# keystone.api.auth module

class keystone.api.auth.AuthAPI(blueprint_url_prefix='', api_url_prefix='', default_mediatype='application/json', decorators=None, errors=None)

  Bases: `APIBase`

  resource_mapping = [(<class 'keystone.api.auth.AuthProjectsResource'>, '/auth/projects', [{'json_home': ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/projects', 'stable', {}), 'url': '/OS-FEDERATION/projects'}], {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/auth_projects', 'stable', {})), (<class 'keystone.api.auth.AuthDomainsResource'>, '/auth/domains', [{'json_home': ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/domains', 'stable', {}), 'url': '/OS-FEDERATION/domains'}], {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/auth_domains', 'stable', {})), (<class 'keystone.api.auth.AuthSystemResource'>, '/auth/system', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/auth_system', 'stable', {})), (<class 'keystone.api.auth.AuthCatalogResource'>, '/auth/catalog', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/auth_catalog', 'stable', {})), (<class 'keystone.api.auth.AuthTokenOSPKIResource'>, '/auth/tokens/OS-PKI/revoked', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-PKI/1.0/rel/revocations', 'stable', {})), (<class 'keystone.api.auth.AuthTokenResource'>, '/auth/tokens', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/rel/auth_tokens', 'stable', {}))]
  resources = []

class keystone.api.auth.AuthCatalogResource

  Bases: `_AuthFederationWebSSOBase`

  get()

    Get service catalog for token.

    GET/HEAD /v3/auth/catalog

  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.auth.AuthDomainsResource

  Bases: `ResourceBase`

  collection_key: str = 'domains'
  get()

    Get possible domain scopes for token.

    GET/HEAD /v3/auth/domains GET/HEAD /v3/OS-FEDERATION/domains

  member_key: str = 'domain'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.auth.AuthFederationAPI(blueprint_url_prefix='', api_url_prefix='', default_mediatype='application/json', decorators=None, errors=None)

  Bases: `APIBase`

  resource_mapping = [(<class 'keystone.api.auth.AuthFederationSaml2Resource'>, '/auth/OS-FEDERATION/saml2', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/saml2', 'stable', {})), (<class 'keystone.api.auth.AuthFederationSaml2ECPResource'>, '/auth/OS-FEDERATION/saml2/ecp', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/ecp', 'stable', {})), (<class 'keystone.api.auth.AuthFederationWebSSOResource'>, '/auth/OS-FEDERATION/websso/<string:protocol_id>', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/websso', 'stable', {'protocol_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/param/protocol_id'})), (<class 'keystone.api.auth.AuthFederationWebSSOIDPsResource'>, '/auth/OS-FEDERATION/identity_providers/<string:idp_id>/protocols/<string:protocol_id>/websso', None, {}, ('https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/rel/identity_providers_websso', 'stable', {'idp_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/param/idp_id', 'protocol_id': 'https://docs.openstack.org/api/openstack-identity/3/ext/OS-FEDERATION/1.0/param/protocol_id'}))]
  resources = []

class keystone.api.auth.AuthFederationSaml2ECPResource

  Bases: `_AuthFederationWebSSOBase`

  get()
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post()

    Exchange a scoped token for an ECP assertion.

    POST /v3/auth/OS-FEDERATION/saml2/ecp

class keystone.api.auth.AuthFederationSaml2Resource

  Bases: `_AuthFederationWebSSOBase`

  get()
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post()

    Exchange a scoped token for a SAML assertion.

    POST /v3/auth/OS-FEDERATION/saml2

class keystone.api.auth.AuthFederationWebSSOIDPsResource

  Bases: `_AuthFederationWebSSOBase`

  get(idp_id, protocol_id)
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(idp_id, protocol_id)

class keystone.api.auth.AuthFederationWebSSOResource

  Bases: `_AuthFederationWebSSOBase`

  get(protocol_id)
  methods: ClassVar[Collection[str] | None] = {'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post(protocol_id)

class keystone.api.auth.AuthProjectsResource

  Bases: `ResourceBase`

  collection_key: str = 'projects'
  get()

    Get possible project scopes for token.

    GET/HEAD /v3/auth/projects GET/HEAD /v3/OS-FEDERATION/projects

  member_key: str = 'project'
  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.auth.AuthSystemResource

  Bases: `_AuthFederationWebSSOBase`

  get()

    Get possible system scopes for token.

    GET/HEAD /v3/auth/system

  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.auth.AuthTokenOSPKIResource

  Bases: `Resource`

  get()

    Deprecated; get revoked token list.

    GET/HEAD /v3/auth/tokens/OS-PKI/revoked

  methods: ClassVar[Collection[str] | None] = {'GET'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

class keystone.api.auth.AuthTokenResource

  Bases: `_AuthFederationWebSSOBase`

  delete()

    Revoke a token.

    DELETE /v3/auth/tokens

  get()

    Validate a token.

    HEAD/GET /v3/auth/tokens

  methods: ClassVar[Collection[str] | None] = {'DELETE', 'GET', 'POST'}

    The methods this view is registered for. Uses the same default (`["GET", "HEAD", "OPTIONS"]`) as `route` and `add_url_rule` by default.

  post()

    Issue a token.

    POST /v3/auth/tokens

this page last updated: 2026-06-11 21:52:50

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug