Skip to main content
API docs by Redocly

Ory Identities API

Download OpenAPI specification:Download

E-mail: office@ory.sh License: Apache 2.0

This is the API specification for Ory Identities with features such as registration, login, recovery, account verification, profile settings, password reset, identity management, session management, email and sms delivery, and more.

identity

APIs for managing identities.

List Identities

Lists all identities in the system.

Authorizations:
oryAccessToken
query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

consistency
string
Enum: "" "strong" "eventual"

Read Consistency Level (preview)

The read consistency level determines the consistency guarantee for reads:

strong (slow): The read is guaranteed to return the most recent data committed at the start of the read. eventual (very fast): The result will return data that is about 4.8 seconds old.

The default consistency guarantee can be changed in the Ory Network Console or using the Ory CLI with ory patch project --replace '/previews/default_read_consistency_level="strong"'.

Setting the default consistency level to eventual may cause regressions in the future as we add consistency controls to more APIs. Currently, the following APIs will be affected by this setting:

GET /admin/identities

This feature is in preview and only available in Ory Network. ConsistencyLevelUnset ConsistencyLevelUnset is the unset / default consistency level. strong ConsistencyLevelStrong ConsistencyLevelStrong is the strong consistency level. eventual ConsistencyLevelEventual ConsistencyLevelEventual is the eventual consistency level using follower read timestamps.

ids
Array of strings

List of ids used to filter identities. If this list is empty, then no filter will be applied.

credentials_identifier
string

CredentialsIdentifier is the identifier (username, email) of the credentials to look up using exact match. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.

preview_credentials_identifier_similar
string

This is an EXPERIMENTAL parameter that WILL CHANGE. Do NOT rely on consistent, deterministic behavior. THIS PARAMETER WILL BE REMOVED IN AN UPCOMING RELEASE WITHOUT ANY MIGRATION PATH.

CredentialsIdentifierSimilar is the (partial) identifier (username, email) of the credentials to look up using similarity search. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used.

include_credential
Array of strings

Include Credentials in Response

Include any credential, for example password or oidc, in the response. When set to oidc, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token and the OpenID Connect ID Token if available.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create multiple identities

Creates multiple identities. This endpoint can also be used to import credentials for instance passwords, social sign in configurations or multifactor methods.

Authorizations:
oryAccessToken
Request Body schema: application/json
Array of objects (identityPatch)

Identities holds the list of patches to apply

required

Array
object (createIdentityBody)

Create Identity Body

patch_id
string <uuid>

The ID of this patch.

The patch ID is optional. If specified, the ID will be returned in the response, so consumers of this API can correlate the response with the patch.

Responses

Request samples

Content type
application/json
{
  • "identities": [
    ]
}

Response samples

Content type
application/json
{
  • "identities": [
    ]
}

Create an Identity

Create an identity. This endpoint can also be used to import credentials for instance passwords, social sign in configurations or multifactor methods.

Authorizations:
oryAccessToken
Request Body schema: application/json
object (identityWithCredentials)

Create Identity and Import Credentials

metadata_admin
any

Store metadata about the user which is only accessible through admin APIs such as GET /admin/identities/<id>.

metadata_public
any

Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this field.

Array of objects (recoveryIdentityAddress)

RecoveryAddresses contains all the addresses that can be used to recover an identity.

Use this structure to import recovery addresses for an identity. Please keep in mind that the address needs to be represented in the Identity Schema or this field will be overwritten on the next identity update.

schema_id
required
string

SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.

state
string
Enum: "active" "inactive"

State is the identity's state. active StateActive inactive StateInactive

traits
required
object

Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in schema_url.

Array of objects (verifiableIdentityAddress)

VerifiableAddresses contains all the addresses that can be verified by the user.

Use this structure to import verified addresses for an identity. Please keep in mind that the address needs to be represented in the Identity Schema or this field will be overwritten on the next identity update.

Responses

Request samples

Content type
application/json
{
  • "credentials": {
    },
  • "metadata_admin": null,
  • "metadata_public": null,
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "state": "active",
  • "traits": { },
  • "verifiable_addresses": [
    ]
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": null,
  • "metadata_public": null,
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Delete an Identity

Calling this endpoint irrecoverably and permanently deletes the identity given its ID. This action can not be undone. This endpoint returns 204 when the identity was deleted or when the identity was not found, in which case it is assumed that is has been deleted already.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Get an Identity

Return an identity by its ID. You can optionally include credentials (e.g. social sign in connections) in the response by using the include_credential query parameter.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to get

query Parameters
include_credential
Array of strings
Items Enum: "password" "oidc" "totp" "lookup_secret" "webauthn" "code" "passkey" "profile" "link_recovery" "code_recovery"

Include Credentials in Response

Include any credential, for example password or oidc, in the response. When set to oidc, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh Token and the OpenID Connect ID Token if available.

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": null,
  • "metadata_public": null,
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Patch an Identity

Partially updates an identity's field using JSON Patch. The fields id, stateChangedAt and credentials can not be updated using this method.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to update

Request Body schema: application/json
Array
from
string

This field is used together with operation "move" and uses JSON Pointer notation.

Learn more about JSON Pointers.

op
required
string

The operation to be performed. One of "add", "remove", "replace", "move", "copy", or "test".

path
required
string

The path to the target path. Uses JSON pointer notation.

Learn more about JSON Pointers.

value
any

The value to be used within the operations.

Learn more about JSON Pointers.

Responses

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": null,
  • "metadata_public": null,
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Update an Identity

This endpoint updates an identity. The full identity payload (except credentials) is expected. It is possible to update the identity's credentials as well.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to update

Request Body schema: application/json
object (identityWithCredentials)

Create Identity and Import Credentials

metadata_admin
any

Store metadata about the user which is only accessible through admin APIs such as GET /admin/identities/<id>.

metadata_public
any

Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this field.

schema_id
required
string

SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. If set will update the Identity's SchemaID.

state
required
string
Enum: "active" "inactive"

State is the identity's state. active StateActive inactive StateInactive

traits
required
object

Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in schema_id.

Responses

Request samples

Content type
application/json
{
  • "credentials": {
    },
  • "metadata_admin": null,
  • "metadata_public": null,
  • "schema_id": "string",
  • "state": "active",
  • "traits": { }
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "metadata_admin": null,
  • "metadata_public": null,
  • "organization_id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Delete a credential for a specific identity

Delete an identity credential by its type. You cannot delete password or code auth credentials through this API.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

type
required
string
Enum: "password" "oidc" "totp" "lookup_secret" "webauthn" "code" "passkey" "profile" "link_recovery" "code_recovery"

Type is the type of credentials to delete. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode

query Parameters
identifier
string

Identifier is the identifier of the OIDC credential to delete. Find the identifier by calling the GET /admin/identities/{id}?include_credential=oidc endpoint.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Delete & Invalidate an Identity's Sessions

Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

List an Identity's Sessions

This endpoint returns all sessions that belong to the given Identity.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

active
boolean

Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Recovery Code

This endpoint creates a recovery code which should be given to the user in order for them to recover (or activate) their account.

Authorizations:
oryAccessToken
Request Body schema: application/json
expires_in
string^([0-9]+(ns|us|ms|s|m|h))*$

Code Expires In

The recovery code will expire after that amount of time has passed. Defaults to the configuration value of selfservice.methods.code.config.lifespan.

flow_type
string (Type is the flow type.)

The flow type can either be api or browser.

identity_id
required
string <uuid>

Identity to Recover

The identity's ID you wish to recover.

Responses

Request samples

Content type
application/json
{
  • "expires_in": "string",
  • "flow_type": "string",
  • "identity_id": "011a42b9-62d7-49eb-8328-c2e454af88a1"
}

Response samples

Content type
application/json
{
  • "expires_at": "2019-08-24T14:15:22Z",
  • "recovery_code": "string",
  • "recovery_link": "string"
}

Create a Recovery Link

This endpoint creates a recovery link which should be given to the user in order for them to recover (or activate) their account.

Authorizations:
oryAccessToken
query Parameters
return_to
string
Request Body schema: application/json
expires_in
string^[0-9]+(ns|us|ms|s|m|h)$

Link Expires In

The recovery link will expire after that amount of time has passed. Defaults to the configuration value of selfservice.methods.code.config.lifespan.

identity_id
required
string <uuid>

Identity to Recover

The identity's ID you wish to recover.

Responses

Request samples

Content type
application/json
{
  • "expires_in": "string",
  • "identity_id": "011a42b9-62d7-49eb-8328-c2e454af88a1"
}

Response samples

Content type
application/json
{
  • "expires_at": "2019-08-24T14:15:22Z",
  • "recovery_link": "string"
}

List All Sessions

Listing all sessions that exist.

Authorizations:
oryAccessToken
query Parameters
page_size
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

active
boolean

Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.

expand
Array of strings
Items Enum: "identity" "devices"

ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session. If no value is provided, the expandable properties are skipped.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Deactivate a Session

Calling this endpoint deactivates the specified session. Session data is not deleted.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the session's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Get Session

This endpoint is useful for:

Getting a session object with all specified expandables that exist in an administrative context.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the session's ID.

query Parameters
expand
Array of strings
Items Enum: "identity" "devices"

ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session. Example - ?expand=Identity&expand=Devices If no value is provided, the expandable properties are skipped.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "devices": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "tokenized": "string"
}

Extend a Session

Calling this endpoint extends the given session ID. If session.earliest_possible_extend is set it will only extend the session after the specified time has passed.

This endpoint returns per default a 204 No Content response on success. Older Ory Network projects may return a 200 OK response with the session in the body. Returning the session as part of the response will be deprecated in the future and should not be relied upon.

This endpoint ignores consecutive requests to extend the same session and returns a 404 error in those scenarios. This endpoint also returns 404 errors if the session does not exist.

Retrieve the session ID from the /sessions/whoami endpoint / toSession SDK method.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the session's ID.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "devices": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "tokenized": "string"
}

Get all Identity Schemas

Returns a list of all identity schemas currently in use.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get Identity JSON Schema

Return a specific identity schema.

path Parameters
id
required
string

ID must be set to the ID of schema you want to get

Responses

Response samples

Content type
application/json
{ }

frontend

Endpoints used by frontend applications (e.g. Single-Page-App, Native Apps, Server Apps, ...) to manage a user's own profile.

Get WebAuthn JavaScript

This endpoint provides JavaScript which is needed in order to perform WebAuthn login and registration.

If you are building a JavaScript Browser App (e.g. in ReactJS or AngularJS) you will need to load this file:

<script src="https://public-kratos.example.org/.well-known/ory/webauthn.js" type="script" async />

More information can be found at Ory Kratos User Login and User Registration Documentation.

Responses

Response samples

Content type
application/json
"string"

Get User-Flow Errors

This endpoint returns the error associated with a user-facing self service errors.

This endpoint supports stub values to help you implement the error UI:

?id=stub:500 - returns a stub 500 (Internal Server Error) error.

More information can be found at Ory Kratos User User Facing Error Documentation.

query Parameters
id
required
string

Error is the error's ID

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "error": { },
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Submit a Login Flow

Use this endpoint to complete a login flow. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and responds with HTTP 200 and a application/json body with the session token on success; HTTP 410 if the original flow expired with the appropriate error messages set and optionally a use_flow_id parameter in the body; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after login URL or the return_to value if it was set and if the login succeeded; a HTTP 303 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
flow
required
string

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
required
address
string

Address is the address to send the code to, in case that there are multiple addresses. This field is only used in two-factor flows and is ineffective for passwordless flows.

code
string

Code is the 6 digits code sent to the user

csrf_token
required
string

CSRFToken is the anti-CSRF token

identifier
string

Identifier is the code identifier The identifier requires that the user has already completed the registration or settings with code flow.

method
required
string

Method should be set to "code" when logging in using the code strategy.

resend
string

Resend is set when the user wants to resend the code

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "address": "string",
  • "code": "string",
  • "csrf_token": "string",
  • "identifier": "string",
  • "method": "code",
  • "resend": "string",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "continue_with": [
    ],
  • "session": {
    },
  • "session_token": "string"
}

Create Login Flow for Native Apps

This endpoint initiates a login flow for native apps that do not use a browser, such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing login flow call /self-service/login/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks, including CSRF login attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. session_aal1_required: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
refresh
boolean

Refresh a login session

If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session.

aal
string

Request a Specific AuthenticationMethod Assurance Level

Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password, the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ... you would set this to "aal2".

return_session_token_exchange_code
boolean

EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed.

return_to
string

The URL to return the browser to after the flow was completed.

via
string

Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.

DEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice of MFA credentials to choose from to perform the second factor instead.

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Create Login Flow for Browsers

This endpoint initializes a browser-based user login flow. This endpoint will set the appropriate cookies and anti-CSRF measures required for browser-based flows.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.login.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists already, the browser will be redirected to urls.default_redirect_url unless the query parameter ?refresh=true was set.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. session_aal1_required: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

The optional query parameter login_challenge is set when using Kratos with Hydra in an OAuth2 flow. See the oauth2_provider.url configuration option.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
refresh
boolean

Refresh a login session

If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session.

aal
string

Request a Specific AuthenticationMethod Assurance Level

Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password, the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ... you would set this to "aal2".

return_to
string

The URL to return the browser to after the flow was completed.

login_challenge
string

An optional Hydra login challenge. If present, Kratos will cooperate with Ory Hydra to act as an OAuth2 identity provider.

The value for this parameter comes from login_challenge URL Query parameter sent to your application (e.g. /login?login_challenge=abcde).

organization
string

An optional organization ID that should be used for logging this user in. This parameter is only effective in the Ory Network.

via
string

Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows.

DEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see a choice of MFA credentials to choose from to perform the second factor instead.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Get Login Flow

This endpoint returns a login flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/login', async function (req, res) {
const flow = await client.getLoginFlow(req.header('cookie'), req.query['flow'])

res.render('login', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
id
required
string

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Update Logout Flow

This endpoint logs out an identity in a self-service manner.

If the Accept HTTP header is not set to application/json, the browser will be redirected (HTTP 303 See Other) to the return_to parameter of the initial request or fall back to urls.default_return_to.

If the Accept HTTP header is set to application/json, a 204 No Content response will be sent on successful logout instead.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...). For API clients you can call the /self-service/logout/api URL directly with the Ory Session Token.

More information can be found at Ory Kratos User Logout Documentation.

query Parameters
token
string

A Valid Logout Token

If you do not have a logout token because you only have a session cookie, call /self-service/logout/browser to generate a URL for this endpoint.

return_to
string

The URL to return to after the logout was completed.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Perform Logout for Native Apps

Use this endpoint to log out an identity using an Ory Session Token. If the Ory Session Token was successfully revoked, the server returns a 204 No Content response. A 204 No Content response is also sent when the Ory Session Token has been revoked already before.

If the Ory Session Token is malformed or does not exist a 403 Forbidden response will be returned.

This endpoint does not remove any HTTP Cookies - use the Browser-Based Self-Service Logout Flow instead.

Request Body schema: application/json
required
session_token
required
string

The Session Token

Invalidate this session token.

Responses

Request samples

Content type
application/json
{
  • "session_token": "string"
}

Response samples

Content type
application/json
{
  • "error": {
    }
}

Create a Logout URL for Browsers

This endpoint initializes a browser-based user logout flow and a URL which can be used to log out the user.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...). For API clients you can call the /self-service/logout/api URL directly with the Ory Session Token.

The URL is only valid for the currently signed in user. If no user is signed in, this endpoint returns a 401 error.

When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.

query Parameters
return_to
string

Return to URL

The URL to which the browser should be redirected to after the logout has been performed.

header Parameters
cookie
string

HTTP Cookies

If you call this endpoint from a backend, please include the original Cookie header in the request.

Responses

Response samples

Content type
application/json
{
  • "logout_token": "string",
  • "logout_url": "string"
}

Update Recovery Flow

Use this endpoint to update a recovery flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid. and a HTTP 303 See Other redirect with a fresh recovery flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Recovery UI URL with the Recovery Flow ID appended. sent_email is the success state after choose_method for the link method and allows the user to request another recovery email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a recovery link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Recover UI URL with a new Recovery Flow ID which contains an error message that the recovery link was invalid.

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
flow
required
string

The Recovery Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /recovery?flow=abcde).

token
string

Recovery Token

The recovery token which completes the recovery request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
required
code
string

Code from the recovery email

If you want to submit a code, use this field, but make sure to not include the email field, as well.

csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

email
string

The email address of the account to recover

If the email belongs to a valid account, a recovery email will be sent.

If you want to notify the email address if the account does not exist, see the notify_unknown_recipients flag

If a code was already sent, including this field in the payload will invalidate the sent code and re-send a new code.

format: email

method
required
string

Method is the method that should be used for this recovery flow

Allowed values are link and code. link RecoveryStrategyLink code RecoveryStrategyCode

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "email": "string",
  • "method": "code",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Recovery Flow for Native Apps

This endpoint initiates a recovery flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error.

On an existing recovery flow, use the getRecoveryFlow API endpoint.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos Account Recovery Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Recovery Flow for Browsers

This endpoint initializes a browser-based account recovery flow. Once initialized, the browser will be redirected to selfservice.flows.recovery.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists, the browser is returned to the configured return URL.

If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects or a 400 bad request error if the user is already authenticated.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Recovery Flow

This endpoint returns a recovery flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/recovery', async function (req, res) {
const flow = await client.getRecoveryFlow(req.header('Cookie'), req.query['flow'])

res.render('recovery', flow)
})

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
id
required
string

The Flow ID

The value for this parameter comes from request URL Query parameter sent to your application (e.g. /recovery?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Update Registration Flow

Use this endpoint to complete a registration flow by sending an identity's traits and password. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and respond with HTTP 200 and a application/json body with the created identity success - if the session hook is configured the session and session_token will also be included; HTTP 410 if the original flow expired with the appropriate error messages set and optionally a use_flow_id parameter in the body; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after registration URL or the return_to value if it was set and if the registration succeeded; a HTTP 303 redirect to the registration UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
flow
required
string

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
required
code
string

The OTP Code sent to the user

csrf_token
string

The CSRF Token

method
required
string

Method to use

This field must be set to code when using the code method.

resend
string

Resend restarts the flow with a new code

traits
required
object

The identity's traits

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "method": "code",
  • "resend": "string",
  • "traits": { },
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "continue_with": [
    ],
  • "identity": {
    },
  • "session": {
    },
  • "session_token": "string"
}

Create Registration Flow for Native Apps

This endpoint initiates a registration flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing registration flow call /self-service/registration/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
return_session_token_exchange_code
boolean

EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed.

return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "request_url": "string",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Registration Flow for Browsers

This endpoint initializes a browser-based user registration flow. This endpoint will set the appropriate cookies and anti-CSRF measures required for browser-based flows.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.registration.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists already, the browser will be redirected to urls.default_redirect_url.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

If this endpoint is called via an AJAX request, the response contains the registration flow without a redirect.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

login_challenge
string

Ory OAuth 2.0 Login Challenge.

If set will cooperate with Ory OAuth2 and OpenID to act as an OAuth2 server / OpenID Provider.

The value for this parameter comes from login_challenge URL Query parameter sent to your application (e.g. /registration?login_challenge=abcde).

This feature is compatible with Ory Hydra when not running on the Ory Network.

after_verification_return_to
string

The URL to return the browser to after the verification flow was completed.

After the registration flow is completed, the user will be sent a verification email. Upon completing the verification flow, this URL will be used to override the default selfservice.flows.verification.after.default_redirect_to value.

organization
string

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "request_url": "string",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Registration Flow

This endpoint returns a registration flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/registration', async function (req, res) {
const flow = await client.getRegistrationFlow(req.header('cookie'), req.query['flow'])

res.render('registration', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
id
required
string

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "oauth2_login_challenge": "string",
  • "oauth2_login_request": {
    },
  • "organization_id": "string",
  • "request_url": "string",
  • "return_to": "string",
  • "session_token_exchange_code": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Complete Settings Flow

Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint behaves differently for API and browser flows.

API-initiated flows expect application/json to be sent in the body and respond with HTTP 200 and an application/json body with the session token on success; HTTP 303 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors. HTTP 401 when the endpoint is called without a valid session token. HTTP 403 when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low. Implies that the user needs to re-authenticate.

Browser flows without HTTP Header Accept or with Accept: text/* respond with a HTTP 303 redirect to the post/after settings URL or the return_to value if it was set and if the flow succeeded; a HTTP 303 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise. a HTTP 303 redirect to the login endpoint when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low.

Browser flows with HTTP Header Accept: application/json respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 401 when the endpoint is called without a valid session cookie. HTTP 403 when the page is accessed without a session cookie or the session's AAL is too low. HTTP 400 on form validation errors.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called with a Accept: application/json HTTP header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_refresh_required: The identity requested to change something that needs a privileged session. Redirect the identity to the login init endpoint with query parameters ?refresh=true&return_to=<the-current-browser-url>, or initiate a refresh login flow otherwise. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

Authorizations:
None
query Parameters
flow
required
string

The Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
required
csrf_token
string

CSRFToken is the anti-CSRF token

lookup_secret_confirm
boolean

If set to true will save the regenerated lookup secrets

lookup_secret_disable
boolean

Disables this method if true.

lookup_secret_regenerate
boolean

If set to true will regenerate the lookup secrets

lookup_secret_reveal
boolean

If set to true will reveal the lookup secrets

method
required
string

Method

Should be set to "lookup" when trying to add, update, or remove a lookup pairing.

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "csrf_token": "string",
  • "lookup_secret_confirm": true,
  • "lookup_secret_disable": true,
  • "lookup_secret_regenerate": true,
  • "lookup_secret_reveal": true,
  • "method": "lookup_secret",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Settings Flow for Native Apps

This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on. You must provide a valid Ory Kratos Session Token for this endpoint to respond with HTTP 200 OK.

To fetch an existing settings flow call /self-service/settings/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Settings Flow for Browsers

This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid user session was set, the browser will be redirected to the login endpoint.

If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects or a 401 forbidden error if no valid session was set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Settings Flow

When accessing this endpoint through Ory Kratos' Public API you must ensure that either the Ory Kratos Session Cookie or the Ory Kratos Session Token are set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

You can access this endpoint without credentials when using Ory Kratos' Admin API.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

query Parameters
id
required
string

ID is the Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token

When using the SDK in an app without a browser, please include the session token here.

Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "continue_with": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Complete Verification Flow

Use this endpoint to complete a verification flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid and a HTTP 303 See Other redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Verification UI URL with the Verification Flow ID appended. sent_email is the success state after choose_method when using the link method and allows the user to request another verification email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a verification link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with a new Verification Flow ID which contains an error message that the verification link was invalid.

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
flow
required
string

The Verification Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /verification?flow=abcde).

token
string

Verification Token

The verification token which completes the verification request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

header Parameters
Cookie
string

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request Body schema:
required
code
string

Code from the recovery email

If you want to submit a code, use this field, but make sure to not include the email field, as well.

csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

email
string

The email address to verify

If the email belongs to a valid account, a verifiation email will be sent.

If you want to notify the email address if the account does not exist, see the notify_unknown_recipients flag

If a code was already sent, including this field in the payload will invalidate the sent code and re-send a new code.

format: email

method
required
string

Method is the method that should be used for this verification flow

Allowed values are link and code. link VerificationStrategyLink code VerificationStrategyCode

transient_payload
object

Transient data to pass along to any webhooks

Responses

Request samples

Content type
Example
{
  • "code": "string",
  • "csrf_token": "string",
  • "email": "string",
  • "method": "code",
  • "transient_payload": { }
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Verification Flow for Native Apps

This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on.

To fetch an existing verification flow call /self-service/verification/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Email and Phone Verification Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Create Verification Flow for Browser Clients

This endpoint initializes a browser-based account verification flow. Once initialized, the browser will be redirected to selfservice.flows.verification.ui_url with the flow ID set as the query parameter ?flow=.

If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...).

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Get Verification Flow

This endpoint returns a verification flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/recovery', async function (req, res) {
const flow = await client.getVerificationFlow(req.header('cookie'), req.query['flow'])

res.render('verification', flow)
})

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
id
required
string

The Flow ID

The value for this parameter comes from request URL Query parameter sent to your application (e.g. /verification?flow=abcde).

header Parameters
cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": null,
  • "transient_payload": { },
  • "type": "string",
  • "ui": {
    }
}

Disable my other sessions

Calling this endpoint invalidates all except the current session that belong to the logged-in user. Session data are not deleted.

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "count": 0
}

Get My Active Sessions

This endpoints returns all other active sessions that belong to the logged-in user. The current session can be retrieved by calling the /sessions/whoami endpoint.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Deprecated Items per Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This is the number of items per page.

page
integer <int64>

Deprecated Pagination Page

DEPRECATED: Please use page_token instead. This parameter will be removed in the future.

This value is currently an integer, but it is not sequential. The value is not the page number, but a reference. The next page can be any number and some numbers might return an empty list.

For example, page 2 might not follow after page 1. And even if page 3 and 5 exist, but page 4 might not exist. The first page can be retrieved by omitting this parameter. Following page pointers will be returned in the Link header.

page_size
integer <int64> [ 1 .. 500 ]
Default: 250

Page Size

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string >= 1
Default: "1"

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Exchange Session Token

query Parameters
init_code
required
string

The part of the code return when initializing the flow.

return_to_code
required
string

The part of the code returned by the return_to URL.

Responses

Response samples

Content type
application/json
{
  • "continue_with": [
    ],
  • "session": {
    },
  • "session_token": "string"
}

Check Who the Current HTTP Session Belongs To

Uses the HTTP Headers in the GET request to determine (e.g. by using checking the cookies) who is authenticated. Returns a session object in the body or 401 if the credentials are invalid or no credentials were sent. When the request it successful it adds the user ID to the 'X-Kratos-Authenticated-Identity-Id' header in the response.

If you call this endpoint from a server-side application, you must forward the HTTP Cookie Header to this endpoint:

pseudo-code example
router.get('/protected-endpoint', async function (req, res) {
const session = await client.toSession(undefined, req.header('cookie'))

console.log(session)
})

When calling this endpoint from a non-browser application (e.g. mobile app) you must include the session token:

pseudo-code example
...
const session = await client.toSession("the-session-token")

console.log(session)

When using a token template, the token is included in the tokenized field of the session.

pseudo-code example
...
const session = await client.toSession("the-session-token", { tokenize_as: "example-jwt-template" })

console.log(session.tokenized) // The JWT

Depending on your configuration this endpoint might return a 403 status code if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

This endpoint is useful for:

AJAX calls. Remember to send credentials and set up CORS correctly! Reverse proxies and API Gateways Server-side calls - use the X-Session-Token header!

This endpoint authenticates users by checking:

if the Cookie HTTP header was set containing an Ory Kratos Session Cookie; if the Authorization: bearer <ory-session-token> HTTP header was set with a valid Ory Kratos Session Token; if the X-Session-Token HTTP header was set with a valid Ory Kratos Session Token.

If none of these headers are set or the cookie or token are invalid, the endpoint returns a HTTP 401 status code.

As explained above, this request may fail due to several reasons. The error.id can be one of:

session_inactive: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token). session_aal2_required: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.

query Parameters
tokenize_as
string

Returns the session additionally as a token (such as a JWT)

The value of this parameter has to be a valid, configured Ory Session token template. For more information head over to the documentation.

header Parameters
X-Session-Token
string
Example: MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string
Example: ory_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "devices": [
    ],
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "tokenized": "string"
}

Disable one of my sessions

Calling this endpoint invalidates the specified session. The current session cannot be revoked. Session data are not deleted.

path Parameters
id
required
string

ID is the session's ID.

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

courier

APIs for managing email and SMS message delivery.

List Messages

Lists all messages by given status and recipient.

Authorizations:
oryAccessToken
query Parameters
page_size
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page to return. For details on pagination please head over to the pagination documentation.

page_token
string

Next Page Token

The next page token. For details on pagination please head over to the pagination documentation.

status
string (courierMessageStatus)
Enum: "queued" "sent" "processing" "abandoned"

Status filters out messages based on status. If no value is provided, it doesn't take effect on filter.

recipient
string

Recipient filters out messages based on recipient. If no value is provided, it doesn't take effect on filter.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Get a Message

Gets a specific messages by the given ID.

Authorizations:
oryAccessToken
path Parameters
id
required
string

MessageID is the ID of the message.

Responses

Response samples

Content type
application/json
{
  • "body": "string",
  • "channel": "string",
  • "created_at": "2019-08-24T14:15:22Z",
  • "dispatches": [
    ],
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "recipient": "string",
  • "send_count": 0,
  • "status": "queued",
  • "subject": "string",
  • "template_type": "recovery_invalid",
  • "type": "email",
  • "updated_at": "2019-08-24T14:15:22Z"
}

metadata

Server Metadata provides relevant information about the running server. Only available when self-hosting this service.

Check HTTP Server Status

This endpoint returns a HTTP 200 status code when Ory Kratos is accepting incoming HTTP requests. This status does currently not include checks whether the database connection is working.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of this service, the health status will never refer to the cluster state, only to a single instance.

Responses

Response samples

Content type
application/json
{
  • "status": "string"
}

Check HTTP Server and Database Status

This endpoint returns a HTTP 200 status code when Ory Kratos is up running and the environment dependencies (e.g. the database) are responsive as well.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of Ory Kratos, the health status will never refer to the cluster state, only to a single instance.

Responses

Response samples

Content type
application/json
{
  • "status": "string"
}

Return Running Software Version.

This endpoint returns the version of Ory Kratos.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of this service, the version will never refer to the cluster state, only to a single instance.

Responses

Response samples

Content type
application/json
{
  • "version": "string"
}