For engineers

An API with a console on top.

Every action in the Identify Console is an API call your automation can make too.

Standard protocols

Your apps speak OIDC or SAML 2.0 to standard endpoints. Each tenant gets its own permanent issuer hostname.

Identify is built on Keycloak, the open-source identity server.

API and credentials

The OpenAPI description is generated from the live routes. Operations marked stable are a compatibility promise.

API credentials get the same roles and checks as people. Secrets are shown once, then only rotated.

Get a token, then let the API describe itself

TOKEN=$(curl -s -X POST \
  https://northwind.auth.identify.example/realms/northwind/protocol/openid-connect/token \
  -d grant_type=client_credentials \
  -d client_id=identify-api-ci -d client_secret="$SECRET" | jq -r .access_token)

curl -s -H "Authorization: Bearer $TOKEN" \
  https://northwind.console.identify.example/api/v1/openapi.json

Webhooks

Small, signed notifications that carry identifiers. You read the current state back through the API.

An endpoint that keeps failing suspends itself and says why.

Provisioning over SCIM 2.0

Identify provisions the apps you point it at. It never deletes users, and deactivates nobody after an incomplete read.

Audit export

Stream your full audit log as NDJSON, ready for your SIEM. The stream ends with an eof line, or it isn't finished.

Export, then check the last line

curl -s -H "Authorization: Bearer $TOKEN" \
  https://northwind.console.identify.example/api/v1/audit/export -o audit.ndjson

tail -1 audit.ndjson   # {"type":"eof","rows":85,"cursor":"…"}

How migration works

Users authenticate at Microsoft Entra ID or Google Workspace and are linked by its stable user ID. Their upstream password is never collected.

The second factor follows your policy: TOTP, WebAuthn or a passwordless passkey.

Endpoints, per tenant

OIDC discovery: https://northwind.auth.identify.example/realms/northwind/.well-known/openid-configuration
SAML metadata: https://northwind.auth.identify.example/realms/northwind/protocol/saml/descriptor
OpenAPI: https://northwind.console.identify.example/api/v1/openapi.json

Let's go through it together.

Bring your platform team to the demo. We'll gladly answer the deep questions.

Request a demo