--- title: "POST /list-auth-methods" method: POST path: "/list-auth-methods" tags: ["Authentication"] --- # POST /list-auth-methods `POST /list-auth-methods` ## Request - Base URL: `https://api.akeyless.io` - URL: `https://api.akeyless.io/list-auth-methods` - Auth: none declared ## Request body - ListAuthMethods: listAuthMethods is a command that returns a list of all auth methods in the account. [Deprecated: Use auth-method-list command] - `filter` string: Filter by auth method name or part of it - `json` boolean: Set output format to JSON - `pagination-token` string: Next page reference - `token` string: Authentication token (see `/auth` and `/configure`) - `type` string[]: The Auth method types list of the requested method. In case it is empty, all types of auth methods will be returned. options: [api_key, azure_ad, oauth2/jwt, saml2, ldap, aws_iam, alicloud, oidc, universal_identity, gcp, k8s, cert] - `uid-token` string: The universal identity token, Required only for universal_identity authentication ## Response `200` listAuthMethodsResponse wraps response body. - ListAuthMethodsOutput - `auth_methods` AuthMethod[] - `access_date` string, date-time - `access_date_display` string - `access_info` AuthMethodAccessInfo - `access_expires` integer - `access_id_alias` string: for accounts where AccessId holds encrypted email this field will hold generated AccessId, for accounts based on regular AccessId it will be equal to accessId itself - `alicloud_access_rules` AliCloudAccessRules - `account_id` string[]: The list of account ids that the login is restricted to. - `arn` string[]: The list of ARNs that the login is restricted to. - `resource_id` string[]: The list of resource ids that the login is restricted to. - `role_id` string[]: The list of role ids that the login is restricted to. - `role_name` string[]: The list of role names that the login is restricted to. - `sts_endpoint` string: The sts URL. - `unique_identifier` string: A unique identifier to distinguish different users - `user_id` string[]: The list of user ids that the login is restricted to. - `user_name` string[]: The list of user names that the login is restricted to. - `allowed_client_type` string[] - `api_key_access_rules` APIKeyAccessRules - `alg` string - `key` string: The public key value of the API-key. - `modification_date` string, date-time - `audit_logs_claims` string[] - `aws_iam_access_rules` AWSIAMAccessRules - `account_id` string[]: The list of account ids that the login is restricted to. - `arn` string[]: The list of ARNs that the login is restricted to. - `resource_id` string[]: The list of resource ids that the login is restricted to. - `role_id` string[]: The list of role ids that the login is restricted to. - `role_name` string[]: The list of role names that the login is restricted to. - `sts_endpoint` string: The sts URL. - `unique_identifier` string: A unique identifier to distinguish different users - `user_id` string[]: The list of user ids that the login is restricted to. - `user_name` string[]: The list of user names that the login is restricted to. - `azure_ad_access_rules` AzureADAccessRules: AzureADAccessRules contains access rules specific to Azure Active Directory authentication. - `ad_endpoint` string: The audience in the JWT. - `azure_cloud` string: Azure cloud environment [AzureCloud/AzureUSGovernment/AzureChinaCloud]. For create/update, cloud is inferred from jwks_uri. - `bound_group_ids` string[]: The list of group ids that login is restricted to. - `bound_resource_groups` string[]: The list of resource groups that login is restricted to. - `bound_resource_ids` string[]: The list of full resource ids that the login is restricted to. - `bound_resource_names` string[]: The list of resource names that the login is restricted to (e.g, a virtual machine name, scale set name, etc). - `bound_resource_providers` string[]: The list of resource providers that login is restricted to (e.g, Microsoft.Compute, Microsoft.ManagedIdentity, etc). - `bound_resource_types` string[]: The list of resource types that login is restricted to (e.g, virtualMachines, userAssignedIdentities, etc). - `bound_service_principal_ids` string[]: The list of service principal IDs that login is restricted to. - `bound_subscription_ids` string[]: The list of subscription IDs that login is restricted to. - `bound_tenant_id` string: The tenants id for the Azure Active Directory organization. - `issuer` string: Issuer URL - `jwks_uri` string: The URL to the JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. - `unique_identifier` string: A unique identifier to distinguish different users - `cert_access_rules` CertAccessRules - `allowed_cors` string[]: a list of allowed cors domains if used for browser authentication - `bound_common_names` string[]: A list of names. At least one must exist in the Common Name. Supports globbing. - `bound_dns_sans` string[]: A list of DNS names. At least one must exist in the SANs. Supports globbing. - `bound_email_sans` string[]: A list of Email Addresses. At least one must exist in the SANs. Supports globbing. - `bound_extensions` string[]: A list of extensions formatted as "oid:value". Expects the extension value to be some type of ASN1 encoded string. All values must match. Supports globbing on "value". - `bound_organizational_units` string[]: A list of Organizational Units names. At least one must exist in the OU field. - `bound_uri_sans` string[]: A list of URIs. At least one must exist in the SANs. Supports globbing. - `certificate` string: Base64 encdoed PEM certificate - `require_crl_dp` boolean: RequireCrlDp indicates whether CRL distribution points are required on the leaf client certificate, and whether CRL validation must be enforced during authentication. - `revoked_cert_ids` string[]: A list of revoked cert ids - `unique_identifier` string: A unique identifier to distinguish different users - `cidr_whitelist` string - `email_pass_access_rules` EmailPassAccessRules - `alg` string - `email` string: The Email value - `enc_email_with_shared_key` string: EncEmailWithSharedKey is the email of this auth method, encrypted with the shared auth/uam key (for use in uam) - `hash_pass` string: The password value - `last_reset_password` string, date-time: The last password change date - `mfa_type` string - `enforce_client_type` boolean: EnforceClientType mirrors the SaaS Auth client-type enforcement decision (GwAuthEligibilityReply.EnforceClientType) captured online, so Gateway-owned offline auth and cached-creds usage honor the same enforce flag SaaS uses (see base_access.AuthenticateClientType). When false, client-type mismatches are not rejected. - `force_sub_claims` boolean: if true the role associated with this auth method must include sub claims - `gcp_access_rules` GCPAccessRules - `audience` string: The audience in the JWT - `bound_labels` object: A map of GCP labels formatted as "key:value" strings that must be set on authorized GCE instances. TODO: Because GCP labels are not currently ACL'd .... - `bound_projects` string[]: Human and Machine authentication section Array of GCP project IDs. Only entities belonging to any of the provided projects can authenticate. - `bound_regions` string[]: List of regions that a GCE instance must belong to in order to be authenticated. TODO: If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored. - `bound_service_accounts` string[]: List of service accounts the service account must be part of in order to be authenticated - `bound_zones` string[]: === Machine authentication section === List of zones that a GCE instance must belong to in order to be authenticated. TODO: If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone. - `service_account` string: ServiceAccount holds the credentials file contents to be used by Akeyless to validate IAM (Human) and GCE (Machine) logins against GCP base64 encoded string - `type` string - `unique_identifier` string: A unique identifier to distinguish different users - `gw_cidr_whitelist` string - `huawei_access_rules` HuaweiAccessRules - `auth_endpoint` string: The auth URL. - `domain_id` string[]: The list of domain ids that the login is restricted to. - `domain_name` string[]: The list of domainNames that the login is restricted to. - `tenant_id` string[]: The list of tenantIDs that the login is restricted to. - `tenant_name` string[]: The list of tenantNames that the login is restricted to. - `user_id` string[]: The list of user ids that the login is restricted to. - `user_name` string[]: The list of user names that the login is restricted to. - `jwt_ttl` integer - `k8s_access_rules` KubernetesAccessRules - `alg` string - `audience` string: Audience is an optional Kubernetes jwt claim to verify - `bound_namespaces` string[]: A list of namespaces that the authentication is restricted to. - `bound_pod_names` string[]: A list of pods names that the authentication is restricted to. - `bound_service_account_names` string[]: A list of service account names that the authentication is restricted to. - `gen_key_pair` string: Generate public/private key (the private key is required for the K8S Auth Config in the Akeyless Gateway) - `pub_key` string: The public key value of the Kubernetes auth method configuration in the Akeyless Gateway. - `kerberos_access_rules` KerberosAccessRules - `sign_public_key` string - `unique_identifier` string - `ldap_access_rules` LDAPAccessRules - `alg` string - `gen_key_pair` string: Generate public/private key (the private key is required for the LDAP Auth Config in the Akeyless Gateway) - `key` string: The public key value of LDAP. - `unique_identifier` string: A unique identifier to distinguish different users - `oauth2_access_rules` OAuth2AccessRules: OAuth2AccessRules contains access rules specific to OAuth2 authentication method. - `audience` string: The audience in the JWT. - `authorized_gw_cluster_name` string: The gateway cluster name that is authorized to access JWKeySetURL - `bound_claims` OAuth2CustomClaim[]: The claims that login is restricted to. - `name` string - `values` string[] - `bound_clients_id` string[]: The clients ids that login is restricted to. - `certificate` string: Certificate to use when calling jwks_uri from the gateway. in PEM format - `issuer` string: Issuer URL - `jwks_json_data` string: The JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. base64 encoded string - `jwks_uri` string: The URL to the JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. - `unique_identifier` string: A unique identifier to distinguish different users - `oci_access_rules` OCIAccessRules: OCIAccessRules contains access rules specific to Oracle cloud instance / user authentication - `group_ocids` string[] - `tenant_ocid` string - `oidc_access_rules` OIDCAccessRules: OIDCAccessRules contains access rules specific to Open Id Connect authentication method. - `allowed_redirect_URIs` string[]: Allowed redirect URIs after the authentication - `audience` string: Audience claim to be used as part of the authentication flow. In case set, it must match the one configured on the Identity Provider's Application - `authorized_gw_cluster_name` string: AuthorizedGwClusterName binds the access method to a single GW cluster. When empty (or whitespace-only), GW-driven auth is disabled. - `bound_claims` OIDCCustomClaim[]: The claims that login is restricted to. - `name` string - `values` string[] - `client_id` string: Client ID - `client_secret` string: Client Secret - `is_internal` boolean: IsInternal indicates whether this is an internal Auth Method where the client has no control over it, or it was created by the client e.g - Sign In with Google will create an OIDC Auth Method with IsInternal=true - `issuer` string: Issuer URL - `required_scopes` string[]: A list of required scopes to request from the oidc provider, and to check on the token - `required_scopes_prefix` string: A prefix to add to the required scopes (for example, azures' Application ID URI) - `unique_identifier` string: A unique identifier to distinguish different users - `product_types` Product[]: List of product types this auth method will be in use of - `rules_type` string - `saml_access_rules` SAMLAccessRules - `allowed_redirect_URIs` string[]: Allowed redirect URIs after the authentication - `authorized_gw_cluster_name` string: AuthorizedGwClusterName binds the access method to a single GW cluster. When empty (or whitespace-only), GW-driven auth is disabled. - `bound_attributes` SAMLAttribute[]: The attributes that login is restricted to. - `name` string - `values` string[] - `idp_metadata_url` string: IDP metadata url - `idp_metadata_xml` string: IDP metadata XML - `unique_identifier` string: A unique identifier to distinguish different users - `use_dedicated_saml_urls` boolean: When true, the login AuthnRequest is signed with this access method's dedicated SP identity (Entity ID https:///saml/sp/{access_id} and ACS https:///saml/acs/{access_id}) instead of the shared global identity. Default false keeps the legacy global identity for backward compatibility. - `scim` ScimSettings - `bearer_access_id` string: Access ID of the API Key auth method the IdP uses as the SCIM bearer. - `default_identity_type` string - `enabled` boolean - `endpoint` string - `gateway_url` string: URL of the gateway that serves the SCIM endpoint to the IdP, for the private endpoint. - `provisioned_access_id` string: ProvisionedAccessId and ProvisionedType are set on the bearer itself, not on the auth method it provisions. They point back to the SAML or OIDC auth method the bearer provisions, so the gateway can find that auth method from the bearer. - `provisioned_type` string - `sub_claims_delimiters` string[] - `uid_expiration_events` UidExpirationEvent[]: Relevant only for Universal Identity auth methods: token about-to-expire notification thresholds. - `percent_passed` integer - `universal_identity_access_rules` UniversalIdentityAccessRules - `child_ttl_limit` integer - `deny_inheritance` boolean - `deny_rotate` boolean - `tree_length` integer - `ttl` integer - `account_id` string - `associated_gw_ids` integer[] - `auth_method_access_id` string - `auth_method_additional_data` AuthMethodAdditionalData - `kerberos_data` KerberosAuthMethodInfo - `kerberos_keytab` string - `kerberos_krb5_conf` string - `ldap_anonymous_search` boolean - `ldap_bind_dn` string - `ldap_bind_password` string - `ldap_certificate` string - `ldap_group_attr` string - `ldap_group_dn` string - `ldap_group_filter` string - `ldap_url_address` string - `ldap_user_attr` string - `ldap_user_dn` string - `auth_method_id` integer - `auth_method_name` string - `auth_method_roles_assoc` AuthMethodRoleAssociation[] - `allowed_ops` string[] - `assoc_id` string - `auth_method_sub_claims` object - `is_sub_claims_case_sensitive` boolean - `is_subclaims_with_operator` boolean - `role_id` integer - `role_name` string - `rules` Rules - `admin` boolean: Is admin - `path_rules` PathRule[]: The path the rules refers to - `assigners` RuleAssigner[] - `access_id` string - `unique_id` string - `capabilities` string[]: The approved/denied capabilities in the path - `cb` integer - `is_limit_access` boolean: flag that indicate that this rule is allowed to be access RemainingAccess of times. - `item_id` integer: The item id this rule directly refers to (when applicable) - `number_of_access_used` integer - `number_of_allowed_access` integer - `path` string: The path the rule refers to - `start_time` integer - `ttl` integer - `type` string - `bookmark_login_url_template` string: BookmarkLoginURLTemplate is an OIDC/SAML login URL template for console bookmarks. SaaS-owned methods use {redirect_uri} for client substitution; AuthViaGw embeds the GW console callback. - `client_permissions` string[] - `creation_date` string, date-time - `delete_protection` boolean - `description` string - `expiration_events` AuthExpirationEvent[] - `seconds_before` integer - `is_approved` boolean - `modification_date` string, date-time - `uid_expiration_events` UidExpirationEvent[] - `percent_passed` integer - `next_page` string ## Other responses - `default`: errorResponse wraps any error to return it as a JSON object with one "error" field. --- [API](https://skmtc.dev/akeyless/apis/identity-access.md) - [All operations](https://skmtc.dev/akeyless/apis/identity-access/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/identity-access/revisions/6fbc3858ec88?raw)