Authentik Integration via API

Purpose

This guide explains how to generate an API Token in the Authentik admin interface and how to use it in Logsign USO to ingest Authentik audit events (logins, MFA, admin actions, and object changes) for security analytics and forensic purposes.

Authentik exposes its audit trail through a REST Events API rather than syslog. This API poller is the supported way to bring Authentik event data into Logsign USO. Authentik does not offer a native syslog forwarder for its own audit log out of the box, so the API is the only supported path for this data; if you need raw log forwarding for other reasons, that is a separate mechanism unrelated to this integration and is out of scope here.

Prerequisites

The account you use must be an Authentik administrator with access to the Directory section of the admin interface (Users, and Tokens and App passwords). Standard (non-admin) Authentik users cannot create service accounts or tokens.

Authentik is typically self-hosted, so the Base URL is your organization's own Authentik domain (for example https://authentik.yourcompany.com), not a shared vendor domain. Confirm this address with your Authentik administrator before starting.

Step 1: Create a Service Account

1. In the Authentik admin interface, go to Directory > Users.
2. Click Create and select Service Account.
3. Enter a Username (for example, "logsign-integration").
4. Decide whether the initial password/token should expire. If you leave Expiring on, the default expiry is 360 days; you can set a custom date under Expires on, or turn expiry off entirely.
5. Click Create, then copy and store the generated password shown on the confirmation screen (this is separate from the API token you create in Step 2). Click Close.

Step 2: Create an API Token for the Service Account

1. Go to Directory > Tokens and App passwords.
2. Click Create.
3. Enter an Identifier (for example, "logsign-uso-token") so the token is identifiable later.
4. In the User field, select the service account you created in Step 1.
5. Set Intent to API Token (not "App password" — that intent is for username/password style access, not API calls).
6. Click Create and copy the generated token value immediately. Authentik will not show it to you again once you close the panel; if you lose it, you must generate a new one.

By default this token expires after 360 days unless you configured it as non-expiring. There is no automatic renewal from the Logsign side, so plan to rotate it before it lapses.

Step 3: Grant the Service Account Access to Events

A newly created service account has no permissions by default. Add it to a group, or bind it directly, with permission to view Events in the Authentik admin interface (under Directory > Groups, or via role/permission assignment, depending on your Authentik version). The exact minimum permission set for read-only Events API access was not confirmed against Authentik's official documentation during this review — if the token authenticates but every request to the Events endpoint returns 403, this is the first thing to check with your Authentik administrator.

Step 4: Configure the Integration in Logsign USO

After obtaining the Base URL and API Token, log in to Logsign USO and add a new Authentik data source. You will be asked for:

Logsign sends this token as a static Bearer credential on every request (Authorization: Bearer <token>) — unlike some other integrations, there is no OAuth2 exchange or refresh step; the token you paste in is used as-is until it expires or is revoked. Logsign then periodically queries the Authentik Events API (GET /api/v3/events/events/), filtering by the event's created timestamp so no events are skipped or duplicated across polling cycles, and normalizes each event into a Logsign record, including the acting user, source IP, geo location, HTTP request details, and any object that was changed.

Notes and Limits

• The API token is a static credential, not a short-lived access token. It does not auto-refresh. By default it expires after 360 days (configurable to non-expiring at creation time); track its expiry and rotate it in Logsign USO before it lapses, or polling will start failing with authorization errors.
• Authentik's own Events log has a default retention of 365 days (configurable in Authentik's System Settings). If polling is paused for longer than your configured retention window, events from that gap may no longer exist in Authentik when polling resumes.
• Authentik does not publish a documented rate limit for its general API in its official documentation as of this writing; if you encounter throttling, treat any 429 responses as a signal to reduce polling frequency and confirm with your Authentik administrator whether a limit was configured locally.
• This poller only covers the Events (audit log) endpoint. It does not pull user/group/application inventory, flow or policy configuration, or any other Authentik management data — those would require separate connectors.
• If polling stops and the source logs repeated authorization errors, check three things first: whether the token was deleted, rotated, or expired in the Authentik console; whether the service account still has permission to read Events; and whether the Base URL still points to a reachable instance. Generate a fresh token with the correct permissions and update the data source in Logsign USO.
• The exact minimum permission/role required for a service account to read the Events API was not confirmed against Authentik's official documentation; this is called out explicitly in Step 3 and should be verified with your Authentik administrator if you hit 403 responses.