---
name: pp-authentik
description: "Agent-native admin CLI for authentik identity provider with offline SQLite cache and an MCP server for Claude Desktop. Trigger phrases: `audit authentik users`, `list authentik tokens`, `check authentik health`, `use authentik`, `run authentik`."
author: "CFinney"
license: "Apache-2.0"
argument-hint: "<command> [args] | install cli|mcp"
allowed-tools: "Read Bash"
metadata:
  openclaw:
    requires:
      bins:
        - authentik-pp-cli
    install:
      - kind: go
        bins: [authentik-pp-cli]
        module: github.com/mvanhorn/printing-press-library/library/auth/authentik/cmd/authentik-pp-cli
---

# authentik — Printing Press CLI

## Prerequisites: Install the CLI

This skill drives the `authentik-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first:

1. Install via the Printing Press installer:
   ```bash
   npx -y @mvanhorn/printing-press-library install authentik --cli-only
   ```
2. Verify: `authentik-pp-cli --version`
3. Ensure `$GOPATH/bin` (or `$HOME/go/bin`) is on `$PATH`.

If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.6 or newer):

```bash
go install github.com/mvanhorn/printing-press-library/library/auth/authentik/cmd/authentik-pp-cli@latest
```

If `--version` reports "command not found" after install, the install step did not put the binary on `$PATH`. Do not proceed with skill commands until verification succeeds.

Inspect users, groups, applications, flows, tokens, and providers from the terminal or from Claude. Sync once, query offline, audit with a single command.

## When to Use This CLI

Use this CLI when you need to audit or inspect an authentik installation from the terminal or from an agent. Best for read-heavy admin workflows, token hygiene, and access audits.

## Unique Capabilities

These capabilities aren't available in any other tool for this API.
- **`health`** — Joins admin/system + tasks + workers + version into a single agent-readable summary
- **`tokens stale`** — Find API tokens whose owners have not used them in N days
- **`apps unused`** — List applications with no successful login in N days
- **`users groups`** — Recursively expand a user's group memberships including inherited roles
- **`flows map`** — Render a flow with its ordered stage bindings as a tree

## Command Reference

**admin** — Manage admin

- `authentik-pp-cli admin apps-list` — Read-only view list all installed apps
- `authentik-pp-cli admin models-list` — Read-only view list all installed models
- `authentik-pp-cli admin settings-partial-update` — Settings view
- `authentik-pp-cli admin settings-retrieve` — Settings view
- `authentik-pp-cli admin settings-update` — Settings view
- `authentik-pp-cli admin system-create` — Get system information.
- `authentik-pp-cli admin system-retrieve` — Get system information.
- `authentik-pp-cli admin version-history-list` — VersionHistory Viewset
- `authentik-pp-cli admin version-history-retrieve` — VersionHistory Viewset
- `authentik-pp-cli admin version-retrieve` — Get running and latest version.

**authenticators** — Manage authenticators

- `authentik-pp-cli authenticators admin-all-list` — Get all devices for current user
- `authentik-pp-cli authenticators admin-duo-create` — Viewset for Duo authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-duo-destroy` — Viewset for Duo authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-duo-list` — Viewset for Duo authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-duo-partial-update` — Viewset for Duo authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-duo-retrieve` — Viewset for Duo authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-duo-update` — Viewset for Duo authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-email-create` — Viewset for email authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-email-destroy` — Viewset for email authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-email-list` — Viewset for email authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-email-partial-update` — Viewset for email authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-email-retrieve` — Viewset for email authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-email-update` — Viewset for email authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-endpoint-create` — Viewset for Endpoint authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-endpoint-destroy` — Viewset for Endpoint authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-endpoint-list` — Viewset for Endpoint authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-endpoint-partial-update` — Viewset for Endpoint authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-endpoint-retrieve` — Viewset for Endpoint authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-endpoint-update` — Viewset for Endpoint authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-sms-create` — Viewset for sms authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-sms-destroy` — Viewset for sms authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-sms-list` — Viewset for sms authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-sms-partial-update` — Viewset for sms authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-sms-retrieve` — Viewset for sms authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-sms-update` — Viewset for sms authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-static-create` — Viewset for static authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-static-destroy` — Viewset for static authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-static-list` — Viewset for static authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-static-partial-update` — Viewset for static authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-static-retrieve` — Viewset for static authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-static-update` — Viewset for static authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-totp-create` — Viewset for totp authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-totp-destroy` — Viewset for totp authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-totp-list` — Viewset for totp authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-totp-partial-update` — Viewset for totp authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-totp-retrieve` — Viewset for totp authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-totp-update` — Viewset for totp authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-webauthn-create` — Viewset for WebAuthn authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-webauthn-destroy` — Viewset for WebAuthn authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-webauthn-list` — Viewset for WebAuthn authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-webauthn-partial-update` — Viewset for WebAuthn authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-webauthn-retrieve` — Viewset for WebAuthn authenticator devices (for admins)
- `authentik-pp-cli authenticators admin-webauthn-update` — Viewset for WebAuthn authenticator devices (for admins)
- `authentik-pp-cli authenticators all-list` — Get all devices for current user
- `authentik-pp-cli authenticators duo-destroy` — Viewset for Duo authenticator devices
- `authentik-pp-cli authenticators duo-list` — Viewset for Duo authenticator devices
- `authentik-pp-cli authenticators duo-partial-update` — Viewset for Duo authenticator devices
- `authentik-pp-cli authenticators duo-retrieve` — Viewset for Duo authenticator devices
- `authentik-pp-cli authenticators duo-update` — Viewset for Duo authenticator devices
- `authentik-pp-cli authenticators duo-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli authenticators email-destroy` — Viewset for email authenticator devices
- `authentik-pp-cli authenticators email-list` — Viewset for email authenticator devices
- `authentik-pp-cli authenticators email-partial-update` — Viewset for email authenticator devices
- `authentik-pp-cli authenticators email-retrieve` — Viewset for email authenticator devices
- `authentik-pp-cli authenticators email-update` — Viewset for email authenticator devices
- `authentik-pp-cli authenticators email-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli authenticators endpoint-list` — Viewset for Endpoint authenticator devices
- `authentik-pp-cli authenticators endpoint-retrieve` — Viewset for Endpoint authenticator devices
- `authentik-pp-cli authenticators endpoint-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli authenticators sms-destroy` — Viewset for sms authenticator devices
- `authentik-pp-cli authenticators sms-list` — Viewset for sms authenticator devices
- `authentik-pp-cli authenticators sms-partial-update` — Viewset for sms authenticator devices
- `authentik-pp-cli authenticators sms-retrieve` — Viewset for sms authenticator devices
- `authentik-pp-cli authenticators sms-update` — Viewset for sms authenticator devices
- `authentik-pp-cli authenticators sms-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli authenticators static-destroy` — Viewset for static authenticator devices
- `authentik-pp-cli authenticators static-list` — Viewset for static authenticator devices
- `authentik-pp-cli authenticators static-partial-update` — Viewset for static authenticator devices
- `authentik-pp-cli authenticators static-retrieve` — Viewset for static authenticator devices
- `authentik-pp-cli authenticators static-update` — Viewset for static authenticator devices
- `authentik-pp-cli authenticators static-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli authenticators totp-destroy` — Viewset for totp authenticator devices
- `authentik-pp-cli authenticators totp-list` — Viewset for totp authenticator devices
- `authentik-pp-cli authenticators totp-partial-update` — Viewset for totp authenticator devices
- `authentik-pp-cli authenticators totp-retrieve` — Viewset for totp authenticator devices
- `authentik-pp-cli authenticators totp-update` — Viewset for totp authenticator devices
- `authentik-pp-cli authenticators totp-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli authenticators webauthn-destroy` — Viewset for WebAuthn authenticator devices
- `authentik-pp-cli authenticators webauthn-list` — Viewset for WebAuthn authenticator devices
- `authentik-pp-cli authenticators webauthn-partial-update` — Viewset for WebAuthn authenticator devices
- `authentik-pp-cli authenticators webauthn-retrieve` — Viewset for WebAuthn authenticator devices
- `authentik-pp-cli authenticators webauthn-update` — Viewset for WebAuthn authenticator devices
- `authentik-pp-cli authenticators webauthn-used-by-list` — Get a list of all objects that use this object

**core** — Manage core

- `authentik-pp-cli core application-entitlements-create` — ApplicationEntitlement Viewset
- `authentik-pp-cli core application-entitlements-destroy` — ApplicationEntitlement Viewset
- `authentik-pp-cli core application-entitlements-list` — ApplicationEntitlement Viewset
- `authentik-pp-cli core application-entitlements-partial-update` — ApplicationEntitlement Viewset
- `authentik-pp-cli core application-entitlements-retrieve` — ApplicationEntitlement Viewset
- `authentik-pp-cli core application-entitlements-update` — ApplicationEntitlement Viewset
- `authentik-pp-cli core application-entitlements-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core applications-check-access-retrieve` — Check access to a single application by slug
- `authentik-pp-cli core applications-create` — Application Viewset
- `authentik-pp-cli core applications-destroy` — Application Viewset
- `authentik-pp-cli core applications-list` — Custom list method that checks Policy based access instead of guardian
- `authentik-pp-cli core applications-partial-update` — Application Viewset
- `authentik-pp-cli core applications-retrieve` — Application Viewset
- `authentik-pp-cli core applications-set-icon-create` — Set application icon
- `authentik-pp-cli core applications-set-icon-url-create` — Set application icon (as URL)
- `authentik-pp-cli core applications-update` — Application Viewset
- `authentik-pp-cli core applications-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core authenticated-sessions-destroy` — AuthenticatedSession Viewset
- `authentik-pp-cli core authenticated-sessions-list` — AuthenticatedSession Viewset
- `authentik-pp-cli core authenticated-sessions-retrieve` — AuthenticatedSession Viewset
- `authentik-pp-cli core authenticated-sessions-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core brands-create` — Brand Viewset
- `authentik-pp-cli core brands-current-retrieve` — Get current brand
- `authentik-pp-cli core brands-destroy` — Brand Viewset
- `authentik-pp-cli core brands-list` — Brand Viewset
- `authentik-pp-cli core brands-partial-update` — Brand Viewset
- `authentik-pp-cli core brands-retrieve` — Brand Viewset
- `authentik-pp-cli core brands-update` — Brand Viewset
- `authentik-pp-cli core brands-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core groups-add-user-create` — Add user to group
- `authentik-pp-cli core groups-create` — Group Viewset
- `authentik-pp-cli core groups-destroy` — Group Viewset
- `authentik-pp-cli core groups-list` — Group Viewset
- `authentik-pp-cli core groups-partial-update` — Group Viewset
- `authentik-pp-cli core groups-remove-user-create` — Remove user from group
- `authentik-pp-cli core groups-retrieve` — Group Viewset
- `authentik-pp-cli core groups-update` — Group Viewset
- `authentik-pp-cli core groups-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core tokens-create` — Token Viewset
- `authentik-pp-cli core tokens-destroy` — Token Viewset
- `authentik-pp-cli core tokens-list` — Token Viewset
- `authentik-pp-cli core tokens-partial-update` — Token Viewset
- `authentik-pp-cli core tokens-retrieve` — Token Viewset
- `authentik-pp-cli core tokens-set-key-create` — Set token key. Action is logged as event. `authentik_core.set_token_key` permission is required.
- `authentik-pp-cli core tokens-update` — Token Viewset
- `authentik-pp-cli core tokens-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core tokens-view-key-retrieve` — Return token key and log access
- `authentik-pp-cli core transactional-applications-update` — Convert data into a blueprint, validate it and apply it
- `authentik-pp-cli core user-consent-destroy` — UserConsent Viewset
- `authentik-pp-cli core user-consent-list` — UserConsent Viewset
- `authentik-pp-cli core user-consent-retrieve` — UserConsent Viewset
- `authentik-pp-cli core user-consent-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli core users-create` — User Viewset
- `authentik-pp-cli core users-destroy` — User Viewset
- `authentik-pp-cli core users-impersonate-create` — Impersonate a user
- `authentik-pp-cli core users-impersonate-end-retrieve` — End Impersonation a user
- `authentik-pp-cli core users-list` — User Viewset
- `authentik-pp-cli core users-me-retrieve` — Get information about current user
- `authentik-pp-cli core users-partial-update` — User Viewset
- `authentik-pp-cli core users-paths-retrieve` — Get all user paths
- `authentik-pp-cli core users-recovery-create` — Create a temporary link that a user can use to recover their account
- `authentik-pp-cli core users-recovery-email-create` — Send an email with a temporary link that a user can use to recover their account
- `authentik-pp-cli core users-retrieve` — User Viewset
- `authentik-pp-cli core users-service-account-create` — Create a new user account that is marked as a service account
- `authentik-pp-cli core users-set-password-create` — Set password for user
- `authentik-pp-cli core users-update` — User Viewset
- `authentik-pp-cli core users-used-by-list` — Get a list of all objects that use this object

**enterprise** — Manage enterprise

- `authentik-pp-cli enterprise license-create` — License Viewset
- `authentik-pp-cli enterprise license-destroy` — License Viewset
- `authentik-pp-cli enterprise license-forecast-retrieve` — Forecast how many users will be required in a year
- `authentik-pp-cli enterprise license-install-id-retrieve` — Get install_id
- `authentik-pp-cli enterprise license-list` — License Viewset
- `authentik-pp-cli enterprise license-partial-update` — License Viewset
- `authentik-pp-cli enterprise license-retrieve` — License Viewset
- `authentik-pp-cli enterprise license-summary-retrieve` — Get the total license status
- `authentik-pp-cli enterprise license-update` — License Viewset
- `authentik-pp-cli enterprise license-used-by-list` — Get a list of all objects that use this object

**events** — Manage events

- `authentik-pp-cli events actions-list` — Get all actions
- `authentik-pp-cli events create` — Event Read-Only Viewset
- `authentik-pp-cli events destroy` — Event Read-Only Viewset
- `authentik-pp-cli events list` — Event Read-Only Viewset
- `authentik-pp-cli events notifications-destroy` — Notification Viewset
- `authentik-pp-cli events notifications-list` — Notification Viewset
- `authentik-pp-cli events notifications-mark-all-seen-create` — Mark all the user's notifications as seen
- `authentik-pp-cli events notifications-partial-update` — Notification Viewset
- `authentik-pp-cli events notifications-retrieve` — Notification Viewset
- `authentik-pp-cli events notifications-update` — Notification Viewset
- `authentik-pp-cli events notifications-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli events partial-update` — Event Read-Only Viewset
- `authentik-pp-cli events retrieve` — Event Read-Only Viewset
- `authentik-pp-cli events rules-create` — NotificationRule Viewset
- `authentik-pp-cli events rules-destroy` — NotificationRule Viewset
- `authentik-pp-cli events rules-list` — NotificationRule Viewset
- `authentik-pp-cli events rules-partial-update` — NotificationRule Viewset
- `authentik-pp-cli events rules-retrieve` — NotificationRule Viewset
- `authentik-pp-cli events rules-update` — NotificationRule Viewset
- `authentik-pp-cli events rules-used-by-list` — Get a list of all objects that use this object
- `authentik-pp-cli events top-per-user-list` — Get the top_n events grouped by user count
- `authentik-pp-cli events transports-create` — NotificationTransport Viewset
- `authentik-pp-cli events transports-destroy` — NotificationTransport Viewset
- `authentik-pp-cli events transports-list` — NotificationTransport Viewset
- `authentik-pp-cli events transports-partial-update` — NotificationTransport Viewset
- `authentik-pp-cli events transports-retrieve` — NotificationTransport Viewset
- `authentik-pp-cli events transports-test-create` — Send example notification using selected transport. Requires Modify