Package org.keycloak.email

Class ActionTokenEmail

java.lang.Object

org.keycloak.email.ActionTokenEmail

public final class ActionTokenEmail
extends Object

Helper for sending an "execute actions" email to a user, so callers (e.g. InviteUserStepProvider) do not have to reimplement the individual steps:

• resolving the target client (explicit clientId or the realm system client);
• validating the optional redirect URI against the resolved client;
• building the action-token URL and serialising the token;
• invoking EmailTemplateProvider.sendExecuteActions(String, long).

It is HTTP-agnostic: resolveParams(org.keycloak.models.KeycloakSession, org.keycloak.models.RealmModel, org.keycloak.models.UserModel, java.lang.String, java.lang.String, java.lang.Integer) returns a ActionTokenEmail.Result (either ActionTokenEmail.Params or an ActionTokenEmail.Ineligibility reason) and send(org.keycloak.models.KeycloakSession, org.keycloak.models.RealmModel, org.keycloak.models.UserModel, org.keycloak.email.ActionTokenEmail.Params, java.util.List<java.lang.String>, jakarta.ws.rs.core.UriInfo) throws EmailException, so callers can map outcomes onto HTTP status codes or onto silent skips in background executors.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	ActionTokenEmail.Ineligibility	Outcomes of resolveParams(org.keycloak.models.KeycloakSession, org.keycloak.models.RealmModel, org.keycloak.models.UserModel, java.lang.String, java.lang.String, java.lang.Integer) that indicate a user is ineligible for an action-token email.
static final class	ActionTokenEmail.Params	Resolved parameters for a single execute-actions email.
static final class	ActionTokenEmail.Result	Result of resolveParams(org.keycloak.models.KeycloakSession, org.keycloak.models.RealmModel, org.keycloak.models.UserModel, java.lang.String, java.lang.String, java.lang.Integer): either successfully resolved ActionTokenEmail.Params or a structured ActionTokenEmail.Ineligibility reason.

Method Summary

Modifier and Type	Method	Description
static ActionTokenEmail.Result	resolveParams(KeycloakSession session, RealmModel realm, UserModel user, String clientId, String redirectUri, Integer overrideLifespanSeconds)	Resolves the parameters needed to send an action-token email to user.
static void	send(KeycloakSession session, RealmModel realm, UserModel user, ActionTokenEmail.Params params, List<String> actions, jakarta.ws.rs.core.UriInfo uriInfo)	Builds the action-token URL using the active HTTP request's base URI and sends the email.
static void	send(KeycloakSession session, RealmModel realm, UserModel user, ActionTokenEmail.Params params, List<String> actions, URI baseUri)	Builds the action-token URL using baseUri and sends the email.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

resolveParams

public static ActionTokenEmail.Result resolveParams(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 String clientId,
 String redirectUri,
 Integer overrideLifespanSeconds)

Resolves the parameters needed to send an action-token email to user. Returns a structured ActionTokenEmail.Result so callers can differentiate between

• successful resolution → ActionTokenEmail.Params;
• user/client/redirect ineligibility → ActionTokenEmail.Ineligibility;
• caller-supplied invalid configuration (e.g. redirectUri without a clientId) → IllegalArgumentException.

Parameters:

session - the Keycloak session

realm - the realm the user belongs to

user - the recipient

clientId - explicit client id, or null for the realm system client

redirectUri - optional post-action redirect URI; requires clientId when supplied

overrideLifespanSeconds - explicit lifespan override; null falls back to RealmModel.getActionTokenGeneratedByAdminLifespan()

Throws:

IllegalArgumentException - when redirectUri is supplied without clientId

send

public static void send(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 ActionTokenEmail.Params params,
 List<String> actions,
 jakarta.ws.rs.core.UriInfo uriInfo)
                 throws EmailException

Builds the action-token URL using the active HTTP request's base URI and sends the email. Equivalent to send(KeycloakSession, RealmModel, UserModel, Params, List, URI) with uriInfo.getBaseUri().

Throws:

EmailException

send

public static void send(KeycloakSession session,
 RealmModel realm,
 UserModel user,
 ActionTokenEmail.Params params,
 List<String> actions,
 URI baseUri)
                 throws EmailException

Builds the action-token URL using baseUri and sends the email.

Use this overload from contexts that do not have an active HTTP request (e.g. workflow executors) and therefore cannot supply a UriInfo.

Throws:

EmailException