Query Reference

The queryable vocabulary of every entity, one section per schema. Read Query Language first: it defines the parameters, the operators and the rules under which a key here is honoured or silently dropped.

Generated from release 1.0.0-beta.68, registry fingerprint 8d03b546fc638304e3bab565a0c91168670496a25ccc6c182af5ab5cfbb10351. GET /schemas reports both values back under meta, so a deployment that has drifted from this page can be recognised without diffing anything.

Every list below is the static upper bound. A caller is additionally subject to its own permissions: a relation it may not read is stripped from the include, and a gated column is redacted, both without an error.

client

Collection: GET /clients, GET /realms/{realmId}/clients

Record: GET /clients/@stats, GET /realms/{realmId}/clients/@stats, GET /clients/{id}, GET /realms/{realmId}/clients/{id}

Parameter	Accepted keys
fields	id, active, builtIn, name, displayName, description, secretHashed, secretEncrypted, baseUrl, redirectUri, postLogoutRedirectUri, backchannelLogoutUri, grantTypes, authMethod, tokenBindingMethod, accessPolicyId, realmId, pathId, updatedAt, createdAt, secret
filter	id, name, displayName, realmId, pathId, active, builtIn, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	realm, accessPolicy (policy), path
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned except secret, which has to be asked for by name.

Index prefixes: id · name, realmId · displayName · realmId · pathId · active · builtIn · createdAt · updatedAt

clientPermission

Collection: GET /client-permissions

Record: GET /client-permissions/{id}

Parameter	Accepted keys
fields	id, policyId, realmScope, permissionId, permissionRealmId, clientId, clientRealmId, createdAt, updatedAt
filter	clientId, permissionId, id, clientRealmId, permissionRealmId, policyId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	client, permission
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · clientId, permissionId · permissionId · clientRealmId · permissionRealmId · policyId · createdAt · updatedAt

clientRole

Collection: GET /client-roles

Record: GET /client-roles/{id}

Parameter	Accepted keys
fields	id, clientId, clientRealmId, roleId, roleRealmId, createdAt, updatedAt
filter	clientId, roleId, id, clientRealmId, roleRealmId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	client, role
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · roleId, clientId · clientId · clientRealmId · roleRealmId · createdAt · updatedAt

clientScope

Collection: GET /client-scopes

Record: GET /client-scopes/{id}

Parameter	Accepted keys
fields	id, default, clientId, clientRealmId, scopeId, scopeRealmId, createdAt, updatedAt
filter	clientId, scopeId, default, id, clientRealmId, scopeRealmId, createdAt, updatedAt
sort	id, default, clientId, clientRealmId, scopeId, scopeRealmId, createdAt, updatedAt
include	client, scope
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · clientId, scopeId · scopeId · default · clientRealmId · scopeRealmId · createdAt · updatedAt

consent

Collection: GET /consents, GET /realms/{realmId}/consents

Record: GET /consents/{id}, GET /realms/{realmId}/consents/{id}

Parameter	Accepted keys
fields	id, clientId, realmId, userId, sub, subKind, scope, expiresAt, createdAt, updatedAt
filter	id, clientId, realmId, sub, subKind, scope, userId, createdAt, updatedAt
sort	createdAt, updatedAt, scope
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · clientId, sub, subKind, scope · sub · subKind · scope · realmId · userId · createdAt · updatedAt

event

Collection: GET /events, GET /realms/{realmId}/events

Record: GET /events/@stats, GET /realms/{realmId}/events/@stats, GET /events/{id}, GET /realms/{realmId}/events/{id}

Parameter	Accepted keys
fields	id, scope, name, refType, refId, clientId, sessionId, actorType, actorId, actorName, requestPath, requestMethod, requestIpAddress, requestUserAgent, realmId, data, expiring, expiresAt, createdAt
filter	id, scope, name, refType, refId, clientId, sessionId, actorType, actorId, actorName, requestIpAddress, realmId, expiring, createdAt
sort	createdAt
include	none
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, scope · scope · refType, refId · refId · clientId · sessionId · actorType · actorId · actorName, requestIpAddress, createdAt · requestIpAddress · realmId · expiring · realmId, createdAt · createdAt

identityProvider

Collection: GET /identity-providers, GET /realms/{realmId}/identity-providers

Record: GET /identity-providers/@stats, GET /realms/{realmId}/identity-providers/@stats, GET /identity-providers/{id}, GET /realms/{realmId}/identity-providers/{id}

Parameter	Accepted keys
fields	id, name, displayName, protocol, preset, enabled, realmId, createdAt, updatedAt
filter	name, displayName, protocol, enabled, realmId, id, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · displayName · protocol · enabled · realmId · createdAt · updatedAt

identityProviderAccount

Collection: GET /identity-provider-accounts, GET /realms/{realmId}/identity-provider-accounts

Record: GET /identity-provider-accounts/{id}, GET /realms/{realmId}/identity-provider-accounts/{id}

Parameter	Accepted keys
fields	id, providerUserId, providerUserName, providerUserEmail, createdAt, updatedAt, userId, userRealmId, providerId, providerRealmId
filter	id, userId, providerId, userRealmId, providerUserId, providerRealmId, createdAt, updatedAt
sort	createdAt, updatedAt
include	provider (identityProvider)
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · providerId, userId · userId · userRealmId · providerUserId, providerId · providerRealmId · createdAt · updatedAt

identityProviderRoleMapping

Collection: GET /identity-provider-role-mappings

Record: GET /identity-provider-role-mappings/{id}

Parameter	Accepted keys
fields	id, name, value, valueIsRegex, synchronizationMode, providerId, providerRealmId, roleId, roleRealmId, createdAt, updatedAt
filter	roleId, providerId, id, providerRealmId, roleRealmId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	role, provider (identityProvider)
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · providerId, roleId · roleId · providerRealmId · roleRealmId · createdAt · updatedAt

key

Collection: GET /keys, GET /realms/{realmId}/keys

Record: GET /keys/@stats, GET /realms/{realmId}/keys/@stats, GET /keys/{id}, GET /realms/{realmId}/keys/{id}

Parameter	Accepted keys
fields	id, name, type, use, priority, status, signatureAlgorithm, realmId, createdAt, updatedAt, encryptionKey, certificate
filter	id, name, type, use, status, realmId, priority, createdAt, updatedAt
sort	id, name, priority, use, status, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned except encryptionKey, certificate, which has to be asked for by name.

Index prefixes: id · name, realmId · type · use · status · realmId · priority, realmId, type · createdAt · updatedAt

path

Collection: GET /paths, GET /realms/{realmId}/paths

Record: GET /paths/@stats, GET /realms/{realmId}/paths/@stats, GET /paths/{id}, GET /realms/{realmId}/paths/{id}

Parameter	Accepted keys
fields	id, name, path, displayName, description, parentId, realmId, createdAt, updatedAt
filter	id, path, displayName, parentId, realmId, createdAt, updatedAt
sort	id, path, createdAt, updatedAt
include	realm, parent (path)
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · path, realmId · displayName · parentId · realmId · createdAt · updatedAt

permission

Collection: GET /permissions, GET /realms/{realmId}/permissions

Record: GET /permissions/@stats, GET /realms/{realmId}/permissions/@stats, GET /permissions/{id}, GET /realms/{realmId}/permissions/{id}

Parameter	Accepted keys
fields	id, builtIn, name, displayName, description, decisionStrategy, clientId, realmId, createdAt, updatedAt
filter	id, displayName, name, builtIn, realmId, clientId, createdAt, updatedAt
sort	id, name, createdAt, updatedAt
include	none
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, clientId, realmId · displayName · builtIn · realmId · clientId · createdAt · updatedAt

permissionPolicy

Collection: GET /permission-policies

Record: GET /permission-policies/{id}

Parameter	Accepted keys
fields	id, permissionId, permissionRealmId, policyId, policyRealmId, createdAt, updatedAt
filter	permissionId, policyId, id, permissionRealmId, policyRealmId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	permission, policy
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · permissionId, policyId · policyId · permissionRealmId · policyRealmId · createdAt · updatedAt

policy

Collection: GET /policies, GET /realms/{realmId}/policies

Record: GET /policies/@stats, GET /realms/{realmId}/policies/@stats, GET /policies/{id}/expanded, GET /realms/{realmId}/policies/{id}/expanded, GET /policies/{id}, GET /realms/{realmId}/policies/{id}

Parameter	Accepted keys
fields	id, builtIn, type, displayName, name, description, invert, parentId, realmId, createdAt, updatedAt
filter	id, name, displayName, type, parentId, realmId, builtIn, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	children (policy), realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · displayName · type · parentId · realmId · builtIn · createdAt · updatedAt

realm

Collection: GET /realms

Record: GET /realms/@stats, GET /realms/{id}

Parameter	Accepted keys
fields	id, name, displayName, description, builtIn, createdAt, updatedAt
filter	id, builtIn, displayName, name, createdAt, updatedAt
sort	id, name, createdAt, updatedAt
include	none
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name · builtIn · displayName · createdAt · updatedAt

role

Collection: GET /roles

Record: GET /roles/@stats, GET /roles/{id}

Parameter	Accepted keys
fields	id, builtIn, name, displayName, target, description, clientId, realmId, createdAt, updatedAt
filter	id, builtIn, name, displayName, target, clientId, realmId, createdAt, updatedAt
sort	id, name, updatedAt, createdAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, clientId, realmId · displayName · builtIn · target · clientId · realmId · createdAt · updatedAt

roleAttribute

Collection: GET /role-attributes

Record: GET /role-attributes/{id}

Parameter	Accepted keys
fields	id, name, value, roleId, realmId, createdAt, updatedAt
filter	id, name, roleId, realmId, createdAt, updatedAt
sort	id, name, roleId, realmId, createdAt, updatedAt
include	role, realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, roleId · roleId · realmId · createdAt · updatedAt

rolePermission

Collection: GET /role-permissions

Record: GET /role-permissions/{id}

Parameter	Accepted keys
fields	id, policyId, realmScope, permissionId, permissionRealmId, roleId, roleRealmId, createdAt, updatedAt
filter	roleId, permissionId, id, roleRealmId, permissionRealmId, policyId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	role, permission
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · permissionId, roleId · roleId · roleRealmId · permissionRealmId · policyId · createdAt · updatedAt

scope

Collection: GET /scopes

Record: GET /scopes/@stats, GET /scopes/{id}

Parameter	Accepted keys
fields	id, builtIn, name, displayName, description, realmId, createdAt, updatedAt
filter	id, builtIn, name, displayName, realmId, createdAt, updatedAt
sort	id, name, updatedAt, createdAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · displayName · builtIn · realmId · createdAt · updatedAt

session

Collection: GET /sessions, GET /realms/{realmId}/sessions

Record: GET /sessions/@stats, GET /realms/{realmId}/sessions/@stats, GET /sessions/{id}, GET /realms/{realmId}/sessions/{id}

Filter only: DELETE /sessions, DELETE /realms/{realmId}/sessions

Parameter	Accepted keys
fields	id, sub, subKind, ipAddress, userAgent, authMethod, mfaAt, expiresAt, refreshedAt, seenAt, createdAt, updatedAt, userId, clientId, realmId
filter	id, sub, subKind, userId, clientId, realmId, expiresAt, seenAt, createdAt, updatedAt
sort	seenAt, expiresAt, createdAt, updatedAt
include	realm, user, client
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · sub · subKind · userId · clientId · realmId · seenAt · expiresAt · userId, seenAt · realmId, seenAt · createdAt · updatedAt

sessionToken

Collection: GET /session-tokens

Record: GET /session-tokens/{id}

Filter only: DELETE /session-tokens

Parameter	Accepted keys
fields	id, sessionId, clientId, kind, parentId, refreshTokenId, ipAddress, userAgent, consumedAt, revokedAt, expiresAt, createdAt
filter	id, sessionId, clientId, kind, expiresAt, createdAt
sort	createdAt, expiresAt
include	session
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · sessionId · clientId · kind · expiresAt · sessionId, createdAt · createdAt

trustAnchor

Collection: GET /trust-anchors, GET /realms/{realmId}/trust-anchors

Record: GET /trust-anchors/@stats, GET /realms/{realmId}/trust-anchors/@stats, GET /trust-anchors/{id}, GET /realms/{realmId}/trust-anchors/{id}

Parameter	Accepted keys
fields	id, name, certificate, enabled, realmId, createdAt, updatedAt
filter	id, name, enabled, realmId, createdAt, updatedAt
sort	id, name, enabled, createdAt, updatedAt
include	realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, realmId · enabled · realmId · createdAt · updatedAt

user

Collection: GET /users, GET /realms/{realmId}/users

Record: GET /userinfo, GET /users/@stats, GET /realms/{realmId}/users/@stats, GET /users/{id}, GET /realms/{realmId}/users/{id}

Parameter	Accepted keys
fields	id, name, nameLocked, firstName, lastName, displayName, emailVerified, avatar, cover, active, status, statusMessage, createdAt, updatedAt, realmId, pathId, email
filter	id, name, displayName, realmId, pathId, active, createdAt, updatedAt
sort	id, name, displayName, createdAt, updatedAt
include	realm, path
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned except email, which has to be asked for by name.

Index prefixes: id · name, realmId · displayName · realmId · pathId · active · createdAt · updatedAt

userAttribute

Collection: GET /user-attributes

Record: GET /user-attributes/{id}

Parameter	Accepted keys
fields	id, name, value, userId, realmId, createdAt, updatedAt
filter	id, name, userId, realmId, createdAt, updatedAt
sort	id, name, userId, realmId, createdAt, updatedAt
include	user, realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · name, userId · userId · realmId · createdAt · updatedAt

userAuthenticator

Collection: GET /users/{id}/authenticators

Record: GET /users/{id}/authenticators/{deviceId}

Parameter	Accepted keys
fields	id, kind, name, confirmed, lastUsedAt, createdAt, updatedAt, userId, realmId
filter	id, kind, confirmed, userId, realmId, lastUsedAt, createdAt, updatedAt
sort	createdAt, updatedAt, lastUsedAt
include	user, realm
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · kind · confirmed · userId · realmId · createdAt · updatedAt · lastUsedAt

userPermission

Collection: GET /user-permissions

Record: GET /user-permissions/{id}

Parameter	Accepted keys
fields	id, policyId, realmScope, permissionId, permissionRealmId, userId, userRealmId, createdAt, updatedAt
filter	userId, permissionId, id, userRealmId, permissionRealmId, policyId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	user, permission
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · permissionId, userId · userId · userRealmId · permissionRealmId · policyId · createdAt · updatedAt

userRole

Collection: GET /user-roles

Record: GET /user-roles/{id}

Parameter	Accepted keys
fields	id, roleId, roleRealmId, userId, userRealmId, createdAt, updatedAt
filter	roleId, userId, id, roleRealmId, userRealmId, createdAt, updatedAt
sort	id, createdAt, updatedAt
include	user, role
page[limit]	at most 50
page[offset]	rows to skip before the page starts

Without fields, every column above is returned.

Index prefixes: id · roleId, userId · userId · roleRealmId · userRealmId · createdAt · updatedAt