---
name: "radcli_aaa"
section: "3"
platform: "linux"
package: "radcli"
version: "2.0.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/radcli_aaa"
---

# radcli\_aaa(3)

Perform an authentication or accounting exchange with Acct-Delay-Time autofill and fail-over across every configured server.

## NAME

radcli\_aaa - Perform an authentication or accounting exchange with Acct-Delay-Time autofill and fail-over across every configured server.

## SYNOPSIS

```
#include <radcli/>

int radcli_aaa(
    radcli_ctx             *ctx,
    radcli_code             code,
    const radcli_avp_list  *send,
    radcli_code            *out_code,
    radcli_avp_list       **out_attrs
);
```

## DESCRIPTION

The new API's counterpart to radcli.h's rc\_aaa()/rc\_auth()/rc\_acct(), layered on top of the single-server radcli\_request\_new()/\_perform() building block the same way lib/aaa\_ctx.c layers over rc\_auth() today  added as a separate wrapper rather than as an extension of radcli\_request\_perform(), so that function's single-server contract is untouched. Unlike radcli\_request\_new(), which uses only the first configured "authserver"/"acctserver" entry (REQ-NET2-INIT-003), this tries every configured entry in order, moving to the next on a timeout or unreachable-network result, exactly as rc\_aaa()/rc\_aaa\_ctx() do.

Unlike the legacy rc\_aaa(), this has no NAS-Port autofill parameters: NAS-Port is a value the caller already knows before calling, exactly like any other attribute (NAS-IP-Address, Called-Station-Id, ...), so it belongs in send via radcli\_avp\_add\_uint32\_by\_num(), not as a special-cased parameter here. Acct-Delay-Time remains the one attribute radcli\_aaa() computes itself, since only it can see the fail-over timing: if code is #RADCLI\_CODE\_ACCOUNTING\_REQUEST, an Acct-Delay-Time attribute is always added (replacing any in send), measuring elapsed time from the first attempt  continuing to accumulate across a fail-over retry, not resetting  folding in any Acct-Delay-Time already in send as an initial offset, matching rc\_fill\_acct\_pairs()'s (lib/buildreq.c) semantics.

## PARAMETERS

- **ctx**

  a context with configuration loaded.

- **code**

  RADCLI\_CODE\_ACCESS\_REQUEST or RADCLI\_CODE\_ACCOUNTING\_REQUEST.

- **send**

  the attributes to send; copied in per attempt  send may be freed or reused by the caller immediately after this call returns.

- **out\_code**

  if non-NULL, receives the final reply's RADIUS code on RADCLI\_OK.

- **out\_attrs**

  if non-NULL, receives the final reply's decoded attributes on RADCLI\_OK (owned by the caller, free with radcli\_avp\_list\_free()); left unset otherwise. Pass NULL for an Accounting-Request caller uninterested in the (typically empty) reply.

## RETURN VALUE

RADCLI\_OK if any configured server produced a validated reply (check out\_code for Access-Accept/Access-Reject/Access-Challenge), RADCLI\_TIMEOUT if no server produced one and the last server tried timed out, RADCLI\_ERROR on failure (NULL ctx/send, an invalid code, no server configured for that code's type, an allocation/encoding failure, or the last server tried being on an unreachable network).

## SEE ALSO

[*radcli\_request\_attrs*(3)](/radcli_request_attrs/3.md), [*radcli\_request\_code*(3)](/radcli_request_code/3.md), [*radcli\_request\_done*(3)](/radcli_request_done/3.md), [*radcli\_request\_free*(3)](/radcli_request_free/3.md), [*radcli\_request\_new*(3)](/radcli_request_new/3.md), [*radcli\_request\_perform*(3)](/radcli_request_perform/3.md), [*radcli\_request\_server*(3)](/radcli_request_server/3.md)