--- title: "POST /auth-method-list" method: POST path: "/auth-method-list" tags: ["v2"] --- # POST /auth-method-list `POST /auth-method-list` ## Request body - AuthMethodList — authMethodList is a command that returns a list of auth methods - `filter` string — Filter by auth method name or part of it - `json` boolean — Set output format to JSON - `pagination-token` string — Next page reference - `token` string — Authentication token (see `/auth` and `/configure`) - `type` string[] — The Auth method types list of the requested method. In case it is empty, all types of auth methods will be returned. options: [api_key, azure_ad, oauth2/jwt, saml2, ldap, aws_iam, oidc, universal_identity, gcp, k8s, cert] - `uid-token` string — The universal identity token, Required only for universal_identity authentication ## Response `200` authMethodListResponse wraps response body. - ListAuthMethodsOutput - `auth_methods` AuthMethod[] - `access_date` string, date-time - `access_date_display` string - `access_info` AuthMethodAccessInfo - `access_expires` integer - `access_id_alias` string — for accounts where AccessId holds encrypted email this field will hold generated AccessId, for accounts based on regular AccessId it will be equal to accessId itself - `allowed_client_type` string[] - `api_key_access_rules` APIKeyAccessRules - `alg` string - `key` string — The public key value of the API-key. - `modification_date` string, date-time - `audit_logs_claims` string[] - `aws_iam_access_rules` AWSIAMAccessRules - `account_id` string[] — The list of account ids that the login is restricted to. - `arn` string[] — The list of ARNs that the login is restricted to. - `resource_id` string[] — The list of resource ids that the login is restricted to. - `role_id` string[] — The list of role ids that the login is restricted to. - `role_name` string[] — The list of role names that the login is restricted to. - `sts_endpoint` string — The sts URL. - `unique_identifier` string — A unique identifier to distinguish different users - `user_id` string[] — The list of user ids that the login is restricted to. - `user_name` string[] — The list of user names that the login is restricted to. - `azure_ad_access_rules` AzureADAccessRules — AzureADAccessRules contains access rules specific to Azure Active Directory authentication. - `ad_endpoint` string — The audience in the JWT. - `azure_cloud` string — Azure cloud environment [AzureCloud/AzureUSGovernment/AzureChinaCloud]. For create/update, cloud is inferred from jwks_uri. - `bound_group_ids` string[] — The list of group ids that login is restricted to. - `bound_resource_groups` string[] — The list of resource groups that login is restricted to. - `bound_resource_ids` string[] — The list of full resource ids that the login is restricted to. - `bound_resource_names` string[] — The list of resource names that the login is restricted to (e.g, a virtual machine name, scale set name, etc). - `bound_resource_providers` string[] — The list of resource providers that login is restricted to (e.g, Microsoft.Compute, Microsoft.ManagedIdentity, etc). - `bound_resource_types` string[] — The list of resource types that login is restricted to (e.g, virtualMachines, userAssignedIdentities, etc). - `bound_service_principal_ids` string[] — The list of service principal IDs that login is restricted to. - `bound_subscription_ids` string[] — The list of subscription IDs that login is restricted to. - `bound_tenant_id` string — The tenants id for the Azure Active Directory organization. - `issuer` string — Issuer URL - `jwks_uri` string — The URL to the JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. - `unique_identifier` string — A unique identifier to distinguish different users - `cert_access_rules` CertAccessRules - `allowed_cors` string[] — a list of allowed cors domains if used for browser authentication - `bound_common_names` string[] — A list of names. At least one must exist in the Common Name. Supports globbing. - `bound_dns_sans` string[] — A list of DNS names. At least one must exist in the SANs. Supports globbing. - `bound_email_sans` string[] — A list of Email Addresses. At least one must exist in the SANs. Supports globbing. - `bound_extensions` string[] — A list of extensions formatted as "oid:value". Expects the extension value to be some type of ASN1 encoded string. All values must match. Supports globbing on "value". - `bound_organizational_units` string[] — A list of Organizational Units names. At least one must exist in the OU field. - `bound_uri_sans` string[] — A list of URIs. At least one must exist in the SANs. Supports globbing. - `certificate` string — Base64 encdoed PEM certificate - `require_crl_dp` boolean — RequireCrlDp indicates whether CRL distribution points are required on the leaf client certificate, and whether CRL validation must be enforced during authentication. - `revoked_cert_ids` string[] — A list of revoked cert ids - `unique_identifier` string — A unique identifier to distinguish different users - `cidr_whitelist` string - `email_pass_access_rules` EmailPassAccessRules - `alg` string - `email` string — The Email value - `enc_email_with_shared_key` string — EncEmailWithSharedKey is the email of this auth method, encrypted with the shared auth/uam key (for use in uam) - `hash_pass` string — The password value - `last_reset_password` string, date-time — The last password change date - `mfa_type` string - `force_sub_claims` boolean — if true the role associated with this auth method must include sub claims - `gcp_access_rules` GCPAccessRules - `audience` string — The audience in the JWT - `bound_labels` object — A map of GCP labels formatted as "key:value" strings that must be set on authorized GCE instances. TODO: Because GCP labels are not currently ACL'd .... - `bound_projects` string[] — Human and Machine authentication section Array of GCP project IDs. Only entities belonging to any of the provided projects can authenticate. - `bound_regions` string[] — List of regions that a GCE instance must belong to in order to be authenticated. TODO: If bound_instance_groups is provided, it is assumed to be a regional group and the group must belong to this region. If bound_zones are provided, this attribute is ignored. - `bound_service_accounts` string[] — List of service accounts the service account must be part of in order to be authenticated - `bound_zones` string[] — === Machine authentication section === List of zones that a GCE instance must belong to in order to be authenticated. TODO: If bound_instance_groups is provided, it is assumed to be a zonal group and the group must belong to this zone. - `service_account` string — ServiceAccount holds the credentials file contents to be used by Akeyless to validate IAM (Human) and GCE (Machine) logins against GCP base64 encoded string - `type` string - `unique_identifier` string — A unique identifier to distinguish different users - `gw_cidr_whitelist` string - `huawei_access_rules` HuaweiAccessRules - `auth_endpoint` string — The auth URL. - `domain_id` string[] — The list of domain ids that the login is restricted to. - `domain_name` string[] — The list of domainNames that the login is restricted to. - `tenant_id` string[] — The list of tenantIDs that the login is restricted to. - `tenant_name` string[] — The list of tenantNames that the login is restricted to. - `user_id` string[] — The list of user ids that the login is restricted to. - `user_name` string[] — The list of user names that the login is restricted to. - `jwt_ttl` integer - `k8s_access_rules` KubernetesAccessRules - `alg` string - `audience` string — Audience is an optional Kubernetes jwt claim to verify - `bound_namespaces` string[] — A list of namespaces that the authentication is restricted to. - `bound_pod_names` string[] — A list of pods names that the authentication is restricted to. - `bound_service_account_names` string[] — A list of service account names that the authentication is restricted to. - `gen_key_pair` string — Generate public/private key (the private key is required for the K8S Auth Config in the Akeyless Gateway) - `pub_key` string — The public key value of the Kubernetes auth method configuration in the Akeyless Gateway. - `kerberos_access_rules` KerberosAccessRules - `sign_public_key` string - `unique_identifier` string - `ldap_access_rules` LDAPAccessRules - `alg` string - `gen_key_pair` string — Generate public/private key (the private key is required for the LDAP Auth Config in the Akeyless Gateway) - `key` string — The public key value of LDAP. - `unique_identifier` string — A unique identifier to distinguish different users - `oauth2_access_rules` OAuth2AccessRules — OAuth2AccessRules contains access rules specific to OAuth2 authentication method. - `audience` string — The audience in the JWT. - `authorized_gw_cluster_name` string — The gateway cluster name that is authorized to access JWKeySetURL - `bound_claims` OAuth2CustomClaim[] — The claims that login is restricted to. - `name` string - `values` string[] - `bound_clients_id` string[] — The clients ids that login is restricted to. - `certificate` string — Certificate to use when calling jwks_uri from the gateway. in PEM format - `issuer` string — Issuer URL - `jwks_json_data` string — The JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. base64 encoded string - `jwks_uri` string — The URL to the JSON Web Key Set (JWKS) that containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server. - `unique_identifier` string — A unique identifier to distinguish different users - `oci_access_rules` OCIAccessRules — OCIAccessRules contains access rules specific to Oracle cloud instance / user authentication - `group_ocids` string[] - `tenant_ocid` string - `oidc_access_rules` OIDCAccessRules — OIDCAccessRules contains access rules specific to Open Id Connect authentication method. - `allowed_redirect_URIs` string[] — Allowed redirect URIs after the authentication - `audience` string — Audience claim to be used as part of the authentication flow. In case set, it must match the one configured on the Identity Provider's Application - `bound_claims` OIDCCustomClaim[] — The claims that login is restricted to. - `name` string - `values` string[] - `client_id` string — Client ID - `client_secret` string — Client Secret - `is_internal` boolean — IsInternal indicates whether this is an internal Auth Method where the client has no control over it, or it was created by the client e.g - Sign In with Google will create an OIDC Auth Method with IsInternal=true - `issuer` string — Issuer URL - `required_scopes` string[] — A list of required scopes to request from the oidc provider, and to check on the token - `required_scopes_prefix` string — A prefix to add to the required scopes (for example, azures' Application ID URI) - `unique_identifier` string — A unique identifier to distinguish different users - `product_types` Product[] — List of product types this auth method will be in use of - `rules_type` string - `saml_access_rules` SAMLAccessRules - `allowed_redirect_URIs` string[] — Allowed redirect URIs after the authentication - `bound_attributes` SAMLAttribute[] — The attributes that login is restricted to. - `name` string - `values` string[] - `idp_metadata_url` string — IDP metadata url - `idp_metadata_xml` string — IDP metadata XML - `unique_identifier` string — A unique identifier to distinguish different users - `sub_claims_delimiters` string[] - `universal_identity_access_rules` UniversalIdentityAccessRules - `child_ttl_limit` integer - `deny_inheritance` boolean - `deny_rotate` boolean - `tree_length` integer - `ttl` integer - `account_id` string - `associated_gw_ids` integer[] - `auth_method_access_id` string - `auth_method_additional_data` AuthMethodAdditionalData - `kerberos_data` KerberosAuthMethodInfo - `kerberos_keytab` string - `kerberos_krb5_conf` string - `ldap_anonymous_search` boolean - `ldap_bind_dn` string - `ldap_bind_password` string - `ldap_certificate` string - `ldap_group_attr` string - `ldap_group_dn` string - `ldap_group_filter` string - `ldap_url_address` string - `ldap_user_attr` string - `ldap_user_dn` string - `auth_method_id` integer - `auth_method_name` string - `auth_method_roles_assoc` AuthMethodRoleAssociation[] - `allowed_ops` string[] - `assoc_id` string - `auth_method_sub_claims` object - `is_sub_claims_case_sensitive` boolean - `is_subclaims_with_operator` boolean - `role_id` integer - `role_name` string - `rules` Rules - `admin` boolean — Is admin - `path_rules` PathRule[] — The path the rules refers to - `assigners` RuleAssigner[] - `access_id` string - `unique_id` string - `capabilities` string[] — The approved/denied capabilities in the path - `cb` integer - `is_limit_access` boolean — flag that indicate that this rule is allowed to be access RemainingAccess of times. - `item_id` integer — The item id this rule directly refers to (when applicable) - `number_of_access_used` integer - `number_of_allowed_access` integer - `path` string — The path the rule refers to - `start_time` integer - `ttl` integer - `type` string - `client_permissions` string[] - `creation_date` string, date-time - `delete_protection` boolean - `description` string - `expiration_events` AuthExpirationEvent[] - `seconds_before` integer - `is_approved` boolean - `modification_date` string, date-time - `next_page` string ## Other responses - `default` — errorResponse wraps any error to return it as a JSON object with one "error" field. --- [API](https://skmtc.net/akeyless/apis/akeyless-api.md) · [All operations](https://skmtc.net/akeyless/apis/akeyless-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/akeyless/akeyless-api/versions/0ceb25634501/schema)