Everything an AI agent can do with the Auth0 API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints28
API versionv2
Last updated23 June 2026
Orientation

How the Auth0 Management API works.

The Auth0 API is how an app or AI agent administers an Auth0 tenant: listing and creating users, assigning roles, registering applications and connections, and searching tenant logs. Access is granted through a machine-to-machine access token whose scopes decide which operations are allowed, and an agent is limited to the tenant and the scopes that token carries. Auth0 can also stream tenant events, like a failed login or a user change, to a chosen destination as they happen.

28Endpoints
8Capability groups
15Read
13Write
20Permissions
Authentication
Every call needs a Management API access token sent as 'Authorization: Bearer '. The token is a signed JWT minted through the OAuth 2.0 client-credentials grant: a machine-to-machine application posts its client id and secret to the tenant's token endpoint with the audience set to the tenant's /api/v2/ path, and receives a token that lasts 24 hours by default. There is no anonymous access to the Management API.
Permissions
The token's scope claim decides which methods are allowed. Scopes are granular and follow a verb:resource shape, such as read:users, create:users, update:users, delete:users, read:roles, create:clients, read:connections, read:organizations, read:logs, read:grants, and read:resource_servers. A few endpoints need more than one scope, like assigning roles to a user, which needs update:users and create:role_members together. Calling a method the token lacks a scope for returns 403 Forbidden.
Versioning
The Management API is at major version v2, called from the tenant's /api/v2/ base path. The previous version, v1, reached end of life on the public cloud on 13 July 2020 and was removed from the private cloud in the November 2020 release. New endpoints and behavior ship continuously through dated release notes rather than minting a new version string.
Data model
The API is resource-oriented JSON over HTTPS at the tenant's own domain, such as https://acme-tenant.us.auth0.com/api/v2/. Core resources are users, roles, clients (applications), connections, organizations, logs, grants, and resource-servers (the tenant's registered APIs). Users carry profile, app_metadata, and user_metadata, and several field-level scopes gate the more sensitive parts. Auth0 also streams tenant log events to external destinations through log streams.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Auth0 determines what it can reach. The main route is a machine-to-machine token whose scopes decide which operations are allowed, and Auth0 publishes an official MCP server on top of the same API.

Ways to connect

Management API (REST)

The Management API answers at the tenant's own domain under the /api/v2/ base path, such as https://acme-tenant.us.auth0.com/api/v2/. Every call sends a machine-to-machine access token as a bearer token, and the token's scopes decide which methods are allowed.

Best forConnecting an app or AI agent to Auth0.
Governed byThe machine-to-machine access token and the scopes it carries.
Docs ↗

MCP server (Model Context Protocol)

Auth0 publishes a first-party MCP server at github.com/auth0/auth0-mcp-server, announced on 2 September 2025. It lets an agent work with applications, APIs, Actions, logs, and Forms through the Management API. It authenticates with the OAuth 2.0 device authorization flow and stores tokens in the operating system keychain, and connects to clients such as Claude Desktop, Cursor, and Windsurf.

Best forConnecting an AI agent to Auth0 through the Model Context Protocol.
Governed byThe device-flow token and the Management API scopes it carries.
Docs ↗

Log streams

Log streams deliver each tenant log event to a chosen destination as it happens, including a custom HTTP webhook, Amazon EventBridge, Azure Event Grid, Datadog, Splunk, and Sumo Logic. Auth0 retries delivery up to three times and recommends log streams for monitoring rather than for a real-time decision in the application's critical path.

Best forReceiving tenant events without polling.
Governed byThe destination configuration and the event filters set on the stream.
Docs ↗
Authentication

Machine-to-machine token (client credentials)

A machine-to-machine application authorized for the Management API uses the OAuth 2.0 client-credentials grant: it posts its client id and secret to the tenant's token endpoint with the audience set to the tenant's /api/v2/ path, and receives a signed JWT access token that lasts 24 hours by default. The token's scopes decide which methods are allowed.

TokenManagement API access token (JWT)
Best forBackend and agent access to administer a tenant
Docs ↗

Device authorization flow (MCP server)

The Auth0 MCP server authenticates a developer through the OAuth 2.0 device authorization flow and stores the resulting token in the operating system keychain. The token then carries the Management API scopes the agent is allowed to use.

TokenDevice-flow access token
Best forConnecting an AI agent through the official MCP server
Docs ↗
Capability map

What an AI agent can do in Auth0.

The Management API is split into areas an agent can act on, such as users, roles, applications, connections, and logs. Each area has its own methods and its own scopes, and some reach far more than others, like resetting a password or deleting a user.

Endpoint reference

Every Auth0 Management API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Users

List and search users, read a single user, and create, update, and delete users in the tenant.5

Searching by a Lucene query uses the q parameter. read:user_idp_tokens is also accepted, but unlocks identity-provider tokens rather than replacing read:users.

Acts onuser
Permission (capability)read:users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

read:user_idp_tokens additionally returns the user's identity-provider tokens.

Acts onuser
Permission (capability)read:users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The user is created in a named connection, such as a database connection.

Acts onuser
Permission (capability)create:users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Changing the app_metadata field additionally needs update:users_app_metadata.

Acts onuser
Permission (capability)update:users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deletion is permanent and removes the account from the tenant.

Acts onuser
Permission (capability)delete:users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Roles

List and read roles, create a role, and assign roles to a user for role-based access control.4

Roles drive role-based access control for users.

Acts onrole
Permission (capability)read:roles
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the role's name, description, and id.

Acts onrole
Permission (capability)read:roles
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Permissions are added to the role in a separate call.

Acts onrole
Permission (capability)create:roles
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

This method needs two scopes together: update:users and create:role_members.

Acts onrole
Permission (capability)update:users
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Applications

List and read clients (applications), and create, update, and delete them.5

read:client_keys and read:client_credentials unlock credential fields rather than replacing read:clients.

Acts onclient
Permission (capability)read:clients
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Credential fields need read:client_keys or read:client_credentials in addition.

Acts onclient
Permission (capability)read:clients
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the new client's id and, for confidential apps, a client secret.

Acts onclient
Permission (capability)create:clients
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Changing the client secret or signing key additionally needs update:client_keys.

Acts onclient
Permission (capability)update:clients
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deletion removes the application and breaks any integration using it.

Acts onclient
Permission (capability)delete:clients
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Connections

List and read connections to identity providers, and create a connection.3

A connection links the tenant to an identity provider, such as a database or a social login.

Acts onconnection
Permission (capability)read:connections
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the strategy and the provider-specific options for the connection.

Acts onconnection
Permission (capability)read:connections
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The strategy field sets the kind of provider the connection uses.

Acts onconnection
Permission (capability)create:connections
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Organizations

List and read organizations, create an organization, and add members to one.4

read:organizations_summary returns a lighter summary view of each organization.

Acts onorganization
Permission (capability)read:organizations
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

read:organizations_summary returns a lighter summary view.

Acts onorganization
Permission (capability)read:organizations
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

An organization groups members and the connections enabled for them.

Acts onorganization
Permission (capability)create:organizations
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Members are referenced by user id and must already exist in the tenant.

Acts onorganization
Permission (capability)create:organization_members
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Logs

Search tenant log events and read a single log event by id.2

read:logs_users additionally returns log detail tied to specific users. Large result sets are best read with checkpoint pagination.

Acts onlog event
Permission (capability)read:logs
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

read:logs_users additionally returns user-linked detail.

Acts onlog event
Permission (capability)read:logs
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Grants

List the authorization grants on the tenant and delete a grant.2

A grant records the access a user gave to an application.

Acts ongrant
Permission (capability)read:grants
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deleting a grant revokes the application's access for that user.

Acts ongrant
Permission (capability)delete:grants
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

APIs (resource servers)

List and read the tenant's registered APIs, and create a new one.3

A resource server is an API that tokens can be issued for.

Acts onresource server
Permission (capability)read:resource_servers
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the API's identifier, scopes, and token settings.

Acts onresource server
Permission (capability)read:resource_servers
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The identifier field, usually a URL, names the API that tokens are issued for.

Acts onresource server
Permission (capability)create:resource_servers
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Auth0 can stream tenant events to an app or AI agent instead of the app repeatedly asking. Log streams deliver each log event, such as a successful or failed login, a signup, or a Management API change, to an HTTP endpoint or a partner destination as it happens.

EventWhat it signalsTriggered by
Authentication eventsFires on sign-in activity, such as a successful login, a failed login, a logout, a signup, a silent authentication, or a token exchange.In-app only
Management API eventsFires when a Management API operation succeeds or fails, such as a user, role, or application change.In-app only
User and behavioral eventsFires on account-level activity, such as a user account change, device authorization, or single sign-on.In-app only
Actions eventsFires for events raised by Auth0 Actions, the custom code run at points in a flow.In-app only
System eventsFires for tenant-level system activity that is not tied to a single user sign-in.In-app only
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Auth0 limits how fast an app or AI agent can call the Management API through a token-bucket model that varies by tenant type and subscription level, returning a 429 when a bucket is empty.

Request rate

Auth0 limits the Management API with a token-bucket model: each bucket has a maximum size, which sets how large a burst is allowed, and a refill rate, which sets the steady pace of requests. The applicable limits vary by API, by tenant type (production versus development or staging), and by subscription level (Free, Essential, Professional, Enterprise, and the private-cloud tiers). Every response carries three headers that report the current state: x-ratelimit-limit (the maximum requests available), x-ratelimit-remaining (how many remain before the bucket refills), and x-ratelimit-reset (a UNIX timestamp for when requests are added back). Exceeding a bucket returns HTTP 429 Too Many Requests, at which point a client should back off until the reset time.

Pagination

List endpoints use offset pagination through the page parameter, which is zero-based, and the per_page parameter, which tops out at 100. Adding include_totals=true wraps the results in an object with start, limit, length, and total counts instead of returning a bare array. Large datasets, such as users and logs, can use checkpoint pagination instead, a forward-only cursor through the from and take parameters that avoids the deep-paging limits of offset paging. The user-search endpoint never returns more than 1,000 users for the same query, even across pages.

Request size

Requests and responses are JSON and must be sent with a Content-Type of application/json. There is no single documented payload size limit across the whole API. The main bound on response size is the per_page cap of 100 results and the 1,000-result ceiling on user search.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe request is malformed or a parameter is missing or invalid.Correct the request body or parameters and resend.
401UnauthorizedThe Management API access token is missing, invalid, or expired.Mint a fresh token through the client-credentials grant and send it in the Authorization header.
403ForbiddenThe token is valid but its scopes do not allow the requested operation.Authorize the machine-to-machine application for the missing scope, then mint a new token.
404Not FoundThe resource does not exist, or the token cannot see it.Confirm the id and that the token has access to the resource.
429Too Many RequestsA rate-limit bucket was exhausted. The x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset headers report the current state.Read x-ratelimit-reset and back off until requests are added back to the bucket.
Versioning & freshness

Version history.

Auth0 versions the Management API by major number. The current version is v2, and the older v1 reached end of life in 2020. New endpoints and changes ship continuously through dated release notes rather than a new version string.

Version history

What changed, and when

Latest versionv2
v2Current version
Management API v2 (current)

v2 is the current Management API, called from the tenant's /api/v2/ base path. It replaced v1, which reached end of life on the public cloud on 13 July 2020 and was removed from the private cloud in the November 2020 release. Additive changes ship continuously through Auth0's dated release notes rather than a new version string.

What changed
  • Authenticated with a machine-to-machine access token whose scopes decide the allowed operations
  • Granular verb:resource scopes, such as read:users, create:clients, and delete:grants
  • Offset and checkpoint pagination across list endpoints
2026-06-22Feature update
Refresh token metadata generally available

Refresh token metadata reached general availability, adding endpoints to read, update, and delete a single refresh token by id. It was published on Monday 22 June 2026.

What changed
  • GET, PATCH, and DELETE /api/v2/refresh-tokens/{id} reached general availability
2026-06-11Feature update
Improved refresh token management (early access)

An early-access release added bulk refresh-token management, including listing refresh tokens and revoking up to 100 by id in one call. It was published on Thursday 11 June 2026.

What changed
  • Added GET /api/v2/refresh-tokens to list refresh tokens
  • Added POST /api/v2/refresh-tokens/revoke to revoke up to 100 tokens at once
2026-02-10Feature update
Session metadata generally available

Session metadata reached general availability, adding endpoints to read and update a single session by id. It was published on Tuesday 10 February 2026.

What changed
  • GET and PATCH /api/v2/sessions/{id} reached general availability
2020-07-13Requires migration
Management API v1 end of life

Management API v1 reached end of life on the public cloud on 13 July 2020 and was removed from the private cloud in the November 2020 release, leaving v2 as the only supported version.

What changed
  • v1 retired on the public cloud on 13 July 2020
  • v1 removed from the private cloud in the November 2020 release

An integration calls the v2 base path and picks up additive changes through the changelog.

Auth0 changelog ↗
Questions

Auth0 Management API, answered.

How does an agent authenticate to the Management API?+
With a Management API access token, which is a signed JWT. A machine-to-machine application authorized for the Management API uses the OAuth 2.0 client-credentials grant: it posts its client id and secret to the tenant's token endpoint with the audience set to the tenant's /api/v2/ path, and gets back a bearer token that lasts 24 hours by default. That token goes in the Authorization header on every call. There is no anonymous access.
How do scopes work, and what happens if one is missing?+
Each token carries a scope claim listing the operations it is allowed to perform, using granular verb:resource scopes such as read:users, create:clients, or delete:grants. The scopes are decided when the machine-to-machine application is authorized for the Management API. If a call needs a scope the token does not hold, Auth0 returns 403 Forbidden. A few methods need more than one scope at once, like assigning roles to a user, which needs update:users and create:role_members.
What are the rate limits?+
Auth0 uses a token-bucket model, where a bucket has a maximum size for bursts and a refill rate for the steady pace. The exact limits depend on the API, the tenant type (production versus development or staging), and the subscription level. Every response reports the state through the x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset headers, and going over a bucket returns HTTP 429 Too Many Requests. A client should read x-ratelimit-reset and back off until then.
How does an agent receive events instead of polling?+
Through log streams. A log stream delivers each tenant log event, such as a successful or failed login, a signup, or a Management API change, to a destination as it is triggered, including a custom HTTP webhook, Amazon EventBridge, Azure Event Grid, Datadog, Splunk, and Sumo Logic. Auth0 retries delivery up to three times and recommends log streams for monitoring and analytics rather than for a real-time decision in the application's critical path.
Does Auth0 have an official MCP server?+
Yes. Auth0 publishes a first-party Model Context Protocol server at github.com/auth0/auth0-mcp-server, announced on 2 September 2025. It lets an AI agent work with applications, APIs (resource servers), Actions, logs, and Forms through the Management API, and it authenticates with the OAuth 2.0 device authorization flow, storing tokens in the operating system keychain. It connects to clients such as Claude Desktop, Cursor, and Windsurf.
How does pagination work?+
List endpoints take the page parameter, which is zero-based, and the per_page parameter, which tops out at 100. Setting include_totals=true returns the results inside an object with total counts rather than a bare array. For large datasets like users and logs, checkpoint pagination is the better choice: a forward-only cursor using the from and take parameters that avoids the limits of deep offset paging. User search caps at 1,000 results for the same query.
What is the difference between v1 and v2?+
v2 is the current Management API and the only one to build against. v1 reached end of life on the public cloud on 13 July 2020 and was removed from the private cloud in the November 2020 release, so it should not be used. v2 is called from the tenant's /api/v2/ base path, and new endpoints and changes arrive through Auth0's dated release notes rather than a new version number.
Related

More security API guides for agents

What is Bollard AI?

Control what every AI agent can do in Auth0.

Bollard AI sits between a team's AI agents and Auth0. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Auth0 token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Auth0
Identity Agent
Read users ResourceOffReadFull use
Read tenant logs ResourceOffReadFull use
Delete a user ActionOffReadFull use
Create applications ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Auth0