Trigger federation reconciliation

POST

/api/v1/federation/group-mappings/sync

const url = 'http://localhost:3000/api/v1/federation/group-mappings/sync';
const options = {method: 'POST', headers: {'X-API-Key': '<X-API-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/api/v1/federation/group-mappings/sync \
  --header 'X-API-Key: <X-API-Key>'

Runs a full reconciliation of federated memberships against the last-known Entra attributes stored in Keycloak, applying the currently-configured group mappings. Does NOT poll Entra (login remains authoritative for the cloud OIDC path). Returns aggregated counts. Requires Super Admin privileges.

Authorizations

api-key
bearer

Responses

200

Reconciliation completed

application/json

object

usersProcessed

required

Number of brokered Keycloak users mapped to a WFM user and reconciled

number

added

required

Total FEDERATED memberships created

number

updated

required

Total memberships whose role changed

number

removed

required

Total FEDERATED memberships removed

number

skipped

required

Number of Keycloak users skipped (no WFM user, no Entra attributes, or a per-user error)

number

Example

{
  "usersProcessed": 42,
  "added": 3,
  "updated": 1,
  "removed": 2,
  "skipped": 5
}

401

Unauthorized

403

Forbidden - Super Admin required