Connectors · Identity & security

Keycloak Admin REST API MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Keycloak Admin REST API and the rest of your systems. It gives your agent 409 Keycloak Admin REST API actions (213 reads, 122 writes and 74 that wait for a confirmation) and holds the Keycloak Admin REST API credential itself, so the agent never does. It paces Keycloak Admin REST API's limits and records every call.

Connect Keycloak Admin REST API free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

the first call

do {  action: "keycloak_admin.realms.list",  intent: "check which Keycloak Admin REST API account is connected"}# Get accessible realms Returns a list of accessible realms. The list is filtered based on what realms the caller is allowed to view. · read · 1 upstream call

409actionsin one signed file
213readlook, never change
122writecreate and update
74wait for a yesdestructive, confirmed first

Set up

Connect Keycloak Admin REST API in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Keycloak Admin REST API.
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.
- client_idClient ID of a confidential Keycloak client with Client authentication and Service accounts enabled (Clients >…
- client_secretClient secret of that client (Clients > the client > Credentials)
- auth_realmYour Keycloak Admin REST API auth realm
- context_pathYour Keycloak Admin REST API context path
- tenant_hostWhere your Keycloak Admin REST API lives: your tenant host
```
account { op: "connections.requirements", service: "keycloak_admin" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "keycloak_admin.realms.list" }# get accessible realms returns a list of accessible realms. the list is filtered based on what realms the caller is allowed to view. · read · 1 upstream callcheck { action: "keycloak_admin.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Keycloak Admin REST API at a glance

Sign-in: OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide: client_idclient_secret
Setup fields: auth_realmcontext_pathtenant_host
Limits we pace to: 20 calls a second, per connection
API covered: Keycloak Admin REST API (OpenAPI 3.0.3, latest release docs), at your Keycloak Admin REST API instance's API base URL, which you enter when connecting
Built from: Keycloak Admin REST API's documentation, read 23 October 2026keycloak.org keycloak.org
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 200 of 213 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 4, so ask can line Keycloak Admin REST API up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Keycloak Admin REST API.

409 actions in 227 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

213readlook, never change
122writecreate and update
74destructivewait for a confirmation

Localization
6
2 read · 2 write · 2 destructive
Import localization from uploaded JSON file · localization.list · localization.get · localization_texts.update
Authentication flows
5
2 read · 2 write · 1 destructive
Create a new authentication flow · Get authentication flows Returns a stream of authentication flows. · Get authentication flow for id · Update an authentication flow
Client authz resource server resource
5
2 read · 2 write · 1 destructive
client_authz_resource_server_resource.create · client_authz_resource_server_resource.list · client_authz_resource_server_resource.get · client_authz_resource_server_resource.update
Client authz resource server scope
5
2 read · 2 write · 1 destructive
client_authz_resource_server_scope.create · client_authz_resource_server_scope.list · client_authz_resource_server_scope.get · client_authz_resource_server_scope.update
Client protocol mappers models
5
2 read · 2 write · 1 destructive
Create a mapper · Get mappers · Get mapper by id · Update the mapper
Client roles
5
2 read · 2 write · 1 destructive
Create a new role for the realm or client · Get all roles for the realm or client · Get a role by name · Update a role by name
Client scope protocol mappers models
5
2 read · 2 write · 1 destructive
Create a mapper · Get mappers · Get mapper by id · Update the mapper
Client scopes
5
2 read · 2 write · 1 destructive
Create a new client scope Client Scope’s name must be unique! · Get client scopes belonging to the realm Returns a list of client scopes belonging to the realm · Get representation of the client scope · Update the client scope

112 more areas · 368 actions

Client template protocol mappers models 5
Client templates 5
Clients 5
Components 5
Groups 5
Identity provider instances 5
Identity provider mappers 5
Organization groups 5
Organization identity providers 5
Organizations 5
Realm 5
Roles 5
Users 5
Workflows 5
Authentication config 4
Authentication required actions 4
Organization members 4
Attack detection brute force users 3
Authentication executions 3
Authentication required action config 3
Client default client scopes 3
Client optional client scopes 3
Client role composites 3
Client scope mappings clients 3
Client scope mappings realm 3
Client scope scope mappings clients 3
Client scope scope mappings realm 3
Client template scope mappings clients 3
Client template scope mappings realm 3
Clients initial access 3
Default default client scopes 3
Default groups 3
Default optional client scopes 3
Group role mappings clients 3
Group role mappings realm 3
Organization group members 3
Organization group role mappings clients 3
Organization group role mappings realm 3
Organization invitations 3
Role composites 3
Roles by id 3
Roles by id composites 3
User federated identity 3
User groups 3
User role mappings clients 3
User role mappings realm 3
Admin events 2
Authentication execution config 2
Authentication flow executions 2
Client authz resource server 2
Client authz resource server permission 2
Client authz resource server policy 2
Client client secret 2
Client client secret rotated 2
Client management permissions 2
Client nodes 2
Client policies policies 2
Client policies profiles 2
Client role management permissions 2
Client types 2
Events 2
Events config 2
Group children 2
Group management permissions 2
Identity provider management permissions 2
Organization group children 2
Role management permissions 2
Roles by id management permissions 2
User consents 2
User credentials 2
Users management permissions 2
Users profile 2
Authentication authenticator providers 1
Authentication client authenticator providers 1
Authentication config description 1
Authentication execution lower priority 1
Authentication execution raise priority 1
Authentication flow copy 1
Authentication flow executions execution 1
Authentication flow executions flow 1
Authentication form action providers 1
Authentication form providers 1
Authentication per client config description 1
Authentication register required action 1
Authentication required action config description 1
Authentication required action lower priority 1
Authentication required action raise priority 1
Authentication unregistered required actions 1
Client authz resource server import 1
Client authz resource server permission evaluate 1
Client authz resource server permission providers 1
Client authz resource server permission search 1
Client authz resource server policy evaluate 1
Client authz resource server policy providers 1
Client authz resource server policy search 1
Client authz resource server resource attributes 1
Client authz resource server resource permissions 1
Client authz resource server resource scopes 1
Client authz resource server resource search 1
Client authz resource server scope permissions 1
Client authz resource server scope resources 1
Client authz resource server scope search 1
Client authz resource server settings 1
Client certificate generate 1
Client certificates 1
Client description converter 1
Client evaluate scopes generate example access token 1
Client evaluate scopes generate example id token 1
Client evaluate scopes generate example saml response 1
Client evaluate scopes generate example userinfo 1
Client evaluate scopes protocol mappers 1
108 smaller areas 108

Top actions

The Keycloak Admin REST API API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 34 of Keycloak Admin REST API's 34 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`keycloak_admin.users.list`Get users Returns a stream of users, filtered according to query parameters.	Get users Returns a stream of users, filtered according to query parameters.	read	`identity.user.list`474 connectors
`keycloak_admin.groups.list`Get group hierarchy. Only `name` and `id` are returned. `subGroups` are only returned when using the `search` or `q` parameter. If none of these parameters is provided, the top-level groups are retur…	Get group hierarchy. Only `name` and `id` are returned. `subGroups` are only returned when using the `search` or `q` parameter. If none of these parameters is…	read	`identity.group.list`262 connectors
`keycloak_admin.roles.list`Get all roles for the realm or client	Get all roles for the realm or client.	read	`identity.role.list`184 connectors
`keycloak_admin.users.create`Create a new user Username must be unique.	Create a new user Username must be unique.	write	`identity.user.create`262 connectors
`keycloak_admin.clients.list`Get clients belonging to the realm.	Get clients belonging to the realm.	read	`identity.application.list`37 connectors
`keycloak_admin.groups.create`create or add a top level realm groupSet or create child.	create or add a top level realm groupSet or create child.	write	`identity.group.create`205 connectors
`keycloak_admin.roles.create`Create a new role for the realm or client	Create a new role for the realm or client.	write	`identity.role.create`105 connectors
`keycloak_admin.users.delete`Delete the user	Delete the user.	destructive	`identity.user.delete`253 connectors
`keycloak_admin.clients.create`Create a new client Client’s client_id must be unique!	Create a new client Client’s client_id must be unique!.	write	`identity.application.create`27 connectors
`keycloak_admin.group_members.list`Get users Returns a stream of users, filtered according to query parameters	Get users Returns a stream of users, filtered according to query parameters.	read	`identity.group_member.list`103 connectors
`keycloak_admin.admin_events.list`Get admin events Returns all admin events, or filters events based on URL query parameters listed here	Get admin events Returns all admin events, or filters events based on URL query parameters listed here.	read	`identity.audit_event.list`51 connectors
`keycloak_admin.organization_invitations.list`Get invitations for the organization	Get invitations for the organization.	read	`identity.invitation.list`33 connectors

Try it

Prompts to paste into Claude.

Each one names the Keycloak Admin REST API actions it will call, so you know what it reads and what it changes before you send it.

Readread
Who has access in Keycloak Admin REST API? List every user and their role.
callskeycloak_admin.users.list
Writewrite
Create a new user Username must be unique in Keycloak Admin REST API. Show me exactly what you will send before you save it.
callskeycloak_admin.users.create

Governance for Keycloak Admin REST API

Destructive actions wait for a yes.

74 Keycloak Admin REST API actions are destructive. The first 10:

Delete the userkeycloak_admin.users.delete
groups.deletekeycloak_admin.groups.delete
Delete a role by namekeycloak_admin.roles.delete
Delete the clientkeycloak_admin.clients.delete
Delete the identity providerkeycloak_admin.identity_provider_instances.delete
Delete all eventskeycloak_admin.events.clear
Remove all user sessions associated with the user Also send notification to all clients that have an admin URL to invalidate the sessions for the particular user.keycloak_admin.users.logout
Delete the realmkeycloak_admin.realms.delete
Remove a specific user session.keycloak_admin.sessions.delete
Delete workflowkeycloak_admin.workflows.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dokeycloak_admin.users.deleteconfirm_policy: human

Delete the user?

intent: the user asked me to delete the user

run suspended · waiting for a named person · key keycloak-admin-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "keycloak-admin-agent",  allowed_actions: ["keycloak_admin.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "keycloak_admin.users.delete", approver: "[email protected]" },    { match: "keycloak_admin.groups.delete", approver: "[email protected]" },    { match: "keycloak_admin.roles.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Keycloak Admin REST API only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Keycloak Admin REST API costs on actionlake.

Every Keycloak Admin REST API action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Keycloak Admin REST API refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 409 Keycloak Admin REST API actions
409actions pageeach page of a long list is one call
200reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Keycloak Admin REST API action.

409 actions by area: the id your agent calls, what it does, and its effect.

Localization6

keycloak_admin.localization.createImport localization from uploaded JSON filewrite
keycloak_admin.localization.getlocalization.getread
and 4 more in this area

Authentication flows5

keycloak_admin.authentication_flows.createCreate a new authentication flowwrite
keycloak_admin.authentication_flows.getGet authentication flow for idread
and 3 more in this area

Client authz resource server resource5

keycloak_admin.client_authz_resource_server_resource.createclient_authz_resource_server_resource.createwrite
keycloak_admin.client_authz_resource_server_resource.getclient_authz_resource_server_resource.getread
and 3 more in this area

Client authz resource server scope5

keycloak_admin.client_authz_resource_server_scope.createclient_authz_resource_server_scope.createwrite
keycloak_admin.client_authz_resource_server_scope.getclient_authz_resource_server_scope.getread
and 3 more in this area

Client protocol mappers models5

keycloak_admin.client_protocol_mappers_models.createCreate a mapperwrite
keycloak_admin.client_protocol_mappers_models.getGet mapper by idread
and 3 more in this area

Client roles5

keycloak_admin.client_roles.createCreate a new role for the realm or clientwrite
keycloak_admin.client_roles.getGet a role by nameread
and 3 more in this area

Client scope protocol mappers models5

keycloak_admin.client_scope_protocol_mappers_models.createCreate a mapperwrite
keycloak_admin.client_scope_protocol_mappers_models.getGet mapper by idread
and 3 more in this area

Client scopes5

keycloak_admin.client_scopes.createCreate a new client scope Client Scope’s name must be unique!write
keycloak_admin.client_scopes.getGet representation of the client scoperead
and 3 more in this area

Client template protocol mappers models5

keycloak_admin.client_template_protocol_mappers_models.createCreate a mapperwrite
keycloak_admin.client_template_protocol_mappers_models.getGet mapper by idread
and 3 more in this area

Client templates5

keycloak_admin.client_templates.createCreate a new client scope Client Scope’s name must be unique!write
keycloak_admin.client_templates.getGet representation of the client scoperead
and 3 more in this area

Clients5

keycloak_admin.clients.createCreate a new client Client’s client_id must be unique!write
keycloak_admin.clients.getGet representation of the clientread
and 3 more in this area

Components5

keycloak_admin.components.createcomponents.createwrite
keycloak_admin.components.getcomponents.getread
and 3 more in this area

Groups5

keycloak_admin.groups.createcreate or add a top level realm groupSet or create child.write
keycloak_admin.groups.getgroups.getread
and 3 more in this area

Identity provider instances5

keycloak_admin.identity_provider_instances.createCreate a new identity providerwrite
keycloak_admin.identity_provider_instances.getGet the identity providerread
and 3 more in this area

Identity provider mappers5

keycloak_admin.identity_provider_mappers.createAdd a mapper to identity providerwrite
keycloak_admin.identity_provider_mappers.getGet mapper by id for the identity providerread
and 3 more in this area

Organization groups5

keycloak_admin.organization_groups.createCreates a new top-level group or moves an existing group to top-levelwrite
keycloak_admin.organization_groups.getGet organization group representationread
and 3 more in this area

Organization identity providers5

keycloak_admin.organization_identity_providers.createAdds the identity provider with the specified id to the organizationwrite
keycloak_admin.organization_identity_providers.getReturns the identity provider associated with the organization that has the specified aliasread
and 3 more in this area

Organizations5

keycloak_admin.organizations.createCreates a new organizationwrite
keycloak_admin.organizations.getReturns the organization representationread
and 3 more in this area

Realm5

keycloak_admin.realms.createImport a realm. Imports a realm from a full representation of that realm.write
keycloak_admin.realms.getGet the top-level representation of the realm It will not include nested information like User and Client representations.read
and 3 more in this area

Roles5

keycloak_admin.roles.createCreate a new role for the realm or clientwrite
keycloak_admin.roles.getGet a role by nameread
and 3 more in this area

Users5

keycloak_admin.users.createCreate a new user Username must be unique.write
keycloak_admin.users.getGet representation of the userread
and 3 more in this area

Workflows5

keycloak_admin.workflows.createCreate workflowwrite
keycloak_admin.workflows.getGet workflowread
and 3 more in this area

Authentication config4

keycloak_admin.authentication_config.createCreate new authenticator configurationwrite
keycloak_admin.authentication_config.deleteDelete authenticator configurationdestructive
and 2 more in this area

Authentication required actions4

keycloak_admin.authentication_required_actions.deleteDelete required actiondestructive
keycloak_admin.authentication_required_actions.getGet required action for aliasread
and 2 more in this area

Organization members4

keycloak_admin.organization_members.createAdds the user with the specified id as a member of the organizationwrite
keycloak_admin.organization_members.deleteRemoves the user with the specified id from the organizationdestructive
and 2 more in this area

Attack detection brute force users3

keycloak_admin.brute_force_users.clearClear any user login failures for the user This can release temporary disabled userdestructive
keycloak_admin.brute_force_users.clear_allClear any user login failures for all users This can release temporary disabled usersdestructive
and 1 more in this area

Authentication executions3

keycloak_admin.authentication_executions.createAdd new authentication executionwrite
keycloak_admin.authentication_executions.deleteDelete executiondestructive
and 1 more in this area

Authentication required action config3

keycloak_admin.authentication_required_action_config.deleteDelete RequiredAction configurationdestructive
keycloak_admin.authentication_required_action_config.getGet RequiredAction configurationread
and 1 more in this area

Client default client scopes3

keycloak_admin.client_default_client_scopes.deleteclient_default_client_scopes.deletedestructive
keycloak_admin.client_default_client_scopes.listGet default client scopes. Only name and ids are returned.read
and 1 more in this area

Client optional client scopes3

keycloak_admin.client_optional_client_scopes.deleteclient_optional_client_scopes.deletedestructive
keycloak_admin.client_optional_client_scopes.listGet optional client scopes. Only name and ids are returned.read
and 1 more in this area

Client role composites 3Client scope mappings clients 3Client scope mappings realm 3Client scope scope mappings clients 3Client scope scope mappings realm 3Client template scope mappings clients 3Client template scope mappings realm 3Clients initial access 3Default default client scopes 3Default groups 3Default optional client scopes 3Group role mappings clients 3Group role mappings realm 3Organization group members 3Organization group role mappings clients 3Organization group role mappings realm 3Organization invitations 3Role composites 3Roles by id 3Roles by id composites 3User federated identity 3User groups 3User role mappings clients 3User role mappings realm 3Admin events 2Authentication execution config 2Authentication flow executions 2Client authz resource server 2Client authz resource server permission 2Client authz resource server policy 2Client client secret 2Client client secret rotated 2Client management permissions 2Client nodes 2Client policies policies 2Client policies profiles 2Client role management permissions 2Client types 2Events 2Events config 2Group children 2Group management permissions 2Identity provider management permissions 2Organization group children 2Role management permissions 2Roles by id management permissions 2User consents 2User credentials 2Users management permissions 2Users profile 2Authentication authenticator providers 1Authentication client authenticator providers 1Authentication config description 1Authentication execution lower priority 1Authentication execution raise priority 1Authentication flow copy 1Authentication flow executions execution 1Authentication flow executions flow 1Authentication form action providers 1Authentication form providers 1Authentication per client config description 1Authentication register required action 1Authentication required action config description 1Authentication required action lower priority 1Authentication required action raise priority 1Authentication unregistered required actions 1Client authz resource server import 1Client authz resource server permission evaluate 1Client authz resource server permission providers 1Client authz resource server permission search 1Client authz resource server policy evaluate 1Client authz resource server policy providers 1Client authz resource server policy search 1Client authz resource server resource attributes 1Client authz resource server resource permissions 1Client authz resource server resource scopes 1Client authz resource server resource search 1Client authz resource server scope permissions 1Client authz resource server scope resources 1Client authz resource server scope search 1Client authz resource server settings 1Client certificate generate 1Client certificates 1Client description converter 1Client evaluate scopes generate example access token 1Client evaluate scopes generate example id token 1Client evaluate scopes generate example saml response 1Client evaluate scopes generate example userinfo 1Client evaluate scopes protocol mappers 1108 smaller areas 108

This index shows a sample of each area. All 409 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.

Questions

The Keycloak Admin REST API MCP server, answered.

Is there a Keycloak Admin REST API MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 409 Keycloak Admin REST API actions across localization, authentication flows, client authz resource server resource and client authz resource server scope, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Keycloak Admin REST API.

What do I need to connect Keycloak Admin REST API?

Client ID of a confidential Keycloak client with Client authentication and Service accounts enabled (Clients >… and Client secret of that client (Clients > the client > Credentials). Plus your auth realm, your context path and your tenant host. The free call account { op: "connections.requirements", service: "keycloak_admin" } lists exactly what to paste.

Can an AI agent delete or change things in Keycloak Admin REST API?

Only if its key allows it, and only with an explicit confirmation. 74 Keycloak Admin REST API actions are destructive, including delete the user, groups.delete and delete a role by name. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Keycloak Admin REST API API limit?

actionlake paces every call to the limits in the Keycloak Admin REST API service file: 20 calls a second per connection. Repeated reads are answered from cache (200 Keycloak Admin REST API actions can be), which never reaches Keycloak Admin REST API.

What does a Keycloak Admin REST API action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (409 Keycloak Admin REST API actions page). Cache hits, searches, dry runs and calls Keycloak Admin REST API refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Keycloak Admin REST API API does it cover?

The Keycloak Admin REST API (OpenAPI 3.0.3, latest release docs) at your Keycloak Admin REST API instance's API base URL, which you enter when connecting. It is built from Keycloak Admin REST API's documentation as read on 23 October 2026. 409 actions in 227 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Keycloak Admin REST API data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Keycloak Admin REST API credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Keycloak Admin REST API today.

Connect Keycloak Admin REST API free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Keycloak Admin REST API MCP server for AI agents.

Connect Keycloak Admin REST API in three steps.

Add actionlake to Claude.

Connect Keycloak Admin REST API.

Make the first call. Check before a write.

What an AI agent can do in Keycloak Admin REST API.

Localization

Authentication flows

Client authz resource server resource

Client authz resource server scope

Client protocol mappers models

Client roles

Client scope protocol mappers models

Client scopes