms/{realmId}/events/{id}

Parameter	Accepted keys
fields	id, scope, name, refType, refId, clientId, sessionId, actorType, actorId, actorName, requestPath, requestMethod, requestIpAddress, requestUserAgent, realmId, data, expiring, expiresAt, createdAt
filter	id, scope, name, refType, refId, clientId, sessionId, actorType, actorId, actorName, requestIpAddress, realmId, expiring, createdAt
sort	createdAt
include	none
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, scope · scope · refType, refId · refId · clientId · sessionId · actorType · actorId · actorName, requestIpAddress, createdAt · requestIpAddress · realmId · expiring · realmId, createdAt · createdAt

identityProvider

Collection: GET /identity-providers, GET /realms/{realmId}/identity-providers

Record: GET /identity-providers/{id}, GET /realms/{realmId}/identity-providers/{id}

Parameter	Accepted keys
fields	id, name, displayName, protocol, preset, enabled, realmId, createdAt, updatedAt
filter	name, displayName, protocol, enabled, realmId, id
sort	id, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · displayName · protocol · enabled · realmId · createdAt · updatedAt

identityProviderAccount

Collection: GET /identity-provider-accounts, GET /realms/{realmId}/identity-provider-accounts

Record: GET /identity-provider-accounts/{id}, GET /realms/{realmId}/identity-provider-accounts/{id}

Parameter	Accepted keys
fields	id, providerUserId, providerUserName, providerUserEmail, createdAt, updatedAt, userId, userRealmId, providerId, providerRealmId
filter	id, userId, providerId, userRealmId, providerUserId, providerRealmId
sort	createdAt, updatedAt
include	provider (identityProvider)
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · providerId, userId · userId · userRealmId · providerUserId, providerId · providerRealmId · createdAt · updatedAt

identityProviderRoleMapping

Collection: GET /identity-provider-role-mappings

Record: GET /identity-provider-role-mappings/{id}

Parameter	Accepted keys
fields	id, name, value, valueIsRegex, synchronizationMode, providerId, providerRealmId, roleId, roleRealmId, createdAt, updatedAt
filter	roleId, providerId, id, providerRealmId, roleRealmId
sort	id, createdAt, updatedAt
include	role, provider (identityProvider)
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · providerId, roleId · roleId · providerRealmId · roleRealmId · createdAt · updatedAt

key

Collection: GET /keys, GET /realms/{realmId}/keys

Record: GET /keys/{id}, GET /realms/{realmId}/keys/{id}

Parameter	Accepted keys
fields	id, name, type, use, priority, status, signatureAlgorithm, realmId, createdAt, updatedAt, encryptionKey, certificate
filter	id, name, type, use, status, realmId, priority
sort	id, name, priority, use, status, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned except encryptionKey, certificate, which has to be asked for by name.

Index prefixes: id · name, realmId · type · use · status · realmId · priority, realmId, type · createdAt · updatedAt

permission

Collection: GET /permissions, GET /realms/{realmId}/permissions

Record: GET /permissions/{id}, GET /realms/{realmId}/permissions/{id}

Parameter	Accepted keys
fields	id, builtIn, name, displayName, description, decisionStrategy, clientId, realmId, createdAt, updatedAt
filter	id, displayName, name, builtIn, realmId, clientId
sort	id, name, createdAt, updatedAt
include	none
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, clientId, realmId · displayName · builtIn · realmId · clientId · createdAt · updatedAt

permissionPolicy

Collection: GET /permission-policies

Record: GET /permission-policies/{id}

Parameter	Accepted keys
fields	id, permissionId, permissionRealmId, policyId, policyRealmId, createdAt, updatedAt
filter	permissionId, policyId, id, permissionRealmId, policyRealmId
sort	id, createdAt, updatedAt
include	permission, policy
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · permissionId, policyId · policyId · permissionRealmId · policyRealmId · createdAt · updatedAt

policy

Collection: GET /policies, GET /realms/{realmId}/policies

Record: GET /policies/{id}/expanded, GET /realms/{realmId}/policies/{id}/expanded, GET /policies/{id}, GET /realms/{realmId}/policies/{id}

Parameter	Accepted keys
fields	id, builtIn, type, displayName, name, description, invert, parentId, realmId, createdAt, updatedAt
filter	id, name, displayName, type, parentId, realmId, builtIn
sort	id, createdAt, updatedAt
include	children (policy), realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · displayName · type · parentId · realmId · builtIn · createdAt · updatedAt

realm

Collection: GET /realms

Record: GET /realms/{id}

Parameter	Accepted keys
fields	id, name, displayName, description, builtIn, createdAt, updatedAt
filter	id, builtIn, displayName, name
sort	id, name, createdAt, updatedAt
include	none
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name · builtIn · displayName · createdAt · updatedAt

role

Collection: GET /roles

Record: GET /roles/{id}

Parameter	Accepted keys
fields	id, builtIn, name, displayName, target, description, clientId, realmId, createdAt, updatedAt
filter	id, builtIn, name, displayName, target, clientId, realmId
sort	id, name, updatedAt, createdAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, clientId, realmId · displayName · builtIn · target · clientId · realmId · createdAt · updatedAt

roleAttribute

Collection: GET /role-attributes

Record: GET /role-attributes/{id}

Parameter	Accepted keys
fields	id, name, value, roleId, realmId, createdAt, updatedAt
filter	id, name, roleId, realmId
sort	id, name, roleId, realmId, createdAt, updatedAt
include	role, realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, roleId · roleId · realmId · createdAt · updatedAt

rolePermission

Collection: GET /role-permissions

Record: GET /role-permissions/{id}

Parameter	Accepted keys
fields	id, policyId, realmScope, permissionId, permissionRealmId, roleId, roleRealmId, createdAt, updatedAt
filter	roleId, permissionId, id, roleRealmId, permissionRealmId, policyId
sort	id, createdAt, updatedAt
include	role, permission
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · permissionId, roleId · roleId · roleRealmId · permissionRealmId · policyId · createdAt · updatedAt

scope

Collection: GET /scopes

Record: GET /scopes/{id}

Parameter	Accepted keys
fields	id, builtIn, name, displayName, description, realmId, createdAt, updatedAt
filter	id, builtIn, name, displayName, realmId
sort	id, name, updatedAt, createdAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · displayName · builtIn · realmId · createdAt · updatedAt

session

Collection: GET /sessions, GET /realms/{realmId}/sessions

Record: GET /sessions/{id}, GET /realms/{realmId}/sessions/{id}

Filter only: DELETE /sessions, DELETE /realms/{realmId}/sessions

Parameter	Accepted keys
fields	id, sub, subKind, ipAddress, userAgent, authMethod, mfaAt, expiresAt, refreshedAt, seenAt, createdAt, updatedAt, userId, clientId, realmId
filter	id, sub, subKind, userId, clientId, realmId, expiresAt, seenAt
sort	seenAt, expiresAt, createdAt, updatedAt
include	realm, user, client
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · sub · subKind · userId · clientId · realmId · seenAt · expiresAt · userId, seenAt · realmId, seenAt · createdAt · updatedAt

sessionToken

Collection: GET /session-tokens

Record: GET /session-tokens/{id}

Filter only: DELETE /session-tokens

Parameter	Accepted keys
fields	id, sessionId, clientId, kind, parentId, refreshTokenId, ipAddress, userAgent, consumedAt, revokedAt, expiresAt, createdAt
filter	id, sessionId, clientId, kind, expiresAt
sort	createdAt, expiresAt
include	session
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · sessionId · clientId · kind · expiresAt · sessionId, createdAt · createdAt

trustAnchor

Collection: GET /trust-anchors, GET /realms/{realmId}/trust-anchors

Record: GET /trust-anchors/{id}, GET /realms/{realmId}/trust-anchors/{id}

Parameter	Accepted keys
fields	id, name, certificate, enabled, realmId, createdAt, updatedAt
filter	id, name, enabled, realmId
sort	id, name, enabled, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · enabled · realmId · createdAt · updatedAt

user

Collection: GET /users, GET /realms/{realmId}/users

Record: GET /userinfo, GET /users/{id}, GET /realms/{realmId}/users/{id}

Parameter	Accepted keys
fields	id, name, nameLocked, firstName, lastName, displayName, emailVerified, avatar, cover, active, status, statusMessage, createdAt, updatedAt, realmId, email
filter	id, name, displayName, realmId, active
sort	id, name, displayName, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned except email, which has to be asked for by name.

Index prefixes: id · name, realmId · displayName · realmId · active · createdAt · updatedAt

userAttribute

Collection: GET /user-attributes

Record: GET /user-attributes/{id}

Parameter	Accepted keys
fields	id, name, value, userId, realmId, createdAt, updatedAt
filter	id, name, userId, realmId
sort	id, name, userId, realmId, createdAt, updatedAt
include	user, realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, userId · userId · realmId · createdAt · updatedAt

userAuthenticator

Collection: GET /users/{id}/authenticators

Record: GET /users/{id}/authenticators/{deviceId}

Parameter	Accepted keys
fields	id, kind, name, confirmed, lastUsedAt, createdAt, updatedAt, userId, realmId
filter	id, kind, confirmed, userId, realmId, lastUsedAt
sort	createdAt, updatedAt, lastUsedAt
include	user, realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · kind · confirmed · userId · realmId · createdAt · updatedAt · lastUsedAt

userPermission

Collection: GET /user-permissions

Record: GET /user-permissions/{id}

Parameter	Accepted keys
fields	id, policyId, realmScope, permissionId, permissionRealmId, userId, userRealmId, createdAt, updatedAt
filter	userId, permissionId, id, userRealmId, permissionRealmId, policyId
sort	id, createdAt, updatedAt
include	user, permission
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · permissionId, userId · userId · userRealmId · permissionRealmId · policyId · createdAt · updatedAt

userRole

Collection: GET /user-roles

Record: GET /user-roles/{id}

Parameter	Accepted keys
fields	id, roleId, roleRealmId, userId, userRealmId, createdAt, updatedAt
filter	roleId, userId, id, roleRealmId, userRealmId
sort	id, createdAt, updatedAt
include	user, role
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · roleId, userId · userId · roleRealmId · userRealmId · createdAt · updatedAt