---
title: "List auth connections"
method: GET
path: "/auth/connections"
tags: ["Managed Auth"]
---

# List auth connections

`GET /auth/connections`

List auth connections with optional filters for profile_name and domain.

## Query parameters

- `profile_name` string
- `domain` string
- `limit` integer
- `offset` integer
- `query` string

## Response `200`

List of auth connections

- ManagedAuth[]
  - `allowed_domains` string[] — Additional domains that are valid for this auth flow (besides the primary domain). Useful when login pages redirect to different domains. The following SSO/OAuth provider domains are automatically allowed by default and do not need to be specified: - Google: accounts.google.com - Microsoft/Azure AD: login.microsoftonline.com, login.live.com - Okta: *.okta.com, *.oktapreview.com - Auth0: *.auth0.com, *.us.auth0.com, *.eu.auth0.com, *.au.auth0.com - Apple: appleid.apple.com - GitHub: github.com - Facebook/Meta: www.facebook.com - LinkedIn: www.linkedin.com - Amazon Cognito: *.amazoncognito.com - OneLogin: *.onelogin.com - Ping Identity: *.pingone.com, *.pingidentity.com
  - `auto_reauth` boolean — Whether automatic re-authentication is permitted for this connection. This is an opt-in flag only — it does not check whether re-auth is actually feasible. Even when true, re-auth only runs when the system has what it needs to perform it (for example, saved credentials for the required login fields), and only after a scheduled health check detects an expired session — so this flag has no effect when `health_checks` is false. When false, expired sessions detected by a health check are marked as `NEEDS_AUTH` instead of attempting re-auth.
  - `browser` ManagedAuthBrowserConfig — Browser configuration applied to browser sessions created for a managed auth connection. Managed auth controls the profile, headless mode, timeout, start URL, kiosk mode, and viewport.
    - `proxy` union — Browser proxy configuration. Provide exactly one of mode, id, or name; an empty object is invalid. Set mode to direct for no proxy regardless of stealth. Set mode to default to use the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. Select id or name to use that proxy regardless of stealth. The selected proxy must be in the same project as the browser. Names must match exactly one active proxy; use id for stable references. Proxy configuration changes only egress and does not change stealth or CAPTCHA solver behavior. A stealth browser using mode=direct still runs in stealth mode with the CAPTCHA solver enabled. When proxy is omitted on browser creation, stealth browsers use Kernel's default stealth proxy and non-stealth browsers use direct egress. When omitted on update, the current configuration is unchanged.
      - object
        - `id` string — Proxy ID.
        - `mode` 'direct' | 'default', required — Proxy egress mode. direct forces no proxy regardless of stealth. default uses the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. default is primarily useful on browser update to restore the browser default after selected-proxy egress.
        - `name` string — Proxy name. Must match exactly one active proxy in the project.
      - object
        - `id` string, required — Proxy ID.
        - `mode` 'direct' | 'default' — Proxy egress mode. direct forces no proxy regardless of stealth. default uses the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. default is primarily useful on browser update to restore the browser default after selected-proxy egress.
        - `name` string — Proxy name. Must match exactly one active proxy in the project.
      - object
        - `id` string — Proxy ID.
        - `mode` 'direct' | 'default' — Proxy egress mode. direct forces no proxy regardless of stealth. default uses the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. default is primarily useful on browser update to restore the browser default after selected-proxy egress.
        - `name` string, required — Proxy name. Must match exactly one active proxy in the project.
    - `stealth` boolean — Whether managed auth browser sessions use stealth mode. Defaults to true when omitted.
    - `telemetry` BrowserTelemetryRequestConfig — Telemetry request configuration for a browser session.
      - `browser` BrowserTelemetryCategoriesConfig — Per-category telemetry capture settings layered onto the default set. The operational signals (control, connection, system, captcha) are on by default and are opt-out: set one to enabled=false to stop capturing it. The CDP categories (console, network, page, interaction), screenshot and platform are off by default and are opt-in: set enabled=true to capture them.
        - `captcha` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `connection` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `console` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `control` BrowserTelemetryControlConfig — Configuration for the control category. Same enabled semantics as any other category, plus settings for the browser-control commands the CDP proxy reports.
          - `cdp` BrowserTelemetryCdpControlConfig — Settings for the cdp_command events the CDP proxy reports.
            - `excluded_methods` BrowserCdpCommandMethod[] — Methods to leave out of the cdp_command stream. Omit the list to keep the current one; send an empty list to report every supported method again. Exclusion is a telemetry setting only: an excluded command is still relayed to the browser unchanged, it simply produces no event. Use it to drop the highest-volume methods — Input.dispatchMouseEvent during a humanized cursor path, or Page.captureScreenshot under a screencast — without turning the whole category off. Excluded commands are counted in cdp_disconnect.telemetry_excluded.
          - `enabled` boolean — Whether this category is captured. Control is on by default; set false to opt out.
        - `interaction` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `network` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `page` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `platform` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `screenshot` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `system` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `enabled` boolean — Request shortcut for browser telemetry capture. True enables capture; with no browser category settings it captures the default set (control, connection, system, captcha), and any browser category settings are layered onto that default set. On update, enabled=true resolves the config fresh from the default set plus any provided categories, replacing the session's current selection rather than merging onto it; omit enabled to merge categories onto the current selection instead. False stops capture on update and starts no capture on create. enabled=false cannot be combined with browser category settings.
      - `export` BrowserTelemetryExportRequestConfig — Export destinations for a session's captured telemetry, by protocol. Honored when creating a browser, including the browser a managed auth connection creates for a login. Browser pools do not support export and reject it; on a browser update it is ignored, so the session keeps the destination it was created with.
        - `otlp` BrowserTelemetryOTLPExportRequestConfig — OTLP export settings for a browser session.
          - `destination` union — OTLP destination selection. Provide either id or name. The destination must exist in the project the request resolves to.
            - object
              - …
            - object
              - …
          - `enabled` boolean — Whether to export captured telemetry over OTLP. Setting destination implies enabled=true, so this only needs to be set explicitly to disable export (enabled=false with a destination is rejected).
  - `browser_session_id` string, nullable — ID of the underlying browser session driving the current flow (present when flow in progress). Use this to inspect or terminate the browser session via the `/browsers` API.
  - `browser_telemetry` BrowserTelemetryRequestConfig — Telemetry request configuration for a browser session.
    - `browser` BrowserTelemetryCategoriesConfig — Per-category telemetry capture settings layered onto the default set. The operational signals (control, connection, system, captcha) are on by default and are opt-out: set one to enabled=false to stop capturing it. The CDP categories (console, network, page, interaction), screenshot and platform are off by default and are opt-in: set enabled=true to capture them.
      - `captcha` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `connection` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `console` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `control` BrowserTelemetryControlConfig — Configuration for the control category. Same enabled semantics as any other category, plus settings for the browser-control commands the CDP proxy reports.
        - `cdp` BrowserTelemetryCdpControlConfig — Settings for the cdp_command events the CDP proxy reports.
          - `excluded_methods` BrowserCdpCommandMethod[] — Methods to leave out of the cdp_command stream. Omit the list to keep the current one; send an empty list to report every supported method again. Exclusion is a telemetry setting only: an excluded command is still relayed to the browser unchanged, it simply produces no event. Use it to drop the highest-volume methods — Input.dispatchMouseEvent during a humanized cursor path, or Page.captureScreenshot under a screencast — without turning the whole category off. Excluded commands are counted in cdp_disconnect.telemetry_excluded.
        - `enabled` boolean — Whether this category is captured. Control is on by default; set false to opt out.
      - `interaction` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `network` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `page` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `platform` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `screenshot` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `system` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
    - `enabled` boolean — Request shortcut for browser telemetry capture. True enables capture; with no browser category settings it captures the default set (control, connection, system, captcha), and any browser category settings are layered onto that default set. On update, enabled=true resolves the config fresh from the default set plus any provided categories, replacing the session's current selection rather than merging onto it; omit enabled to merge categories onto the current selection instead. False stops capture on update and starts no capture on create. enabled=false cannot be combined with browser category settings.
    - `export` BrowserTelemetryExportRequestConfig — Export destinations for a session's captured telemetry, by protocol. Honored when creating a browser, including the browser a managed auth connection creates for a login. Browser pools do not support export and reject it; on a browser update it is ignored, so the session keeps the destination it was created with.
      - `otlp` BrowserTelemetryOTLPExportRequestConfig — OTLP export settings for a browser session.
        - `destination` union — OTLP destination selection. Provide either id or name. The destination must exist in the project the request resolves to.
          - object
            - `id` string, required — OTLP destination ID
            - `name` string — OTLP destination name
          - object
            - `id` string — OTLP destination ID
            - `name` string, required — OTLP destination name
        - `enabled` boolean — Whether to export captured telemetry over OTLP. Setting destination implies enabled=true, so this only needs to be set explicitly to disable export (enabled=false with a destination is rejected).
  - `can_reauth` boolean — Whether Kernel can automatically re-authenticate this connection when the session expires. Requires a prior successful login plus either a Kernel credential or an external credential reference. See `can_reauth_reason` for the specific outcome.
  - `can_reauth_reason` 'external_credential' | 'cua_has_credential' | 'has_credential' | 'viable_plans_found' | 'no_requirements_recorded' | 'requirements_satisfiable' | 'no_prior_successful_login' | 'no_credential' | 'no_viable_plans' | 'viable_plans_require_external_action' | 'requires_external_action' | 'requires_totp_without_secret' | 'requires_sms_code' | 'requires_email_code' | 'requires_customer_input' — Machine-readable reason for the current value of `can_reauth`. Affirmative values (re-auth is possible): - `external_credential` — an external credential provider is attached - `cua_has_credential` — CUA flow with a stored credential - `has_credential` — Kernel credential is attached (optimistic; plan viability not checked) - `viable_plans_found` — at least one stored login plan can be replayed - `no_requirements_recorded` — no recorded credential requirements to fail against - `requirements_satisfiable` — recorded requirements can be met by the attached credential Negative values (a human must complete the login flow): - `no_prior_successful_login` — connection has never completed a successful login - `no_credential` — no Kernel or external credential attached - `no_viable_plans` — credential attached but no replayable login plan exists yet - `viable_plans_require_external_action` — stored plans need an external step (email link, push, etc.) - `requires_external_action` — recorded requirements include an external step - `requires_totp_without_secret` — flow needs a TOTP code but no TOTP secret is stored - `requires_sms_code` — flow needs an SMS code that cannot be received automatically - `requires_email_code` — flow needs an email code that cannot be received automatically - `requires_customer_input` — flow needs another field or choice that is unavailable during unattended re-authentication
  - `choices` ManagedAuthChoice[], nullable — Canonical choices awaiting selection. Prefer this over pending_sso_buttons, mfa_options, and sign_in_options when present.
    - `context` string, nullable — Context captured for a choice.
    - `description` string, nullable — Additional context for the choice.
    - `display_text` string, nullable — Display text captured for a choice.
    - `id` string, required — Stable choice identifier for canonical submit.
    - `label` string, required — Human-readable choice label.
    - `masked_destination` string, nullable — Masked phone number or email address shown for an MFA choice.
    - `mfa_type` 'sms' | 'call' | 'email' | 'totp' | 'push' | 'password' | 'passkey' | 'switch' | 'other' — Canonical MFA method, independent of a site's stable choice identifier.
    - `observed_selector` string, nullable — Selector for the visible choice, when available.
    - `type` 'mfa_method' | 'sso_provider' | 'sign_in_method' | 'auth_method' | 'identifier_method' | 'account' | 'other', required — Choice type.
  - `credential` CredentialReference — Reference to credentials for the auth connection. Use one of: - { name } for Kernel credentials - { provider, path } for external provider item - { provider, auto: true } for external provider domain lookup
    - `auto` boolean — If true, lookup by domain from the specified provider
    - `name` string — Kernel credential name
    - `path` string — Provider-specific path (e.g., "VaultName/ItemName" for 1Password)
    - `provider` string — External provider name (e.g., "my-1p")
  - `discovered_fields` DiscoveredField[], nullable — Fields awaiting input (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions)
    - `hint` string — Contextual help text near the field that tells the user what to enter (e.g., "Enter the phone ending in (***) ***-**92")
    - `label` string, required — Field label
    - `linked_mfa_type` 'sms' | 'call' | 'email' | 'totp' | 'push' | 'password' | 'switch' — The MFA delivery method type. Includes 'password' for auth method selection pages and 'switch' for generic method-switcher links like "Use another method" that do not name a specific method.
    - `name` string, required — Field name
    - `placeholder` string — Field placeholder
    - `required` boolean — Whether field is required
    - `selector` string, required — CSS selector for the field
    - `type` 'text' | 'email' | 'password' | 'tel' | 'number' | 'url' | 'code' | 'totp', required — Field type
  - `domain` string, required — Target domain for authentication
  - `error_code` string, nullable — Machine-readable error code (present when flow_status=failed)
  - `error_message` string, nullable — Error message (present when flow_status=failed)
  - `external_action_message` string, nullable — Instructions for external action (present when flow_step=awaiting_external_action)
  - `fields` ManagedAuthField[], nullable — Canonical fields awaiting input. Prefer this over discovered_fields when present.
    - `hint` string — Context shown near the field, including a masked code destination.
    - `id` string, required — Stable field identifier for canonical submit.
    - `label` string — Human-readable label shown to the user.
    - `observed_selector` string, nullable — Selector for the visible field, when available.
    - `reason` 'missing' | 'rejected', required — Why the field requires user input.
    - `ref` string, required — Credential reference name to store the submitted value under.
    - `required` boolean — Whether this field is required.
    - `type` 'identifier' | 'password' | 'code' | 'totp_code' | 'totp_secret' | 'text', required — Managed-auth field type.
  - `flow_expires_at` string, date-time, nullable — When the current flow expires (null when no flow in progress). A flow past this timestamp is no longer valid and its `flow_status` will be `EXPIRED`. Clients may start a new login to supersede a stale `IN_PROGRESS` flow past this timestamp.
  - `flow_status` 'IN_PROGRESS' | 'SUCCESS' | 'FAILED' | 'EXPIRED' | 'CANCELED', nullable — Current flow status (null when no flow in progress)
  - `flow_step` 'DISCOVERING' | 'AWAITING_INPUT' | 'AWAITING_EXTERNAL_ACTION' | 'SUBMITTING' | 'COMPLETED', nullable — Current step in the flow (null when no flow in progress)
  - `flow_type` 'LOGIN' | 'REAUTH', nullable — Type of the current flow (null when no flow in progress)
  - `health_check_interval` integer, nullable — Interval in seconds between automatic health checks. When set, the system periodically verifies the authentication status and triggers re-authentication if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour) or your plan minimum, whichever is larger. The minimum depends on your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour), Free: 21600 (6 hours).
  - `health_checks` boolean — Whether periodic health checks are enabled for this connection. When false, the system will not automatically verify authentication status, and `auto_reauth` has no effect on the automatic flow (since re-auth is only triggered by a failed scheduled health check). Manually triggering a health check via the API still works regardless of this setting.
  - `hosted_url` string, uri, nullable — URL to redirect user to for hosted login (present when flow in progress)
  - `id` string, required — Unique identifier for the auth connection
  - `interaction_id` string, nullable — Opaque identifier for the current canonical interaction. Required when submitting fields or choices and changes for each new actionable pause.
  - `last_auth_at` string, date-time — Deprecated alias for `last_auth_check_at`. Despite the name, this is the last health-check timestamp, not the last successful authentication. Use `last_auth_check_at` instead.
  - `last_auth_check_at` string, date-time — When the most recent auth health check ran for this connection, regardless of outcome. Updated on every health check and does not by itself indicate that the profile is currently authenticated - use `status` for that. May be newer than `flow_expires_at` when a flow is still in progress because health checks continue to run in parallel.
  - `live_view_url` string, uri, nullable — Browser live view URL for debugging (present when flow in progress)
  - `login_url` string, uri — Optional login page URL to skip discovery
  - `mfa_options` MFAOption[], nullable — MFA method options (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions)
    - `description` string, nullable — Additional instructions from the site
    - `label` string, required — The visible option text
    - `target` string, nullable — The masked destination (phone/email) if shown
    - `type` 'sms' | 'call' | 'email' | 'totp' | 'push' | 'password' | 'switch', required — The MFA delivery method type. Includes 'password' for auth method selection pages and 'switch' for generic method-switcher links like "Use another method" that do not name a specific method.
  - `pending_sso_buttons` SSOButton[], nullable — SSO buttons available (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions)
    - `label` string, required — Visible button text
    - `provider` string, required — Identity provider name
    - `selector` string, required — XPath selector for the button
  - `post_login_url` string, uri — URL where the browser landed after successful login
  - `profile_name` string, required — Name of the profile associated with this auth connection
  - `proxy_id` string — Deprecated. Read browser.proxy instead. Retained during migration for existing clients.
  - `record_session` boolean, required — Whether to record browser session replays for this connection by default. Useful for debugging login flows. Can be overridden per-login.
  - `save_credentials` boolean, required — Whether credentials are saved after every successful login. One-time codes (TOTP, SMS, etc.) are not saved.
  - `sign_in_options` SignInOption[], nullable — Non-MFA choices presented during the auth flow, such as account selection or org pickers (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions).
    - `description` string, nullable — Additional context such as email address or org name
    - `id` string, required — Unique identifier for this option (used to submit selection back)
    - `label` string, required — Display text for the option
  - `sso_provider` string, nullable — SSO provider being used (e.g., google, github, microsoft)
  - `status` 'AUTHENTICATED' | 'NEEDS_AUTH', required — Current authentication status of the managed profile
  - `website_error` string, nullable — Visible error message from the website (e.g., 'Incorrect password'). Present when the website displays an error during login.

## Other responses

- `401` — Unauthorized – missing or invalid authorization token
- `500` — Internal Server Error

---

[API](https://skmtc.net/onkernel/apis/kernel-api.md) · [All operations](https://skmtc.net/onkernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onkernel/kernel-api/revisions/858365328f92/schema)