Authenticates a user.

By default (no federated query param) this validates the username and password from the request body via the local PAM/DB credential path and returns a JSON token pair. This is the historical behaviour of this endpoint and is preserved for backward compatibility.

When federated=true, the browser is instead redirected (302) through the OIDC authorization-code flow; the identity broker then routes to the local user / LDAP / SAML flow per its policy. No request body is consumed in this mode. If OIDC is not configured for the deployment, the PAM path is used even when federated=true is supplied.

Refreshes the access token using the refresh token stored in httpOnly cookie. No request body required - refresh token is read from cookie.

Logs out the user by revoking the refresh token stored in httpOnly cookie. No request body required - refresh token is read from cookie.

Change user password using username and password. Can be called either with or without Bearer token:

• With token: User can change their own password
• Without token: Authentication is done with username and password (for expired password scenarios)

Starts the OIDC authorization code flow with PKCE. Returns a 302 redirect to the configured identity provider authorization endpoint.

Supports two content types for the optional idp_type field:

application/x-www-form-urlencoded (recommended for browser forms): idp_type=ldap or idp_type=saml

application/json: {"idp_type": "ldap"} or {"idp_type": "saml"}

When idp_type is ldap or saml, the organization-scoped external login policy is applied so LDAP/SAML IDPs are shown on the login page. Omitting idp_type (or sending an empty body) shows the instance-level login screen.

Authenticates a machine-to-machine (M2M) service user using its client_id/client_secret via the OAuth2 client_credentials grant against the configured identity provider. On success the service user's F5 Insights role is resolved and an F5 Insights access token is returned as JSON.

Unlike the browser login flow, no session cookie is set: the caller supplies the returned access token via the Authorization: Bearer <token> header on subsequent API requests. Service users re-authenticate by calling this endpoint again rather than using a refresh cookie.

The configured identity provider redirects the browser here after successful user authentication. Exchanges the authorization code for tokens, stores them in a server-side session, sets an HttpOnly session cookie, and redirects the browser to the React SPA.

Called by the React SPA after landing on /auth/callback. Reads the HttpOnly session cookie and returns the F5 Insight access token details needed by the SPA.

Returns the authenticated user's F5 Insight role and the permissions granted to that role. Used by the frontend to enable or hide role-based UI actions. Requires authentication.

Returns all available system roles with user counts. Used to populate the role selector when creating or updating a group mapping. Requires admin role.

Returns a single role by its UUID, including its full permission list. Requires admin role.

Returns configured mappings grouped by identity provider and role. Requires admin role.

Returns all provider-scoped grouped mappings for the given role_id. Requires admin role.

Creates or fully replaces the grouped_resource_attribute list for the given provider_id and role_id. Sending an empty grouped_resource_attribute array clears mappings for that provider/role. Requires admin role.

Adds or moves the provided grouped_resource_attribute values to the given provider_id and role_id without removing other values already mapped to that role. Requires admin role.

Deletes the grouped mapping for the given provider_id and role_id. This removes all grouped_resource_attribute values currently mapped to that provider/role pair. Requires admin role.

Returns cached security insights from AIDF including alerts, calculated application scores, deductions, and device findings. Requires AIDF to be configured.

Returns cached workload classification insights from AIDF. Classification traffic statistics are intentionally not exposed by this endpoint. Requires AIDF to be configured.

Returns a paginated, filterable list of AI assistant audit events from ClickHouse. Each row represents one agent action (user message, assistant response, tool call, tool result, error, data access, or PDF export). Requires the audit.read permission. PII fields (ip_address, user_agent, message, tool_arguments, tool_result) are masked unless the caller also holds the audit.view_sensitive permission and passes view_sensitive=true.

Generates a CSV export of audit events matching the supplied filters. For ≤10 000 matching rows the export is generated synchronously and the response includes a download_url. For >10 000 rows the job is queued asynchronously; the response is 202 Accepted with status: processing and a status_url to poll. Exports are cached on disk for 30 minutes and deleted after download. A per-user limit of 5 concurrent exports is enforced.

Streams the CSV file for the given export ID. The file is deleted from the server after a successful download. If the export is still being processed, returns 202. If the export has expired (TTL 30 min), returns 410 Gone.

Returns a list of all backup and restore jobs

Triggers a backup operation. Returns a job ID to track progress.

Compares the most recent completed backup size against the rolling average of the previous 3 completed backups. Returns is_anomalous=true when the latest backup is more than 30% smaller than the rolling average (pct_of_avg < 70).

Returns details of a specific backup job including live progress

Deletes a backup file and its job record

Downloads the backup archive file

Triggers a restore from the specified backup

Upload a backup .tar file from another system without restoring

Import a backup file from a local path or remote storage target. Reads the manifest via platform-manager to validate and extract metadata. Creates a DB record referencing the file location without copying.

Lists rows from backup_restore.backup_files, independent of any specific backup/restore job. Powers the restore job's file-picker UI.

Deletes each requested backup artifact independently. Files that cannot be deleted (for example, because an active restore references them) are returned as failed results without preventing other deletions.

Returns metadata for one stored backup file by its ID.

Deletes an available backup artifact and its metadata. Deletion is rejected while an active restore references the backup file.

Streams an available backup artifact as an attachment.

Returns a paginated list of backup readiness check runs with rollup summaries. Each item contains the run status, device counts, and timestamps — but not the full per-device results. Use GET /backup/readiness/{runId} for the detailed per-device breakdown.

Runs readiness checks against the specified target devices before backup. Every device has adjacent backup_storage_capacity (device backup filesystem) and f5_insight_storage_capacity (local backup store) checks. Both always run and are SOFT (PASS or WARN, never FAIL), so warnings do not block backup. F5 Insight free space is snapshotted once before device checks. Every device receives the same local-store result: WARN when available space is below the total estimate for the entire selection, otherwise PASS (including equality). Devices are ordered by hostname, then device_id; this does not affect storage results. All warnings use the total required for the entire selection, for example: "F5 Insight has 8.00 GB available, but 10.00 GB is required to retain backup files for all the selected instances". Estimates are 2 GiB per BIG-IP and 500 KiB per F5OS-A. Messages use base-1024 GB for BIG-IP and MB for F5OS-A, with two decimals. PASS has no message. A local-space probe failure warns every device with "Unable to determine free space in F5 Insight", with the error in detail. Both results remain present even when device checks fail or error. If local storage setup fails before device checks start, every device completes with status ERROR and only a WARN f5_insight_storage_capacity entry. Device type is inferred from inventory: all targets must be BIGIP or all RSERIES. Mixed or unsupported types, missing devices, and unknown checks return 400. VELOS targets return 400 with "VELOS is not supported". Remote capacity is not checked; backups are always stored locally first.

Returns persisted backup readiness results for a run. devices contains only selected devices, ordered by hostname then device_id. Each device includes backup_storage_capacity and f5_insight_storage_capacity in check_results. Poll until status is no longer PENDING or RUNNING.

List all active (non-expired, non-deleted) conversations for the authenticated user, sorted by most recent message.