---
title: "List App Auth Strategies"
method: GET
path: "/v2/application-auth-strategies"
tags: ["App Auth Strategies"]
---

# List App Auth Strategies

`GET /v2/application-auth-strategies`

Returns a paginated collection of application auth strategies.

## Query parameters

- `page[size]` integer
- `page[number]` integer
- `sort` string
- `filter` object
  - `strategy_type` StringFieldFilter — Filter using **one** of the following operators: `eq`, `oeq`, `neq`, `contains`, `ocontains`
    - `eq` string — The field exactly matches the provided value.
    - `contains` string — The field contains the provided value.
    - `ocontains` string — The field contains any of the provided values.
    - `oeq` string — The field matches any of the provided values.
    - `neq` string — The field does not match the provided value.
  - `name` StringFieldFilter — Filter using **one** of the following operators: `eq`, `oeq`, `neq`, `contains`, `ocontains`
    - `eq` string — The field exactly matches the provided value.
    - `contains` string — The field contains the provided value.
    - `ocontains` string — The field contains any of the provided values.
    - `oeq` string — The field matches any of the provided values.
    - `neq` string — The field does not match the provided value.
  - `display_name` StringFieldFilter — Filter using **one** of the following operators: `eq`, `oeq`, `neq`, `contains`, `ocontains`
    - `eq` string — The field exactly matches the provided value.
    - `contains` string — The field contains the provided value.
    - `ocontains` string — The field contains any of the provided values.
    - `oeq` string — The field matches any of the provided values.
    - `neq` string — The field does not match the provided value.
  - `dcr_provider_id` UuidFieldFilter — Filter using **one** of the following operators: `eq`, `oeq`, `neq`
    - `eq` string — The field exactly matches the provided value.
    - `oeq` string — The field matches any of the provided values.
    - `neq` string — The field does not match the provided value.
  - `dcr_provider_name` StringFieldFilter — Filter using **one** of the following operators: `eq`, `oeq`, `neq`, `contains`, `ocontains`
    - `eq` string — The field exactly matches the provided value.
    - `contains` string — The field contains the provided value.
    - `ocontains` string — The field contains any of the provided values.
    - `oeq` string — The field matches any of the provided values.
    - `neq` string — The field does not match the provided value.
  - `dcr_provider_type` StringFieldFilter — Filter using **one** of the following operators: `eq`, `oeq`, `neq`, `contains`, `ocontains`
    - `eq` string — The field exactly matches the provided value.
    - `contains` string — The field contains the provided value.
    - `ocontains` string — The field contains any of the provided values.
    - `oeq` string — The field matches any of the provided values.
    - `neq` string — The field does not match the provided value.

## Response `200`

A paginated list response for a collection of application auth strategies.

- ListAppAuthStrategiesResponse — A paginated list response for a collection of Application Auth Strategies
  - `data` AppAuthStrategy[], required
    - union — A set of plugin configurations that represent how the gateway will perform authentication and authorization for a Product Version. Called “Auth Strategy” for short in the context of portals/applications. The plugins are synced to any Gateway Service that is currently linked or becomes linked to the Product Version.
      - object — Response payload from creating or updating a Key Auth Application Auth Strategy
        - `id` string, uuid, required — Contains a unique identifier used for this resource.
        - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
        - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
        - `strategy_type` 'key_auth', required
        - `configs` object, required — JSON-B object containing the configuration for the Key Auth strategy
          - `key-auth` AppAuthStrategyConfigKeyAuth, required — The most basic mode to configure an Application Auth Strategy for an API Product Version. Using this mode will allow developers to generate API keys that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for Key Auth.
            - `key_names` string[] — The names of the headers containing the API key. You can specify multiple header names.
            - `ttl` object — Default maximum Time-To-Live for keys created under this strategy.
              - …
        - `active` boolean, required — At least one published entity is using this auth strategy.
        - `dcr_provider` object, nullable, required
          - `id` string, uuid, required — Contains a unique identifier used for this resource.
          - `name` string, required
          - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
          - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http' | 'kongIdentity', required — The type of DCR provider.
        - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
        - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
        - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
        - `supports_multiple_credentials` boolean — Indicates whether this auth strategy supports multiple credentials. Always `true` for KEY_AUTH.
        - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization.
          - `enabled` boolean, required — Whether application principals are enabled for this auth strategy.
      - object — Response payload from creating an OIDC Application Auth Strategy
        - `id` string, uuid, required — Contains a unique identifier used for this resource.
        - `name` string, required — The name of the auth strategy. This is used to identify the auth strategy in the Konnect UI.
        - `display_name` string, required — The display name of the Auth strategy. This is used to identify the Auth strategy in the Portal UI.
        - `strategy_type` 'openid_connect', required
        - `configs` object, required — JSON-B object containing the configuration for the OIDC strategy
          - `openid-connect` AppAuthStrategyConfigOpenIDConnect, required — A more advanced mode to configure an API Product Version’s Application Auth Strategy. Using this mode will allow developers to use API credentials issued from an external IdP that will authenticate their application requests. Once authenticated, an application will be granted access to any Product Version it is registered for that is configured for the same Auth Strategy. An OIDC strategy may be used in conjunction with a DCR provider to automatically create the IdP application.
            - `issuer` string, url, required
            - `credential_claim` string[], required
            - `scopes` string[], required
            - `auth_methods` string[], required
        - `active` boolean, required — At least one published entity is using this auth strategy.
        - `dcr_provider` object, nullable, required
          - `id` string, uuid, required — Contains a unique identifier used for this resource.
          - `name` string, required
          - `display_name` string — The display name of the DCR provider. This is used to identify the DCR provider in the Portal UI.
          - `provider_type` 'auth0' | 'azureAd' | 'curity' | 'okta' | 'http' | 'kongIdentity', required — The type of DCR provider.
        - `labels` Labels, required — Labels store metadata of an entity that can be used for filtering an entity list or for searching across entity types. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
        - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
        - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
        - `supports_multiple_credentials` boolean — Indicates whether this auth strategy supports multiple credentials. - `true` for Key Auth strategies and when supported for Client Credentials strategies - `false` when not supported for Client Credentials strategies
        - `principals` AuthStrategyPrincipals — Application principal settings for this auth strategy. Runtime effect applies to V3 API Catalog (ACE) portals and applications; stored values may be set for any auth strategy in the organization.
          - `enabled` boolean, required — Whether application principals are enabled for this auth strategy.
  - `meta` PaginatedMeta, required — returns the pagination information
    - `page` PageMeta, required — Contains pagination query parameters and the total number of objects returned.
      - `number` number, required
      - `size` number, required
      - `total` number, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/f920f418f552/schema)