.\" File automatically generated by doxy2man0.3
.\" Generation date: Thu Sep 3 2026
.TH radcli_aaa 3 2026-09-03 "radcli" "Radius client library"
.SH "NAME"
radcli_aaa \- Perform an authentication or accounting exchange with Acct-Delay-Time autofill and fail-over across every configured server.
.SH SYNOPSIS
.nf
.B #include <radcli/>
.sp
\fBint radcli_aaa\fP(
    \fBradcli_ctx             *\fP\fIctx\fP,
    \fBradcli_code             \fP\fIcode\fP,
    \fBconst radcli_avp_list  *\fP\fIsend\fP,
    \fBradcli_code            *\fP\fIout_code\fP,
    \fBradcli_avp_list       **\fP\fIout_attrs\fP
);
.fi
.SH DESCRIPTION
.PP 
The new API's counterpart to radcli.h's rc_aaa()/rc_auth()/rc_acct(), layered on top of the single-server radcli_request_new()/_perform() building block the same way lib/aaa_ctx.c layers over rc_auth() today  added as a separate wrapper rather than as an extension of radcli_request_perform(), so that function's single-server contract is untouched. Unlike radcli_request_new(), which uses only the first configured "authserver"/"acctserver" entry (REQ-NET2-INIT-003), this tries every configured entry in order, moving to the next on a timeout or unreachable-network result, exactly as rc_aaa()/rc_aaa_ctx() do.
.PP 
Unlike the legacy rc_aaa(), this has no NAS-Port autofill parameters: NAS-Port is a value the caller already knows before calling, exactly like any other attribute (NAS-IP-Address, Called-Station-Id, ...), so it belongs in send via radcli_avp_add_uint32_by_num(), not as a special-cased parameter here. Acct-Delay-Time remains the one attribute radcli_aaa() computes itself, since only it can see the fail-over timing: if code is #RADCLI_CODE_ACCOUNTING_REQUEST, an Acct-Delay-Time attribute is always added (replacing any in send), measuring elapsed time from the first attempt  continuing to accumulate across a fail-over retry, not resetting  folding in any Acct-Delay-Time already in send as an initial offset, matching rc_fill_acct_pairs()'s (lib/buildreq.c) semantics.
.SH PARAMETERS
.TP
.B ctx
a context with configuration loaded. 

.TP
.B code
RADCLI_CODE_ACCESS_REQUEST or RADCLI_CODE_ACCOUNTING_REQUEST. 

.TP
.B send
the attributes to send; copied in per attempt  send may be freed or reused by the caller immediately after this call returns. 

.TP
.B out_code
if non-NULL, receives the final reply's RADIUS code on RADCLI_OK. 

.TP
.B out_attrs
if non-NULL, receives the final reply's decoded attributes on RADCLI_OK (owned by the caller, free with radcli_avp_list_free()); left unset otherwise. Pass NULL for an Accounting-Request caller uninterested in the (typically empty) reply. 

.SH RETURN VALUE
.PP
RADCLI_OK if any configured server produced a validated reply (check out_code for Access-Accept/Access-Reject/Access-Challenge), RADCLI_TIMEOUT if every configured server timed out or was unreachable, RADCLI_ERROR on failure (NULL ctx/send, an invalid code, no server configured for that code's type, or an allocation/encoding failure). 
.SH SEE ALSO
.PP
.nh
.ad l
\fIradcli_request_attrs\fP(3), \fIradcli_request_code\fP(3), \fIradcli_request_done\fP(3), \fIradcli_request_free\fP(3), \fIradcli_request_new\fP(3), \fIradcli_request_perform\fP(3), \fIradcli_request_server\fP(3)
.ad
.hy