Keycloak

Administer a Keycloak realm. Create and update users, reset passwords, enable and disable accounts, manage groups and their members, create realm roles and assign them, check who is signed in, and list the applications registered in the realm.

Actions

Action	What it does
Add user to group	Put a user in a group, so they pick up whatever roles and attributes it carries.
Assign realm role to user	Give a user a realm role.
Create group	Create a top-level group and return it, including the new group ID for later steps.
Create realm role	Create a realm role and return it.
Create user	Create a user in the realm and return the created record, including the new user ID for later steps.
Delete group	Delete a group and its subgroups.
Delete realm role	Delete a realm role by name.
Delete user	Permanently delete a user, with their sessions, group memberships and role assignments.
Get group	Read one group: its name, description, full path, parent and attributes.
Get user	Read one user in full by their Keycloak user ID: username, name, email and whether it is verified, whether the account is enabled, when it was created, and any required actions outstanding.
List clients	The applications registered in the realm, with each one's UUID, client ID, protocol, redirect URIs and which flows it allows.
List group members	The users in a group.
List groups	The realm's top-level groups, each with its path and how many subgroups it has.
List realm roles	The realm's own roles, with their descriptions and whether each is composite.
List user sessions	The user's active sessions: when each started, when it was last used, the IP address it came from and which applications it has reached.
List user's realm roles	The realm roles assigned directly to a user.
List users	Find users in the realm.
Remove user from group	Take a user out of a group.
Reset user password	Set a user's password.
Update user	Change a user's details.

Add user to group

Put a user in a group, so they pick up whatever roles and attributes it carries. Adding someone who is already a member changes nothing and is not an error.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.
Groupgroup_idtextRequired: The group to act on. Pick one, or paste a group ID from an earlier step - a group created by this workflow will not be in the list until it is refreshed.

Outputs

addedtrue/false
group_idtext
removedtrue/false
resourcetext
user_idtext

Example output

{
  "added": true,
  "group_id": "1f3c0e2a-9b1d-4a5e-8c77-2b6d5f0a1c34",
  "resource": "group_membership",
  "user_id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6"
}

Assign realm role to user

Give a user a realm role. The role takes effect on their next token, so an already signed-in user picks it up when their session refreshes rather than instantly. Assigning a role the user already has changes nothing and is not an error.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.
Realm rolerole_nametextRequired: The realm role, by name. Pick one, or type a name - a role created by this workflow will not be in the list until it is refreshed.

Outputs

assignedtrue/false
resourcetext
roleobject
user_idtext

Example output

{
  "assigned": true,
  "resource": "realm_role_mapping",
  "role": {
    "clientRole": false,
    "composite": false,
    "containerId": "my-company",
    "description": "Can read the reporting dashboards",
    "id": "8a2c5f10-4d3b-4e91-9f0a-77c1b2e3d4f5",
    "name": "reporting-viewer"
  },
  "user_id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6"
}

Create group

Create a top-level group and return it, including the new group ID for later steps. Group names are unique among their siblings.

Inputs

NamenametextRequired: The group's name.
Descriptiondescriptiontext: What the group is for.

Outputs

accessobject
attributesobject
clientRolesobject
descriptiontext
idtext
nametext
parentIdtext
pathtext
realmRoleslist
subGroupCountnumber
subGroupslist

Example output

{
  "id": "1f3c0e2a-9b1d-4a5e-8c77-2b6d5f0a1c34",
  "name": "Engineering",
  "path": "/Engineering",
  "subGroupCount": 2
}

Create realm role

Create a realm role and return it. Role names are unique in the realm and are how every other role step refers to them, so pick a name you can keep.

Inputs

NamenametextRequired: The role's name, unique in the realm. This is the identifier applications check for.
Descriptiondescriptiontext: What the role grants.

Outputs

attributesobject
clientRoletrue/false
compositetrue/false
containerIdtext
descriptiontext
idtext
nametext
scopeParamRequiredtrue/false

Example output

{
  "clientRole": false,
  "composite": false,
  "containerId": "my-company",
  "description": "Can read the reporting dashboards",
  "id": "8a2c5f10-4d3b-4e91-9f0a-77c1b2e3d4f5",
  "name": "reporting-viewer"
}

Create user

Create a user in the realm and return the created record, including the new user ID for later steps. The username must be unique in the realm, and so is the email address when the realm requires one. Set a password here to create the account ready to use; leave it empty to create one that cannot sign in until a password is set.

Inputs

UsernameusernametextRequired: The username, unique within the realm. Keycloak lowercases it unless the realm is set to be case sensitive.
Emailemailtext: The user's email address.
First namefirst_nametext: The user's first name.
Last namelast_nametext: The user's last name.
Enabledenabledtrue/false: Whether the account can sign in. Defaults to enabled.Default: true.
Email verifiedemail_verifiedtrue/false: Mark the email as already verified, so the user is not asked to confirm it. Defaults to unverified.
Required actionsrequired_actionslist: What the user must do at their next sign-in. Each one has to be switched on for the realm under Authentication > Required actions; Keycloak accepts one that is off and then simply never asks for it.One or more of: UPDATE_PASSWORD (Update password), VERIFY_EMAIL (Verify email), UPDATE_PROFILE (Update profile), CONFIGURE_TOTP (Configure OTP), UPDATE_EMAIL (Update email), TERMS_AND_CONDITIONS (Accept terms and conditions), CONFIGURE_RECOVERY_CODES (Configure recovery codes), webauthn-register (Register a passkey (WebAuthn)), webauthn-register-passwordless (Register a passwordless passkey), delete_account (Delete account).
Passwordpasswordtext: An initial password. Leave empty to create the account without one.
Password is temporarytemporary_passwordtrue/false: Make the user choose a new password at their first sign-in. Defaults to a permanent password.

Outputs

accessobject
attributesobject
clientRolesobject
createdTimestampnumber
disableableCredentialTypeslist
emailtext
emailVerifiedtrue/false
enabledtrue/false
federationLinktext
firstNametext
groupslist
idtext
lastNametext
notBeforenumber
realmRoleslist
requiredActionslist
selftext
serviceAccountClientIdtext
totptrue/false
usernametext

Example output

{
  "createdTimestamp": 1735689600000,
  "email": "ada@example.com",
  "emailVerified": true,
  "enabled": true,
  "firstName": "Ada",
  "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
  "lastName": "Lovelace",
  "requiredActions": [],
  "username": "ada.lovelace"
}

Delete group

Delete a group and its subgroups. The members keep their accounts and lose whatever the group granted them. This cannot be undone.

Inputs

Groupgroup_idtextRequired: The group to act on. Pick one, or paste a group ID from an earlier step - a group created by this workflow will not be in the list until it is refreshed.

Outputs

deletedtrue/false
idtext
resourcetext

Example output

{
  "deleted": true,
  "id": "1f3c0e2a-9b1d-4a5e-8c77-2b6d5f0a1c34",
  "resource": "group"
}

Delete realm role

Delete a realm role by name. Everyone who held it loses it immediately, and any composite role built on it loses that part. This cannot be undone.

Inputs

Realm rolerole_nametextRequired: The realm role, by name. Pick one, or type a name - a role created by this workflow will not be in the list until it is refreshed.

Outputs

deletedtrue/false
idtext
resourcetext

Example output

{
  "deleted": true,
  "id": "reporting-viewer",
  "resource": "realm_role"
}

Delete user

Permanently delete a user, with their sessions, group memberships and role assignments. This cannot be undone - to block someone's access reversibly, use Update user to disable the account instead.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.

Outputs

deletedtrue/false
idtext
resourcetext

Example output

{
  "deleted": true,
  "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
  "resource": "user"
}

Get group

Read one group: its name, description, full path, parent and attributes.

Inputs

Groupgroup_idtextRequired: The group to act on. Pick one, or paste a group ID from an earlier step - a group created by this workflow will not be in the list until it is refreshed.

Outputs

accessobject
attributesobject
clientRolesobject
descriptiontext
idtext
nametext
parentIdtext
pathtext
realmRoleslist
subGroupCountnumber
subGroupslist

Example output

{
  "id": "1f3c0e2a-9b1d-4a5e-8c77-2b6d5f0a1c34",
  "name": "Engineering",
  "path": "/Engineering",
  "subGroupCount": 2
}

Get user

Read one user in full by their Keycloak user ID: username, name, email and whether it is verified, whether the account is enabled, when it was created, and any required actions outstanding.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.

Outputs

accessobject
attributesobject
clientRolesobject
createdTimestampnumber
disableableCredentialTypeslist
emailtext
emailVerifiedtrue/false
enabledtrue/false
federationLinktext
firstNametext
groupslist
idtext
lastNametext
notBeforenumber
realmRoleslist
requiredActionslist
selftext
serviceAccountClientIdtext
totptrue/false
usernametext

Example output

{
  "createdTimestamp": 1735689600000,
  "email": "ada@example.com",
  "emailVerified": true,
  "enabled": true,
  "firstName": "Ada",
  "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
  "lastName": "Lovelace",
  "requiredActions": [],
  "username": "ada.lovelace"
}

List clients

The applications registered in the realm, with each one's UUID, client ID, protocol, redirect URIs and which flows it allows. Search by part of a client ID, or turn off partial matching to look one up exactly.

Inputs

Client IDclient_idtext: Only clients whose client ID matches. Leave empty for all of them.
Match part of the client IDpartial_matchtrue/false: Treat the client ID above as text to search for rather than an exact name. Defaults to on, and does nothing unless a client ID is given.Default: true.
Only clients I can viewviewable_onlytrue/false: Hide clients the service account has no view permission for, instead of listing them by ID alone.
Skipoffsetnumber: How many results to skip before this page. Leave empty to start at the beginning.From 0 to 1000000. Default: 0.
Maximum resultslimitnumber: How many to return, 1-500. Defaults to 50.From 1 to 500. Default: 50.

Outputs

countnumber: How many came back
has_moretrue/false: Whether another page probably follows
itemslist: The matching clients
limitnumber: The page size asked for
next_offsetnumber: The offset to send for the next page, if any
offsetnumber: How many were skipped

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "clientId": "reporting-web",
      "enabled": true,
      "id": "c4d5e6f7-8a9b-4c0d-9e1f-2a3b4c5d6e7f",
      "name": "Reporting",
      "protocol": "openid-connect",
      "publicClient": true,
      "redirectUris": [
        "https://reporting.example.com/*"
      ],
      "standardFlowEnabled": true
    }
  ],
  "limit": 50,
  "next_offset": null,
  "offset": 0
}

List group members

The users in a group. Members of its subgroups are not included - Keycloak treats each group's membership as its own.

Inputs

Groupgroup_idtextRequired: The group to act on. Pick one, or paste a group ID from an earlier step - a group created by this workflow will not be in the list until it is refreshed.
Skipoffsetnumber: How many results to skip before this page. Leave empty to start at the beginning.From 0 to 1000000. Default: 0.
Maximum resultslimitnumber: How many to return, 1-500. Defaults to 50.From 1 to 500. Default: 50.

Outputs

countnumber: How many came back
has_moretrue/false: Whether another page probably follows
itemslist: The users in the group
limitnumber: The page size asked for
next_offsetnumber: The offset to send for the next page, if any
offsetnumber: How many were skipped

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "createdTimestamp": 1735689600000,
      "email": "ada@example.com",
      "emailVerified": true,
      "enabled": true,
      "firstName": "Ada",
      "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
      "lastName": "Lovelace",
      "requiredActions": [],
      "username": "ada.lovelace"
    }
  ],
  "limit": 50,
  "next_offset": null,
  "offset": 0
}

List groups

The realm's top-level groups, each with its path and how many subgroups it has. Search by name to find one anywhere in the tree.

Inputs

Searchsearchtext: Only groups whose name matches this text. Leave empty for all of them.
Exact matchexacttrue/false: Match the search text exactly instead of as part of a name.
Skipoffsetnumber: How many results to skip before this page. Leave empty to start at the beginning.From 0 to 1000000. Default: 0.
Maximum resultslimitnumber: How many to return, 1-500. Defaults to 50.From 1 to 500. Default: 50.

Outputs

countnumber: How many came back
has_moretrue/false: Whether another page probably follows
itemslist: The matching groups
limitnumber: The page size asked for
next_offsetnumber: The offset to send for the next page, if any
offsetnumber: How many were skipped

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "id": "1f3c0e2a-9b1d-4a5e-8c77-2b6d5f0a1c34",
      "name": "Engineering",
      "path": "/Engineering",
      "subGroupCount": 2
    }
  ],
  "limit": 50,
  "next_offset": null,
  "offset": 0
}

List realm roles

The realm's own roles, with their descriptions and whether each is composite. Roles that belong to a client are listed under that client, not here.

Inputs

Searchsearchtext: Only roles whose name or description matches this text. Leave empty for all of them.
Skipoffsetnumber: How many results to skip before this page. Leave empty to start at the beginning.From 0 to 1000000. Default: 0.
Maximum resultslimitnumber: How many to return, 1-500. Defaults to 50.From 1 to 500. Default: 50.

Outputs

countnumber: How many came back
has_moretrue/false: Whether another page probably follows
itemslist: The matching realm roles
limitnumber: The page size asked for
next_offsetnumber: The offset to send for the next page, if any
offsetnumber: How many were skipped

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "clientRole": false,
      "composite": false,
      "containerId": "my-company",
      "description": "Can read the reporting dashboards",
      "id": "8a2c5f10-4d3b-4e91-9f0a-77c1b2e3d4f5",
      "name": "reporting-viewer"
    }
  ],
  "limit": 50,
  "next_offset": null,
  "offset": 0
}

List user sessions

The user's active sessions: when each started, when it was last used, the IP address it came from and which applications it has reached. An empty list means the user is not signed in anywhere.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.

Outputs

countnumber: How many came back
itemslist: The user's active sessions

Example output

{
  "count": 1,
  "items": [
    {
      "clients": {
        "c4d5e6f7-8a9b-4c0d-9e1f-2a3b4c5d6e7f": "reporting-web"
      },
      "id": "3b9f1c7e-5d2a-4e8b-9c0f-1a2b3c4d5e6f",
      "ipAddress": "203.0.113.42",
      "lastAccess": 1735693200000,
      "rememberMe": false,
      "start": 1735689600000,
      "userId": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
      "username": "ada.lovelace"
    }
  ]
}

List user's realm roles

The realm roles assigned directly to a user. Roles they hold only through a group, or through a composite role, are not listed here - Keycloak counts those as effective roles rather than as this user's own.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.

Outputs

countnumber: How many came back
itemslist: The realm roles assigned directly to the user

Example output

{
  "count": 1,
  "items": [
    {
      "clientRole": false,
      "composite": false,
      "containerId": "my-company",
      "description": "Can read the reporting dashboards",
      "id": "8a2c5f10-4d3b-4e91-9f0a-77c1b2e3d4f5",
      "name": "reporting-viewer"
    }
  ]
}

List users

Find users in the realm. Search across username, first name, last name and email at once, or filter on any of them individually, and narrow to enabled or verified accounts. Returns each user's ID, username, name, email and status.

Inputs

Searchsearchtext: Match this text against username, first name, last name and email at once. Leave empty for all users.
Usernameusernametext: Only users with this username.
Emailemailtext: Only users with this email address.
First namefirst_nametext: Only users with this first name.
Last namelast_nametext: Only users with this last name.
Enabledenabledtrue/false: Only enabled users, or only disabled ones. Leave unset for both.
Email verifiedemail_verifiedtrue/false: Only users whose email is verified, or only those whose is not. Leave unset for both.
Exact matchexacttrue/false: Match the username, email and name filters exactly instead of as a prefix.
Skipoffsetnumber: How many results to skip before this page. Leave empty to start at the beginning.From 0 to 1000000. Default: 0.
Maximum resultslimitnumber: How many to return, 1-500. Defaults to 50.From 1 to 500. Default: 50.

Outputs

countnumber: How many came back
has_moretrue/false: Whether another page probably follows
itemslist: The matching users
limitnumber: The page size asked for
next_offsetnumber: The offset to send for the next page, if any
offsetnumber: How many were skipped

Example output

{
  "count": 1,
  "has_more": false,
  "items": [
    {
      "createdTimestamp": 1735689600000,
      "email": "ada@example.com",
      "emailVerified": true,
      "enabled": true,
      "firstName": "Ada",
      "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
      "lastName": "Lovelace",
      "requiredActions": [],
      "username": "ada.lovelace"
    }
  ],
  "limit": 50,
  "next_offset": null,
  "offset": 0
}

Remove user from group

Take a user out of a group. Their account and everything else about it are untouched; they simply lose what the group granted.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.
Groupgroup_idtextRequired: The group to act on. Pick one, or paste a group ID from an earlier step - a group created by this workflow will not be in the list until it is refreshed.

Outputs

addedtrue/false
group_idtext
removedtrue/false
resourcetext
user_idtext

Example output

{
  "group_id": "1f3c0e2a-9b1d-4a5e-8c77-2b6d5f0a1c34",
  "removed": true,
  "resource": "group_membership",
  "user_id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6"
}

Reset user password

Set a user's password. By default the password is temporary, so Keycloak makes the user choose their own at the next sign-in - which is what an administrator setting a password usually wants. The password is never echoed back in the result.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.
PasswordpasswordtextRequired: The new password.
Temporarytemporarytrue/false: Make the user choose a new password at their next sign-in. Defaults to on.Default: true.

Outputs

idtext
resourcetext
temporarytrue/false
updatedtrue/false

Example output

{
  "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
  "resource": "user_password",
  "temporary": true,
  "updated": true
}

Update user

Change a user's details. Only the fields you fill in change - everything else is left exactly as it was. Use this to enable or disable an account, correct a name or email, or set what the user must do at their next sign-in.

Inputs

User IDuser_idtextRequired: The user's Keycloak ID - the UUID in the admin console's address bar when the user is open, and the 'id' field of any List users result. Not the username, which can change.
Emailemailtext: A new email address. Leave empty to keep it.
First namefirst_nametext: A new first name. Leave empty to keep it.
Last namelast_nametext: A new last name. Leave empty to keep it.
Enabledenabledtrue/false: Enable or disable the account. Disabling it signs the user out and refuses new sign-ins without deleting anything. Leave unset to keep it as it is.
Email verifiedemail_verifiedtrue/false: Mark the email verified or unverified. Leave unset to keep it as it is.
Required actionsrequired_actionslist: What the user must do at their next sign-in. Each one has to be switched on for the realm under Authentication > Required actions; Keycloak accepts one that is off and then simply never asks for it.One or more of: UPDATE_PASSWORD (Update password), VERIFY_EMAIL (Verify email), UPDATE_PROFILE (Update profile), CONFIGURE_TOTP (Configure OTP), UPDATE_EMAIL (Update email), TERMS_AND_CONDITIONS (Accept terms and conditions), CONFIGURE_RECOVERY_CODES (Configure recovery codes), webauthn-register (Register a passkey (WebAuthn)), webauthn-register-passwordless (Register a passwordless passkey), delete_account (Delete account).

Outputs

accessobject
attributesobject
clientRolesobject
createdTimestampnumber
disableableCredentialTypeslist
emailtext
emailVerifiedtrue/false
enabledtrue/false
federationLinktext
firstNametext
groupslist
idtext
lastNametext
notBeforenumber
realmRoleslist
requiredActionslist
selftext
serviceAccountClientIdtext
totptrue/false
usernametext

Example output

{
  "createdTimestamp": 1735689600000,
  "email": "ada@example.com",
  "emailVerified": true,
  "enabled": true,
  "firstName": "Ada",
  "id": "f81d4fae-7dec-11d0-a765-00a0c91e6bf6",
  "lastName": "Lovelace",
  "requiredActions": [],
  "username": "ada.lovelace"
}

ActionsCopy Anchor Link

Add user to groupCopy Anchor Link

Inputs

Outputs

Assign realm role to userCopy Anchor Link

Inputs

Outputs

Create groupCopy Anchor Link

Inputs

Outputs

Create realm roleCopy Anchor Link

Inputs

Outputs

Create userCopy Anchor Link

Inputs

Outputs

Delete groupCopy Anchor Link

Inputs

Outputs

Delete realm roleCopy Anchor Link

Inputs

Outputs

Delete userCopy Anchor Link

Inputs

Outputs

Get groupCopy Anchor Link

Inputs

Outputs

Get userCopy Anchor Link

Inputs

Outputs

List clientsCopy Anchor Link

Inputs

Outputs

List group membersCopy Anchor Link

Inputs

Outputs

List groupsCopy Anchor Link

Inputs

Outputs

List realm rolesCopy Anchor Link

Inputs

Outputs

List user sessionsCopy Anchor Link

Inputs

Outputs

List user's realm rolesCopy Anchor Link

Inputs

Outputs

List usersCopy Anchor Link

Inputs

Outputs

Remove user from groupCopy Anchor Link

Inputs

Outputs

Reset user passwordCopy Anchor Link

Inputs

Outputs

Update userCopy Anchor Link

Inputs

Outputs

On this page

Actions

Add user to group

Assign realm role to user

Create group

Create realm role

Create user

Delete group

Delete realm role

Delete user

Get group

Get user

List clients

List group members

List groups

List realm roles

List user sessions

List user's realm roles

List users

Remove user from group

Reset user password

Update user