Cluster Extensions
Custom Keycloak extensions (providers, themes) for a dedicated cluster.
List extensions for a cluster.
Returns the custom extensions (providers, themes) configured for this cluster, optionally filtered by type.
Create an extension for a cluster.
Registers a new extension slot (provider or theme) for this cluster. This only creates the extension record; upload its jar via the extension's version sub-resource before it takes effect.
Restart a cluster to apply extension changes.
Reconciles this cluster's configured extensions onto its running Keycloak deployment and restarts it to pick up the changes. Fails with a 409 if a restart is already in progress for this cluster.
List Keycloak major versions supported for extensions.
Returns the Keycloak major versions that a version-dependent extension may target.
Get an extension by ID.
Get an extension by ID.
Enable or disable an extension.
Toggles whether an extension is active. Disabling does not delete its versions.
Remove an extension by ID.
Deletes an extension and all of its versions.
Create an upload URL for a standalone extension.
Creates the extension's single (version-independent) version and returns a presigned S3 URL to upload its jar to. After uploading, call the extension's `confirm` operation to finalize it.
Confirm a standalone extension upload.
Verifies the jar was uploaded to the presigned URL and records its location on the extension version, making it available for deployment.
Create a new extension version.
Registers a new version of a Keycloak-version-dependent extension for a target major version. This only creates the version record; use the returned version's upload URL to upload its jar.
Remove an extension version by ID.
Remove an extension version by ID.
Block or unblock an extension version.
Stops an extension version being deployed to any cluster, or lifts an existing block. A blocked version is never copied during a cluster reconcile, whatever its `valid` flag or scan state says. Requires the `manage-clusters` role on the `cluster-management` client.
Confirm an extension version upload.
Verifies the jar was uploaded to the presigned URL and records its location on the version. If extension scanning is enabled for the cluster, this also queues a security scan of the jar.
Read the security scan report for an extension version.
Returns the extension checker's full report as written by the scanner: the verdict, the risk score and every individual finding. Requires the `manage-clusters` role on the `cluster-management` client.
Create an upload URL for an extension version.
Returns a presigned S3 URL to upload the version's jar to. After uploading, call the version's `confirm` operation to finalize it.
Approve or reject an extension version.
Sets whether an extension version is considered valid for deployment. If the version's security scan result requires justification, approving it requires a `reason`.
Get app association file state for a custom domain.
Returns each well-known file, whether it has been uploaded, and the public URL the operating system will fetch.
Set the change-password redirect for a custom domain.
Password managers fetch /.well-known/change-password to offer a 'change password' action. Send a null or empty url to clear it, which returns the path to 404 — spec-safe, and simply means the site does not advertise the convention.
Remove an app association file from a custom domain.
Remove an app association file from a custom domain.
Validate and publish an uploaded app association file.
Checks the uploaded object parses as JSON and has the shape the operating system expects, forces its content type, and records it against the domain.
Create an upload URL for an app association file.
Returns a short-lived presigned PUT URL. Upload the file to it, then call confirm to validate and publish it.