Can HumDay connect to Keycloak Admin?

Yes. HumDay reads Keycloak Admin's own published API description and derives the operations from it, so there is no hand-built connector to wait for. 281 operations are documented.

Do I need to write code to automate Keycloak Admin?

No. You describe the outcome you want in plain words. HumDay agrees a contract with you, writes the program, and shows you a test run before anything touches your Keycloak Admin account.

What can HumDay do in Keycloak Admin?

147 of the 281 documented operations change something in Keycloak Admin, and 134 read from it. HumDay only ever uses the specific operations your approved contract needs.

Is my Keycloak Admin account safe?

Your credentials are stored encrypted and are never shown in chat, code, or logs. Every run is limited to the operations you explicitly approved, and anything that writes to Keycloak Admin is held behind that approval.

Automate Keycloak Admin

HumDay reads Keycloak Admin’s own published API description and derives 281 operations from it. Describe the outcome you want in plain words — you get a program that is written, proven on real data, and run for you.

What Keycloak Admin is

This is a REST API reference for the Keycloak Admin

API host: keycloak.local

What HumDay can do in Keycloak Admin

147 documented operations change something in Keycloak Admin. The 63 most useful are listed here.

POSTCreate a new user Username must be unique./{realm}/users
PUTSend an email-verification email to the user An email contains a link the user can click to verify their email address./{realm}/users/{id}/send-verify-email
PUTSend a update account email to the user An email contains a link the user can click to perform a set of required actions./{realm}/users/{id}/execute-actions-email
POSTCreate a new role for the realm or client/{realm}/roles
POSTcreate or add a top level realm groupSet or create child./{realm}/groups
POSTCreate a new client Client’s clientid must be unique!/{realm}/clients
POSTCreate a new client scope Client Scope’s name must be unique!/{realm}/client-scopes
PUTSet up a new password for the user./{realm}/users/{id}/reset-password
POSTCreate a new initial access token./{realm}/clients-initial-access
POSTCreate a new authentication flow/{realm}/authentication/flows
POSTAdd new authentication execution/{realm}/authentication/executions
DELETEDelete the user/{realm}/users/{id}
PUTUpdate the user/{realm}/users/{id}
POSTAdd realm-level role mappings to the user/{realm}/users/{id}/role-mappings/realm
POSTCreate a new identity provider/{realm}/identity-provider/instances
POSTAdd a social login provider to the user/{realm}/users/{id}/federated-identity/{provider}
POSTCreate a new role for the realm or client/{realm}/clients/{id}/roles
DELETEClear any user login failures for all users This can release temporary disabled users/{realm}/attack-detection/brute-force/users
POSTTrigger sync of users Action can be "triggerFullSync" or "triggerChangedUsersSync"/{realm}/user-storage/{id}/sync
POSTImpersonate the user/{realm}/users/{id}/impersonation
POSTUnlink imported users from a storage provider/{realm}/user-storage/{id}/unlink-users
PUTDisable all credentials for a user of a specific type/{realm}/users/{id}/disable-credential-types
POSTAdd client-level roles to the user role mapping/{realm}/users/{id}/role-mappings/clients/{client}
POSTRemove imported users/{realm}/user-storage/{id}/remove-imported-users
POSTMove a credential to a first position in the credentials list of the user/{realm}/users/{id}/credentials/{credentialId}/moveToFirst
POSTAdd realm-level role mappings to the user/{realm}/groups/{id}/role-mappings/realm
POSTImport identity provider from uploaded JSON file/{realm}/identity-provider/import-config
POSTCreate multiple mappers/{realm}/clients/{id}/protocol-mappers/add-models
DELETEClear any user login failures for the user This can release temporary disabled user/{realm}/attack-detection/brute-force/users/{userId}
DELETERevoke consent and offline tokens for particular client from user/{realm}/users/{id}/consents/{client}
POSTRegister a new required actions/{realm}/authentication/register-required-action
POSTCreate multiple mappers/{realm}/client-scopes/{id}/protocol-mappers/add-models
DELETERemove a credential for a user/{realm}/users/{id}/credentials/{credentialId}
DELETERemove a social login provider from user/{realm}/users/{id}/federated-identity/{provider}
POSTSet or create child./{realm}/groups/{id}/children
POSTGenerate a new secret for the client/{realm}/clients/{id}/client-secret
POSTAdd new flow with new execution to existing flow/{realm}/authentication/flows/{flowAlias}/executions/flow
POSTAdd a composite to the role/{realm}/roles/{role-name}/composites
POSTAdd new authentication execution to a flow/{realm}/authentication/flows/{flowAlias}/executions/execution
DELETEDelete client-level roles from user role mapping/{realm}/users/{id}/role-mappings/clients/{client}
POSTAdd client-level roles to the user role mapping/{realm}/groups/{id}/role-mappings/clients/{client}
POSTGenerate a new registration access token for the client/{realm}/clients/{id}/registration-access-token
PUTUpdate a credential label for a user/{realm}/users/{id}/credentials/{credentialId}/userLabel
POSTGenerate a new keypair and certificate, and get the private key file Generates a keypair and certificate and serves the private key in a specified keystore format./{realm}/clients/{id}/certificates/{attr}/generate-and-download
DELETEDelete realm-level role mappings/{realm}/users/{id}/role-mappings/realm
PUTUpdate group, ignores subgroups./{realm}/groups/{id}
DELETEDelete the client/{realm}/clients/{id}
PUTUpdate the client/{realm}/clients/{id}
POSTAdd a set of realm-level roles to the client’s scope/{realm}/clients/{id}/scope-mappings/realm
POSTCreate a mapper/{realm}/clients/{id}/protocol-mappers/models
POSTCopy existing authentication flow under a new name The new name is given as 'newName' attribute of the passed JSON object/{realm}/authentication/flows/{flowAlias}/copy
DELETEDelete a role by name/{realm}/roles/{role-name}
PUTUpdate a role by name/{realm}/roles/{role-name}
DELETEDelete the client scope/{realm}/client-scopes/{id}
PUTUpdate the client scope/{realm}/client-scopes/{id}
POSTAdd a set of realm-level roles to the client’s scope/{realm}/client-scopes/{id}/scope-mappings/realm
DELETEDelete the role/{realm}/roles-by-id/{role-id}
PUTUpdate the role/{realm}/roles-by-id/{role-id}
POSTRemove all user sessions associated with the user Also send notification to all clients that have an admin URL to invalidate the sessions for the particular user./{realm}/users/{id}/logout
POSTCreate a mapper/{realm}/client-scopes/{id}/protocol-mappers/models
POSTAdd a mapper to identity provider/{realm}/identity-provider/instances/{alias}/mappers
POSTUpdate execution with new configuration/{realm}/authentication/executions/{executionId}/config
POSTRegister a cluster node with the client Manually register cluster node to this client - usually it’s not needed to call this directly as adapter should handle by sending registrat…/{realm}/clients/{id}/nodes

What HumDay can read from Keycloak Admin

These are the operations a schedule or a trigger can watch.

GETGet users Returns a list of users, filtered according to query parameters/{realm}/users
GETGet users Returns a list of users, filtered according to query parameters/{realm}/groups/{id}/members
GETGet themes, social providers, auth providers, and event listeners available on this server/
GETGet representation of the user/{realm}/users/{id}
GETGet form providers Returns a list of form providers./{realm}/authentication/form-providers
GETGet form action providers Returns a list of form action providers./{realm}/authentication/form-action-providers
GETGet clients belonging to the realm Returns a list of clients belonging to the realm/{realm}/clients
GETGet client scopes belonging to the realm Returns a list of client scopes belonging to the realm/{realm}/client-scopes
GETGet consents granted by the user/{realm}/users/{id}/consents
GETGet sessions associated with the user/{realm}/users/{id}/sessions
GETReturn List of Users that have the specified role name/{realm}/roles/{role-name}/users
GETGet user sessions for client Returns a list of user sessions associated with this client/{realm}/clients/{id}/user-sessions
GETGet offline sessions for client Returns a list of offline user sessions associated with this client/{realm}/clients/{id}/offline-sessions
GETGet social logins associated with the user/{realm}/users/{id}/federated-identity
GETReturns the number of users that match the given criteria./{realm}/users/count
GETGet authentication flows Returns a list of authentication flows./{realm}/authentication/flows
GETReturn credential types, which are provided by the user storage where user is stored./{realm}/users/{id}/configured-user-storage-credential-types
GETGet required actions Returns a list of required actions./{realm}/authentication/required-actions
GETGet authenticator providers Returns a list of authenticator providers./{realm}/authentication/authenticator-providers
GETGet unregistered required actions Returns a list of unregistered required actions./{realm}/authentication/unregistered-required-actions
GETGet client authenticator providers Returns a list of client authenticator providers./{realm}/authentication/client-authenticator-providers
GETGet all roles for the realm or client/{realm}/roles
GETGet group hierarchy./{realm}/groups
GETGet offline sessions associated with the user and client/{realm}/users/{id}/offline-sessions/{clientId}
GETGet effective realm-level roles associated with the client’s scope What this does is recurse any composite roles associated with the client’s scope and adds the roles to this list…/{realm}/clients/{id}/scope-mappings/realm/composite
GETReturn List of Groups that have the specified role name/{realm}/roles/{role-name}/groups
GETGet role mappings/{realm}/users/{id}/role-mappings
GETGet application session count Returns a number of user sessions associated with this client { "count": number }/{realm}/clients/{id}/session-count
GETGet effective realm-level roles associated with the client’s scope What this does is recurse any composite roles associated with the client’s scope and adds the roles to this list…/{realm}/client-scopes/{id}/scope-mappings/realm/composite
GETReturn List of Users that have the specified role name/{realm}/clients/{id}/roles/{role-name}/users
GETGet a user dedicated to the service account/{realm}/clients/{id}/service-account-user
GETGet application offline session count Returns a number of offline user sessions associated with this client { "count": number }/{realm}/clients/{id}/offline-session-count
GETList of subcomponent types that are available to configure for a particular parent component./{realm}/components/{id}/sub-component-types
GETGet client-level role mappings for the user, and the app/{realm}/users/{id}/role-mappings/clients/{client}
GETReturns the groups counts./{realm}/groups/count
GETGet realm-level role mappings/{realm}/users/{id}/role-mappings/realm
GETGet representation of the client/{realm}/clients/{id}

How automating Keycloak Admin works

Describe the outcome. Say what you want to happen, in your own words. No node graphs, no field mapping.
Approve the contract. HumDay writes down exactly what it will do, what it will touch, and what it will never do. You approve it before anything is built.
See it proven. The program runs and shows you the result before it is allowed near your live Keycloak Admin account.
Grant access, then go live. You approve the specific Keycloak Admin operations it may use — and only those.