MLflow Authentication REST API

The MLflow Authentication REST API allows you to create, get, update, and delete users, manage user permissions, and manage roles and role-based access control (RBAC). The API supports both legacy 2.0 endpoints for user management and new 3.0 endpoints for unified permission and role management introduced in MLflow 3.13.0. The API is hosted under the /api route on the MLflow tracking server. For example, to create a user on a tracking server hosted at http://localhost:5000, access http://localhost:5000/api/2.0/mlflow/users/create.

Important

The MLflow REST API requires content type application/json for all POST requests.

Table of Contents

Create User

Endpoint	HTTP Method
`2.0/mlflow/users/create`	`POST`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
password	`STRING`	Password.

Response Structure

Field Name	Type	Description
user	User	A user object.

Get User

Endpoint	HTTP Method
`2.0/mlflow/users/get`	`GET`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.

Response Structure

Field Name	Type	Description
user	User	A user object.

Update User Password

Endpoint	HTTP Method
`2.0/mlflow/users/update-password`	`PATCH`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
password	`STRING`	New password.

Update User Admin

Endpoint	HTTP Method
`2.0/mlflow/users/update-admin`	`PATCH`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
is_admin	`BOOLEAN`	New admin status.

Delete User

Endpoint	HTTP Method
`2.0/mlflow/users/delete`	`DELETE`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.

List Users

Endpoint	HTTP Method
`2.0/mlflow/users/list`	`GET`

Response Structure

Field Name	Type	Description
users	An array of User	A list of all user objects.

Get Current User

Endpoint	HTTP Method
`2.0/mlflow/users/current`	`GET`

Response Structure

Field Name	Type	Description
user	User	The current user object.

Grant User Permission

Endpoint	HTTP Method
`3.0/mlflow/users/permissions/grant`	`POST`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
resource_type	`STRING`	Resource type (`experiment` or `registered_model`).
resource_id	`STRING`	Resource ID or name.
permission	`STRING`	Permission to grant (`READ`, `EDIT`, `MANAGE`, `USE`).

Revoke User Permission

Endpoint	HTTP Method
`3.0/mlflow/users/permissions/revoke`	`POST`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
resource_type	`STRING`	Resource type (`experiment` or `registered_model`).
resource_id	`STRING`	Resource ID or name.

Get User Permission

Endpoint	HTTP Method
`3.0/mlflow/users/permissions/get`	`GET`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
resource_type	`STRING`	Resource type (`experiment` or `registered_model`).
resource_id	`STRING`	Resource ID or name.

Response Structure

Field Name	Type	Description
allowed	`BOOLEAN`	Whether the user is allowed to access the resource.
permission	`STRING`	The effective permission for the user on the specified resource.

List User Permissions

Endpoint	HTTP Method
`3.0/mlflow/users/permissions/list`	`GET`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.

Response Structure

Field Name	Type	Description
permissions	`ARRAY`	List of permissions for the user across all resources.

List Current User Permissions

Endpoint	HTTP Method
`3.0/mlflow/users/current/permissions`	`GET`

Response Structure

Field Name	Type	Description
permissions	`ARRAY`	List of permissions for the currently authenticated user.

Create Role

Endpoint	HTTP Method
`3.0/mlflow/roles/create`	`POST`

Request Structure

Field Name	Type	Description
name	`STRING`	Role name.
description	`STRING`	Role description.
workspace	`STRING`	Workspace the role belongs to.

Response Structure

Field Name	Type	Description
role	Role	A role object.

Get Role

Endpoint	HTTP Method
`3.0/mlflow/roles/get`	`GET`

Request Structure

Field Name	Type	Description
role_id	`INTEGER`	Role ID.

Response Structure

Field Name	Type	Description
role	Role	A role object.

List Roles

Endpoint	HTTP Method
`3.0/mlflow/roles/list`	`GET`

Response Structure

Field Name	Type	Description
roles	An array of Role	A list of all role objects.

Update Role

Endpoint	HTTP Method
`3.0/mlflow/roles/update`	`PATCH`

Request Structure

Field Name	Type	Description
role_id	`INTEGER`	Role ID.
description	`STRING`	New role description.

Response Structure

Field Name	Type	Description
role	Role	The updated role object.

Delete Role

Endpoint	HTTP Method
`3.0/mlflow/roles/delete`	`DELETE`

Request Structure

Field Name	Type	Description
role_id	`INTEGER`	Role ID.

Assign Role

Endpoint	HTTP Method
`3.0/mlflow/roles/assign`	`POST`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
role_id	`INTEGER`	Role ID to assign.
workspace	`STRING`	Workspace context.

Response Structure

Field Name	Type	Description
assignment	`OBJECT`	The assignment object, containing id, role_id, and user_id.

Unassign Role

Endpoint	HTTP Method
`3.0/mlflow/roles/unassign`	`DELETE`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.
role_id	`INTEGER`	Role ID to unassign.

Add Role Permission

Endpoint	HTTP Method
`3.0/mlflow/roles/permissions/add`	`POST`

Request Structure

Field Name	Type	Description
role_id	`INTEGER`	Role ID.
resource_type	`STRING`	Resource type (`experiment` or `registered_model`).
resource_pattern	`STRING`	Resource pattern. Use `*` to match all resources of this type.
permission	`STRING`	Permission to add.

Response Structure

Field Name	Type	Description
role_permission	`OBJECT`	The created permission, containing id, role_id, resource_type, resource_pattern, and permission.

Remove Role Permission

Endpoint	HTTP Method
`3.0/mlflow/roles/permissions/remove`	`DELETE`

Request Structure

Field Name	Type	Description
role_permission_id	`INTEGER`	Role permission ID.

List Role Permissions

Endpoint	HTTP Method
`3.0/mlflow/roles/permissions/list`	`GET`

Request Structure

Field Name	Type	Description
role_id	`INTEGER`	Role ID.

Response Structure

Field Name	Type	Description
role_permissions	`ARRAY`	List of permissions for the role across all resources.

Update Role Permission

Endpoint	HTTP Method
`3.0/mlflow/roles/permissions/update`	`PATCH`

Request Structure

Field Name	Type	Description
role_permission_id	`INTEGER`	Role permission ID.
permission	`STRING`	New permission.

Response Structure

Field Name	Type	Description
role_permission	`OBJECT`	The updated permission, containing id, role_id, resource_type, resource_pattern, and permission.

List User Roles

Endpoint	HTTP Method
`3.0/mlflow/users/roles/list`	`GET`

Request Structure

Field Name	Type	Description
username	`STRING`	Username.

Response Structure

Field Name	Type	Description
roles	An array of Role	List of roles assigned to user.

List Role Users

Endpoint	HTTP Method
`3.0/mlflow/roles/users/list`	`GET`

Request Structure

Field Name	Type	Description
role_id	`INTEGER`	Role ID.

Response Structure

Field Name	Type	Description
assignments	`ARRAY`	List of role assignments, each containing id, role_id, and user_id.

Data Structures

User

Field Name	Type	Description
id	`STRING`	User ID.
username	`STRING`	Username.
is_admin	`BOOLEAN`	Whether the user is an admin.
roles	An array of Role	Roles assigned to the user.

Note

The roles field is only included in the response from users/list. It is not present when calling users/get or users/current. The users/current endpoint also includes an additional is_basic_auth boolean field.

Permission

Permission level for a user on a resource.

Name	Description
READ	Can read.
EDIT	Can read and update.
MANAGE	Can read, update, delete and manage.
NO_PERMISSIONS	No permissions.

Role

Field Name	Type	Description
id	`INTEGER`	Role ID.
name	`STRING`	Role name.
description	`STRING`	Role description.
workspace	`STRING`	Workspace the role belongs to.
permissions	`ARRAY`	List of permissions associated with the role.