Get auth connection

Retrieve an auth connection by its ID. Includes current flow state if a login is in progress.

GET/auth/connections/{id}

Retrieve an auth connection by its ID. Includes current flow state if a login is in progress.

Authorization

bearerAuth

AuthorizationBearer <token>

In: header

Response

application/json

Auth connection details

Managed authentication that keeps a profile logged into a specific domain. Flow fields (flow_status, flow_step, discovered_fields, mfa_options) reflect the most recent login flow and are null when no flow has been initiated.

id*string

Unique identifier for the auth connection

profile_name*string

Name of the profile associated with this auth connection

domain*string

Target domain for authentication

status*string

Current authentication status of the managed profile

Value in

"AUTHENTICATED"
"NEEDS_AUTH"

last_auth_check_at?string

When the most recent auth health check ran for this connection, regardless of outcome. Updated on every health check and does not by itself indicate that the profile is currently authenticated - use status for that. May be newer than flow_expires_at when a flow is still in progress because health checks continue to run in parallel.

Formatdate-time

last_auth_at?string

Deprecated

Deprecated alias for last_auth_check_at. Despite the name, this is the last health-check timestamp, not the last successful authentication. Use last_auth_check_at instead.

Formatdate-time

credential?

Reference to credentials for the auth connection. Use one of:

{ name } for Kernel credentials
{ provider, path } for external provider item
{ provider, auto: true } for external provider domain lookup

can_reauth?boolean

Whether Kernel can automatically re-authenticate this connection when the session expires. Requires a prior successful login plus either a Kernel credential or an external credential reference. See can_reauth_reason for the specific outcome.

can_reauth_reason?string

Machine-readable reason for the current value of can_reauth. Affirmative values (re-auth is possible):

external_credential — an external credential provider is attached
cua_has_credential — CUA flow with a stored credential
has_credential — Kernel credential is attached (optimistic; plan viability not checked)
viable_plans_found — at least one stored login plan can be replayed
no_requirements_recorded — no recorded credential requirements to fail against
requirements_satisfiable — recorded requirements can be met by the attached credential

Negative values (a human must complete the login flow):

no_prior_successful_login — connection has never completed a successful login
no_credential — no Kernel or external credential attached
no_viable_plans — credential attached but no replayable login plan exists yet
viable_plans_require_external_action — stored plans need an external step (email link, push, etc.)
requires_external_action — recorded requirements include an external step
requires_totp_without_secret — flow needs a TOTP code but no TOTP secret is stored
requires_sms_code — flow needs an SMS code that cannot be received automatically
requires_email_code — flow needs an email code that cannot be received automatically

Value in

"external_credential"
"cua_has_credential"
"has_credential"
"viable_plans_found"
"no_requirements_recorded"
"requirements_satisfiable"
"no_prior_successful_login"
"no_credential"
"no_viable_plans"
"viable_plans_require_external_action"
"requires_external_action"
"requires_totp_without_secret"
"requires_sms_code"
"requires_email_code"

proxy_id?string

ID of the proxy associated with this connection, if any.

allowed_domains?array<string>

Additional domains that are valid for this auth flow (besides the primary domain). Useful when login pages redirect to different domains.

The following SSO/OAuth provider domains are automatically allowed by default and do not need to be specified:

Google: accounts.google.com
Microsoft/Azure AD: login.microsoftonline.com, login.live.com
Okta: *.okta.com, *.oktapreview.com
Auth0: *.auth0.com, *.us.auth0.com, *.eu.auth0.com, *.au.auth0.com
Apple: appleid.apple.com
GitHub: github.com
Facebook/Meta: www.facebook.com
LinkedIn: www.linkedin.com
Amazon Cognito: *.amazoncognito.com
OneLogin: *.onelogin.com
Ping Identity: *.pingone.com, *.pingidentity.com

login_url?string

Optional login page URL to skip discovery

Formaturi

post_login_url?string

URL where the browser landed after successful login

Formaturi

flow_status?string

Current flow status (null when no flow in progress)

Value in

"IN_PROGRESS"
"SUCCESS"
"FAILED"
"EXPIRED"
"CANCELED"

flow_step?string

Current step in the flow (null when no flow in progress)

Value in

"DISCOVERING"
"AWAITING_INPUT"
"AWAITING_EXTERNAL_ACTION"
"SUBMITTING"
"COMPLETED"

flow_type?string

Type of the current flow (null when no flow in progress)

Value in

"LOGIN"
"REAUTH"

flow_expires_at?string

When the current flow expires (null when no flow in progress). A flow past this timestamp is no longer valid and its flow_status will be EXPIRED. Clients may start a new login to supersede a stale IN_PROGRESS flow past this timestamp.

Formatdate-time

fields?array<>

Canonical fields awaiting input. Prefer this over discovered_fields when present.

choices?array<>

Canonical choices awaiting selection. Prefer this over pending_sso_buttons, mfa_options, and sign_in_options when present.

discovered_fields?array<>

Fields awaiting input (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions)

mfa_options?array<>

MFA method options (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions)

sign_in_options?array<>

Non-MFA choices presented during the auth flow, such as account selection or org pickers (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions).

pending_sso_buttons?array<>

SSO buttons available (present when flow_step=awaiting_input; may also be present with awaiting_external_action as fallback actions)

external_action_message?string

Instructions for external action (present when flow_step=awaiting_external_action)

website_error?string

Visible error message from the website (e.g., 'Incorrect password'). Present when the website displays an error during login.

sso_provider?string

SSO provider being used (e.g., google, github, microsoft)

error_message?string

Error message (present when flow_status=failed)

error_code?string

Machine-readable error code (present when flow_status=failed)

hosted_url?string

URL to redirect user to for hosted login (present when flow in progress)

Formaturi

live_view_url?string

Browser live view URL for debugging (present when flow in progress)

Formaturi

browser_session_id?string

ID of the underlying browser session driving the current flow (present when flow in progress). Use this to inspect or terminate the browser session via the /browsers API.

health_check_interval?integer

Interval in seconds between automatic health checks. When set, the system periodically verifies the authentication status and triggers re-authentication if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour). The minimum depends on your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour).

Range300 <= value <= 86400

health_checks?boolean

Whether periodic health checks are enabled for this connection. When false, the system will not automatically verify authentication status, and auto_reauth has no effect on the automatic flow (since re-auth is only triggered by a failed scheduled health check). Manually triggering a health check via the API still works regardless of this setting.

auto_reauth?boolean

Whether automatic re-authentication is permitted for this connection. This is an opt-in flag only — it does not check whether re-auth is actually feasible. Even when true, re-auth only runs when the system has what it needs to perform it (for example, saved credentials for the required login fields), and only after a scheduled health check detects an expired session — so this flag has no effect when health_checks is false. When false, expired sessions detected by a health check are marked as NEEDS_AUTH instead of attempting re-auth.

save_credentials*boolean

Whether credentials are saved after every successful login. One-time codes (TOTP, SMS, etc.) are not saved.

record_session*boolean

Whether to record browser session replays for this connection by default. Useful for debugging login flows. Can be overridden per-login.

curl -X GET "https://example.com/auth/connections/string"

{  "id": "string",  "profile_name": "string",  "domain": "string",  "status": "AUTHENTICATED",  "last_auth_check_at": "2019-08-24T14:15:22Z",  "last_auth_at": "2019-08-24T14:15:22Z",  "credential": {    "name": "string",    "provider": "string",    "path": "string",    "auto": true  },  "can_reauth": true,  "can_reauth_reason": "external_credential",  "proxy_id": "string",  "allowed_domains": [    "string"  ],  "login_url": "http://example.com",  "post_login_url": "http://example.com",  "flow_status": "IN_PROGRESS",  "flow_step": "DISCOVERING",  "flow_type": "LOGIN",  "flow_expires_at": "2019-08-24T14:15:22Z",  "fields": [    {      "id": "string",      "ref": "string",      "type": "identifier",      "label": "string",      "required": true,      "observed_selector": "string"    }  ],  "choices": [    {      "id": "string",      "type": "mfa_method",      "label": "string",      "description": "string",      "observed_selector": "string"    }  ],  "discovered_fields": [    {      "name": "string",      "type": "text",      "label": "string",      "placeholder": "string",      "required": true,      "selector": "string",      "linked_mfa_type": "sms",      "hint": "string"    }  ],  "mfa_options": [    {      "type": "sms",      "label": "string",      "target": "string",      "description": "string"    }  ],  "sign_in_options": [    {      "id": "string",      "label": "string",      "description": "string"    }  ],  "pending_sso_buttons": [    {      "selector": "string",      "provider": "string",      "label": "string"    }  ],  "external_action_message": "string",  "website_error": "string",  "sso_provider": "string",  "error_message": "string",  "error_code": "string",  "hosted_url": "http://example.com",  "live_view_url": "http://example.com",  "browser_session_id": "string",  "health_check_interval": 300,  "health_checks": true,  "auto_reauth": true,  "save_credentials": true,  "record_session": true}

{  "code": "string",  "message": "string",  "details": [    {      "code": "string",      "message": "string"    }  ],  "inner_error": {    "code": "string",    "message": "string"  }}

{  "code": "string",  "message": "string",  "details": [    {      "code": "string",      "message": "string"    }  ],  "inner_error": {    "code": "string",    "message": "string"  }}

{  "code": "string",  "message": "string",  "details": [    {      "code": "string",      "message": "string"    }  ],  "inner_error": {    "code": "string",    "message": "string"  }}

Get auth connection

Authorization

Path Parameters

Response