keycloak · mposolda · Jun 25, 2025 · Jun 25, 2025
@@ -17,7 +17,6 @@
 
 package org.keycloak.admin.client.resource;
 
-import jakarta.ws.rs.QueryParam;
 import org.keycloak.representations.KeyStoreConfig;
 import org.keycloak.representations.idm.CertificateRepresentation;
 
@@ -80,7 +79,8 @@ public interface ClientAttributeCertificateResource {
     /**
      * Get a keystore file for the client, containing private key and public certificate
      *
-     * @param config Keystore configuration as JSON
+     * @param config Keystore configuration as JSON. Parameters "keySize" and "validity" of the config are supported since Keycloak 26.3. Key size is 4096 by default and validity is 3 years by default.
+     *               For older versions than Keycloak 26.3, the key size is 2048 and validity is 10 years.
      * @return
      */
     @POST

@@ -30,15 +30,41 @@
  */
 public interface ClientScopeEvaluateResource {
 
+    /**
+     * Generate example access token
+     *
+     * @param scopeParam Value of the "scope" parameter. Endpoint simulates generating of the access-token as if the "scope" parameter with specified value is used. Could be null.
+     * @param userId User ID
+     * @param audience Value of the "audience" parameter. Endpoint simulates generating of the access-token as if the "audience" parameter with specified value is used. Audience parameter is supported
+     *                 just for some grants (EG. for the token exchange). For most of the grants where "audience" parameter is not supported, it is better to use the value null to simulate generating of the appropriate token.
+     *                 Parameter is supported since Keycloak 26.2.
+     * @return generated access token
+     */
     @GET
     @Path("generate-example-access-token")
     AccessToken generateAccessToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId, @QueryParam("audience") String audience);
 
+    /**
+     * Generate example ID token
+     *
+     * @param scopeParam Value of the "scope" parameter. Endpoint simulates generating of the ID-token as if the "scope" parameter with specified value is used. Could be null.
+     * @param userId User ID
+     * @param audience Value of the "audience" parameter. Endpoint simulates generating of the access-token as if the "audience" parameter with specified value is used. Audience parameter is supported
+     *                 just for some grants (EG. for the token exchange). For most of the grants where "audience" parameter is not supported, it is better to use the value null to simulate generating of the appropriate token.
+     *                 Parameter is supported since Keycloak 26.2.
+     * @return generated ID token
+     */
     @GET
     @Path("generate-example-id-token")
     IDToken generateExampleIdToken(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId, @QueryParam("audience") String audience);
 
-
+    /**
+     * Generate example user-info response
+     *
+     * @param scopeParam  Value of the "scope" parameter. Endpoint simulates generating of the user-info as if the "scope" parameter with specified value is used for generating the access-token, which would then be used for the user-info request. Could be null.
+     * @param userId User ID
+     * @return generated user-info
+     */
     @GET
     @Path("generate-example-userinfo")
     Map<String, Object> generateExampleUserinfo(@QueryParam("scope") String scopeParam, @QueryParam("userId") String userId);

@@ -108,7 +108,7 @@ public interface GroupResource {
      * @param briefRepresentation if {@code true}, each returned subgroup representation will only contain basic information
      *                           (id, name, path, and parentId). If {@code false}, the complete representations of the subgroups
      *                            are returned (include role mappings and attributes).
-     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true.
+     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true. Parameter supported since Keycloak 26.3. For older versions, it is always true.
      */
     @GET
     @Path("children")
@@ -154,7 +154,7 @@ List<GroupRepresentation> getSubGroups(
      * @param briefRepresentation if {@code true}, each returned subgroup representation will only contain basic information
      *                           (id, name, path, and parentId). If {@code false}, the complete representations of the subgroups
      *                            are returned (including role mappings and attributes).
-     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true.
+     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true. Parameter supported since Keycloak 26.3. For older versions, it is always true.
      */
     @GET
     @Path("children")

@@ -92,7 +92,7 @@ List<GroupRepresentation> groups(@QueryParam("search") String search,
      * @param briefRepresentation if {@code true}, each returned group representation will only contain basic information
      *                            (id, name, path, and parentId). If {@code false}, the complete representations of the groups
      *                            are returned (including role mappings and attributes).
-     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true.
+     * @param subGroupsCount if {@code true}, the count of subgroups is returned for each subgroup. Defaults to true. Parameter supported since Keycloak 26.3. For older versions, it is always true.
      * @return A list containing the slice of all groups.
      */
     @GET

@@ -48,6 +48,18 @@ public interface OrganizationMemberResource {
     @Path("organizations")
     @GET
     @Produces(MediaType.APPLICATION_JSON)
+    List<OrganizationRepresentation> getOrganizations();
+
+    /**
+     * Returns the organizations associated with the user
+     *
+     * @param briefRepresentation if false, return the full representation. Otherwise, only the basic fields are returned. It is true by default. Parameter supported since Keycloak 26.3. It is assumed to be false for the older Keycloak server versions.
+     * @since Keycloak server 26
+     * @return the organizations associated with the user
+     */
+    @Path("organizations")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
     List<OrganizationRepresentation> getOrganizations(
             @QueryParam("briefRepresentation") @DefaultValue("true") boolean briefRepresentation);
 }
@@ -30,6 +30,25 @@
 
 public interface OrganizationsMembersResource {
 
+    /**
+     * Returns the organizations associated with the user that has the specified id.
+     *
+     * @param id user id
+     * @return Organizations of the user
+     */
+    @Path("{id}/organizations")
+    @GET
+    @Produces(MediaType.APPLICATION_JSON)
+    List<OrganizationRepresentation> getOrganizations(
+            @PathParam("id") String id);
+
+    /**
+     * Returns the organizations associated with the user that has the specified id.
+     *
+     * @param id user id
+     * @param briefRepresentation if false, return the full representation. Otherwise, only the basic fields are returned. It is true by default. Parameter supported since Keycloak 26.3. It is assumed to be false for the older Keycloak server versions.
+     * @return Organizations of the user
+     */
     @Path("{id}/organizations")
     @GET
     @Produces(MediaType.APPLICATION_JSON)

@@ -155,6 +155,7 @@ List<OrganizationRepresentation> searchByAttribute(
      * Counts organizations by search.
      * @param search text to look for.
      * @return the number of organizations that match the search.
+     * @since Keycloak 26.3
      */
     @GET
     @Path("count")
@@ -169,6 +170,7 @@ List<OrganizationRepresentation> searchByAttribute(
      *              either the organization name or one of its domains must match exactly the {@code search} param. If false,
      *              the method returns all organizations whose name or (domains) partially match the {@code search} param.
      * @return the number of organizations that match the search.
+     * @since Keycloak 26.3
      */
     @GET
     @Path("count")
@@ -183,6 +185,7 @@ long count(
      * Counts all organizations that contain attributes matching the specified query.
      * @param searchQuery a query to search for organization attributes, in the format 'key1:value2 key2:value2'.
      * @return the number of the organizations that match the attribute query.
+     * @since Keycloak 26.3
      */
     @GET
     @Path("count")