API Reference

Getting Started

Core Concepts

Backend API — Guides

Frontend API — Guides

OAuth & OpenID Connect — Guides

Enterprise: SSO & SCIM — Guides

Webhooks — Guides

SDKs

Frontend API (FAPI)

Public API

SCIM

OIDC

Oauth2

Platform

Apps

Actions

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 11, 2026

Actions

Backend API — secret key (Authorization: Bearer sk_…).

8 routes. Each row is one endpoint with its explanation, required scope, and whether it honours the Idempotency-Key header.

Method & path	Scope	Idem	Explanation
`GET /v1/actions`	`actions:read`		List Actions (tenant code that runs at auth-pipeline hooks). Secret values are never returned, only their names.
`POST /v1/actions`	`actions:write`	✓	Create an Action for a trigger (post_login, pre_user_registration, post_user_registration). Secrets are write-only.
`GET /v1/actions/:id`	`actions:read`		Read one Action. Reports secret names only, never their values.
`PATCH /v1/actions/:id`	`actions:write`		Update an Action's name, code, enabled flag, or secrets. A secret set to "" is deleted; one left out is preserved.
`DELETE /v1/actions/:id`	`actions:write`		Delete an Action. Its trigger bindings cascade away, so it stops running everywhere.
`POST /v1/actions/:id/test`	`actions:write`		Dry-run an Action against a sample event in the sandbox and return its claims/deny/logs. Touches no real data.
`GET /v1/actions/bindings/:trigger`	`actions:read`		Read the ordered list of Action ids bound to a trigger.
`PUT /v1/actions/bindings/:trigger`	`actions:write`		Replace the ordered list of Actions bound to a trigger — the single source of truth for what runs, and in what order.

Was this page helpful?

Actions