Clusters

Dedicated Keycloak cluster lifecycle and configuration.

📄️List your dedicated clusters.

Returns the dedicated clusters belonging to organizations the authenticated API client has access to. Archived clusters are excluded.

📄️Create a dedicated cluster.

Starts creation of a dedicated cluster for an organization. Provisioning begins once payment is settled, and the response tells you what is needed to get there — exactly one of three shapes:

📄️Check whether a cluster name is available.

Validates a candidate name for a new dedicated cluster and reports whether it is available (well-formed, not reserved, and not already in use).

📄️List regions available for dedicated clusters.

Returns the AWS regions a new dedicated cluster can be provisioned into.

📄️Get a dedicated cluster by ID.

Returns details about a single dedicated cluster.

📄️Remove a dedicated cluster.

Schedules a dedicated cluster for deletion at the end of the current billing cycle (clusters that never completed billing setup are removed immediately). This cannot be undone.

📄️Get subscription and billing information for a dedicated cluster.

Returns the Stripe subscription backing this cluster's billing.

📄️Create a Stripe billing portal session link for a cluster.

Deprecated. Use `org.billingPortalSession.create` instead.

📄️Restore billing for a cluster that is not currently paid for. Returns a browser link: the existing subscription's open invoice when paying it repairs the subscription, otherwise a fresh Stripe checkout for a new subscription.

Restore billing for a cluster that is not currently paid for. Returns a browser link: the existing subscription's open invoice when paying it repairs the subscription, otherwise a fresh Stripe checkout for a new subscription.

📄️List deployments for a dedicated cluster.

Returns the deployments (realms) running on this cluster.

📄️Create a deployment for a dedicated cluster.

Creates a new, empty deployment (Keycloak realm) on this cluster. The cluster must be ACTIVE, and the number of deployments is limited by the cluster's tier. To create a deployment from an existing realm export, use the import operation instead.

📄️Create a deployment from a realm export.

Creates a new deployment on this cluster from an exported Keycloak realm JSON file. The realm is imported asynchronously; poll the returned deployment until its state leaves PENDING. Importing users is not supported — the file must not contain a `users` array. The cluster must be ACTIVE, and the number of deployments is limited by the cluster's tier.

📄️Check whether a deployment name is available on a cluster.

Validates a candidate name for a new deployment on this cluster and reports whether it is available (well-formed, not reserved, and not already in use on this cluster).

📄️Change the cluster's primary hostname.

Switches the cluster's primary hostname to an already-provisioned domain: either the cluster's default `<name>.global.auth.ac` address or one of its custom domains that already has an issued TLS certificate. This does not provision a new domain — use the custom domains API to add one first. The candidate host must be reachable before the switch is applied.

📄️Get health metrics for a dedicated cluster.

Get health metrics for a dedicated cluster.

📄️Check whether a cluster restart is in progress.

Configuration changes (environment variables, extensions) restart the cluster's Keycloak deployment to take effect; use this to poll until a restart completes before making another change.

📄️Get system info for a dedicated cluster.

Returns the cluster's Keycloak server info (version, build time, etc) plus its Phase Two release build tag (issue #538). Only available while the cluster is ACTIVE.

📄️Get telemetry export configuration.

Returns the cluster's telemetry export configuration. The bearer token is never returned; tokenSet indicates whether one is stored.

📄️Update telemetry export configuration.

Stores the configuration and publishes or withdraws the cluster's gateway config. Omit token to leave the stored one unchanged. Rejects settings the pipeline cannot honour rather than silently ignoring them.

📄️Validate a telemetry export endpoint.

Checks an endpoint without saving, so the caller can offer feedback before committing. Changes nothing. Resolution happens again at publish time, since validating once is defeated by DNS rebinding.