Skip to main content
Documentation Powered by ReDoc

Ory APIs (latest)

API Support: support@ory.sh License: Apache 2.0 Terms of Service

Documentation for all public and administrative Ory APIs. Administrative APIs can only be accessed with a valid Personal Access Token. Public APIs are mostly used in browsers.

Authentication

oryAccessToken

Security Scheme Type HTTP
HTTP Authorization Scheme bearer

v0alpha2

Get WebAuthn JavaScript

This endpoint provides JavaScript which is needed in order to perform WebAuthn login and registration.

If you are building a JavaScript Browser App (e.g. in ReactJS or AngularJS) you will need to load this file:

<script src="https://public-kratos.example.org/.well-known/ory/webauthn.js" type="script" async />

More information can be found at Ory Kratos User Login and User Registration Documentation.

Responses

Response samples

Content type
application/json
"string"

List Identities

Lists all identities. Does not support search at the moment.

Learn how identities work in Ory Kratos' User And Identity Model Documentation.

Authorizations:
oryAccessToken
query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page.

page
integer <int64> >= 1
Default: 1

Pagination Page

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create an Identity

This endpoint creates an identity. It is NOT possible to set an identity's credentials (password, ...) using this method! A way to achieve that will be introduced in the future.

Learn how identities work in Ory Kratos' User And Identity Model Documentation.

Authorizations:
oryAccessToken
Request Body schema: application/json
object (adminIdentityImportCredentials)
Array of objects (RecoveryAddress) [ items ]

RecoveryAddresses contains all the addresses that can be used to recover an identity.

Use this structure to import recovery addresses for an identity. Please keep in mind that the address needs to be represented in the Identity Schema or this field will be overwritten on the next identity update.

schema_id
required
string

SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.

state
string (An Identity's State)
Enum: "active" "inactive"

The state can either be active or inactive.

traits
required
object

Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in schema_url.

Array of objects (verifiableIdentityAddress) [ items ]

VerifiableAddresses contains all the addresses that can be verified by the user.

Use this structure to import verified addresses for an identity. Please keep in mind that the address needs to be represented in the Identity Schema or this field will be overwritten on the next identity update.

Responses

Request samples

Content type
application/json
{
  • "credentials": {
    },
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "state": "active",
  • "traits": { },
  • "verifiable_addresses": [
    ]
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Delete an Identity

Calling this endpoint irrecoverably and permanently deletes the identity given its ID. This action can not be undone. This endpoint returns 204 when the identity was deleted or when the identity was not found, in which case it is assumed that is has been deleted already.

Learn how identities work in Ory Kratos' User And Identity Model Documentation.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Get an Identity

Learn how identities work in Ory Kratos' User And Identity Model Documentation.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to get

query Parameters
include_credential
Array of strings

DeclassifyCredentials will declassify one or more identity's credentials

Currently, only oidc is supported. This will return the initial OAuth 2.0 Access, Refresh and (optionally) OpenID Connect ID Token.

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Update an Identity

This endpoint updates an identity. It is NOT possible to set an identity's credentials (password, ...) using this method! A way to achieve that will be introduced in the future.

The full identity payload (except credentials) is expected. This endpoint does not support patching.

Learn how identities work in Ory Kratos' User And Identity Model Documentation.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID must be set to the ID of identity you want to update

Request Body schema: application/json
schema_id
required
string

SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. If set will update the Identity's SchemaID.

state
required
string (An Identity's State)
Enum: "active" "inactive"

The state can either be active or inactive.

traits
required
object

Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in schema_id.

Responses

Request samples

Content type
application/json
{
  • "schema_id": "string",
  • "state": "active",
  • "traits": { }
}

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "credentials": {
    },
  • "id": "string",
  • "recovery_addresses": [
    ],
  • "schema_id": "string",
  • "schema_url": "string",
  • "state": "active",
  • "state_changed_at": "2019-08-24T14:15:22Z",
  • "traits": null,
  • "updated_at": "2019-08-24T14:15:22Z",
  • "verifiable_addresses": [
    ]
}

Calling this endpoint irrecoverably and permanently deletes and invalidates all sessions that belong to the given Identity.

This endpoint is useful for:

To forcefully logout Identity from all devices and sessions

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

This endpoint returns all sessions that belong to the given Identity.

This endpoint is useful for:

Listing all sessions that belong to an Identity in an administrative context.

Authorizations:
oryAccessToken
path Parameters
id
required
string

ID is the identity's ID.

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page.

page
integer <int64> >= 1
Default: 1

Pagination Page

active
boolean

Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

List All Projects

Lists all projects you have access to.

Authorizations:
oryAccessToken

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Create a Project

Creates a new project.

Authorizations:
oryAccessToken
Request Body schema: application/json
name
required
string

The name of the project to be created

Responses

Request samples

Content type
application/json
{
  • "name": "string"
}

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "revision_id": "string",
  • "services": {
    },
  • "slug": "string",
  • "state": "running"
}

Irrecoverably Purge a Project

!! Use with extreme caution !!

Using this API endpoint you can purge (completely delete) a project and its data. This action can not be undone and will delete ALL your data.

!! Use with extreme caution !!

Authorizations:
oryAccessToken
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": { },
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

Get a Project

Get a projects you have access to by its ID.

Authorizations:
oryAccessToken
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
{
  • "id": "string",
  • "name": "string",
  • "revision_id": "string",
  • "services": {
    },
  • "slug": "string",
  • "state": "running"
}

Patch an Ory Cloud Project Configuration

This endpoints allows you to patch individual Ory Cloud Project configuration keys for Ory's services (identity, permission, ...). The configuration format is fully compatible with the open source projects for the respective services (e.g. Ory Kratos for Identity, Ory Keto for Permissions).

This endpoint expects the version key to be set in the payload. If it is unset, it will try to import the config as if it is from the most recent version.

If you have an older version of a configuration, you should set the version key in the payload!

While this endpoint is able to process all configuration items related to features (e.g. password reset), it does not support operational configuration items (e.g. port, tracing, logging) otherwise available in the open source.

For configuration items that can not be translated to Ory Cloud, this endpoint will return a list of warnings to help you understand which parts of your config could not be processed.

Authorizations:
oryAccessToken
path Parameters
project_id
required
string

Project ID

The project's ID.

Request Body schema: application/json
Array
op
required
string
Enum: "add" "remove" "replace" "move" "copy" "test"

The JSON Patch operation

path
required
string

The JSON Pointer to the target key

value
any

The value to be used. Only available for add and replace operations.

Responses

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
{
  • "project": {
    },
  • "warnings": [
    ]
}

Update an Ory Cloud Project Configuration

This endpoints allows you to update the Ory Cloud Project configuration for individual services (identity, permission, ...). The configuration is fully compatible with the open source projects for the respective services (e.g. Ory Kratos for Identity, Ory Keto for Permissions).

This endpoint expects the version key to be set in the payload. If it is unset, it will try to import the config as if it is from the most recent version.

If you have an older version of a configuration, you should set the version key in the payload!

While this endpoint is able to process all configuration items related to features (e.g. password reset), it does not support operational configuration items (e.g. port, tracing, logging) otherwise available in the open source.

For configuration items that can not be translated to Ory Cloud, this endpoint will return a list of warnings to help you understand which parts of your config could not be processed.

Be aware that updating any service's configuration will completely override your current configuration for that service!

Authorizations:
oryAccessToken
path Parameters
project_id
required
string

Project ID

The project's ID.

Request Body schema: application/json
name
required
string

The name of the project.

required
object (projectServices)

Responses

Request samples

Content type
application/json
{
  • "name": "string",
  • "services": {
    }
}

Response samples

Content type
application/json
{
  • "project": {
    },
  • "warnings": [
    ]
}

Get all members associated with this project.

This endpoint requires the user to be a member of the project with the role OWNER or DEVELOPER.

Authorizations:
oryAccessToken
path Parameters
project_id
required
string

Project ID

The project's ID.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Remove a member associated with this project. This also sets their invite status to `REMOVED`.

This endpoint requires the user to be a member of the project with the role OWNER.

Authorizations:
oryAccessToken
path Parameters
project_id
required
string

Project ID

The project's ID.

member_id
required
string

Member ID

Responses

Response samples

Content type
application/json
{
  • "code": 404,
  • "debug": "SQL field \"foo\" is not a bool.",
  • "details": { },
  • "error": {
    },
  • "id": "string",
  • "message": "The resource could not be found",
  • "reason": "User with ID 1234 does not exist.",
  • "request": "d7ef54b1-ec15-46e6-bccb-524b82c035e6",
  • "status": "Not Found"
}

listIdentitySchemas

Get all Identity Schemas

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page.

page
integer <int64> >= 1
Default: 1

Pagination Page

Responses

Response samples

Content type
application/json
[
  • {
    }
]

getJsonSchema

Get a JSON Schema

path Parameters
id
required
string

ID must be set to the ID of schema you want to get

Responses

Response samples

Content type
application/json
{ }

Get Self-Service Errors

This endpoint returns the error associated with a user-facing self service errors.

This endpoint supports stub values to help you implement the error UI:

?id=stub:500 - returns a stub 500 (Internal Server Error) error.

More information can be found at Ory Kratos User User Facing Error Documentation.

query Parameters
id
required
string

Error is the error's ID

Responses

Response samples

Content type
application/json
{
  • "created_at": "2019-08-24T14:15:22Z",
  • "error": { },
  • "id": "string",
  • "updated_at": "2019-08-24T14:15:22Z"
}

Submit a Login Flow

:::info

This endpoint is EXPERIMENTAL and subject to potential breaking changes in the future.

:::

Use this endpoint to complete a login flow. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and responds with HTTP 200 and a application/json body with the session token on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after login URL or the return_to value if it was set and if the login succeeded; a HTTP 303 redirect to the login UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
flow
required
string

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Request Body schema:
application/json
application/json
application/x-www-form-urlencoded
csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

lookup_secret
required
string

The lookup secret.

method
required
string

Method should be set to "lookup_secret" when logging in using the lookup_secret strategy.

lookup_secret
lookup_secret
oidc
password
totp
webauthn

Responses

Request samples

Content type
application/json
application/json
application/x-www-form-urlencoded
Example
lookup_secret
lookup_secret
oidc
password
totp
webauthn
{
  • "csrf_token": "string",
  • "lookup_secret": "string",
  • "method": "lookup_secret"
}

Response samples

Content type
application/json
{
  • "session": {
    },
  • "session_token": "string"
}

Initialize Login Flow for APIs, Services, Apps, ...

This endpoint initiates a login flow for API clients that do not use a browser, such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing login flow call /self-service/login/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks, including CSRF login attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. session_aal1_required: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
refresh
boolean

Refresh a login session

If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session.

aal
string

Request a Specific AuthenticationMethod Assurance Level

Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password, the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ... you would set this to "aal2".

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Initialize Login Flow for Browsers

This endpoint initializes a browser-based user login flow. This endpoint will set the appropriate cookies and anti-CSRF measures required for browser-based flows.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.login.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists already, the browser will be redirected to urls.default_redirect_url unless the query parameter ?refresh=true was set.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. session_aal1_required: Multi-factor auth (e.g. 2fa) was requested but the user has no session yet. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
refresh
boolean

Refresh a login session

If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session.

aal
string

Request a Specific AuthenticationMethod Assurance Level

Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor authentication. When an identity sign in using e.g. username+password, the AAL is 1. If you wish to "upgrade" the session's security by asking the user to perform TOTP / WebAuth/ ... you would set this to "aal2".

return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Get Login Flow

This endpoint returns a login flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/login', async function (req, res) {
const flow = await client.getSelfServiceLoginFlow(req.header('cookie'), req.query['flow'])

res.render('login', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
id
required
string

The Login Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /login?flow=abcde).

header Parameters
cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "created_at": "2019-08-24T14:15:22Z",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "refresh": true,
  • "request_url": "string",
  • "requested_aal": "aal0",
  • "return_to": "string",
  • "type": "string",
  • "ui": {
    },
  • "updated_at": "2019-08-24T14:15:22Z"
}

Complete Self-Service Logout

This endpoint logs out an identity in a self-service manner.

If the Accept HTTP header is not set to application/json, the browser will be redirected (HTTP 303 See Other) to the return_to parameter of the initial request or fall back to urls.default_return_to.

If the Accept HTTP header is set to application/json, a 204 No Content response will be sent on successful logout instead.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...). For API clients you can call the /self-service/logout/api URL directly with the Ory Session Token.

More information can be found at Ory Kratos User Logout Documentation.

query Parameters
token
string

A Valid Logout Token

If you do not have a logout token because you only have a session cookie, call /self-service/logout/urls to generate a URL for this endpoint.

return_to
string

The URL to return to after the logout was completed.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

Perform Logout for APIs, Services, Apps, ...

Use this endpoint to log out an identity using an Ory Session Token. If the Ory Session Token was successfully revoked, the server returns a 204 No Content response. A 204 No Content response is also sent when the Ory Session Token has been revoked already before.

If the Ory Session Token is malformed or does not exist a 403 Forbidden response will be returned.

This endpoint does not remove any HTTP Cookies - use the Browser-Based Self-Service Logout Flow instead.

Request Body schema: application/json
session_token
required
string

The Session Token

Invalidate this session token.

Responses

Request samples

Content type
application/json
{
  • "session_token": "string"
}

Response samples

Content type
application/json
{
  • "error": {
    }
}

Create a Logout URL for Browsers

This endpoint initializes a browser-based user logout flow and a URL which can be used to log out the user.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...). For API clients you can call the /self-service/logout/api URL directly with the Ory Session Token.

The URL is only valid for the currently signed in user. If no user is signed in, this endpoint returns a 401 error.

When calling this endpoint from a backend, please ensure to properly forward the HTTP cookies.

header Parameters
cookie
string

HTTP Cookies

If you call this endpoint from a backend, please include the original Cookie header in the request.

Responses

Response samples

Content type
application/json
{
  • "logout_token": "string",
  • "logout_url": "string"
}

Complete Recovery Flow

Use this endpoint to complete a recovery flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid. and a HTTP 303 See Other redirect with a fresh recovery flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Recovery UI URL with the Recovery Flow ID appended. sent_email is the success state after choose_method for the link method and allows the user to request another recovery email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a recovery link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Recover UI URL with a new Recovery Flow ID which contains an error message that the recovery link was invalid.

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
flow
required
string

The Recovery Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /recovery?flow=abcde).

token
string

Recovery Token

The recovery token which completes the recovery request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

Request Body schema:
application/json
application/json
application/x-www-form-urlencoded
csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

email
required
string

Email to Recover

Needs to be set when initiating the flow. If the email is a registered recovery email, a recovery link will be sent. If the email is not known, a email with details on what happened will be sent instead.

format: email

method
required
string

Method supports link only right now.

link
link

Responses

Request samples

Content type
application/json
application/json
application/x-www-form-urlencoded
{
  • "csrf_token": "string",
  • "email": "string",
  • "method": "link"
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Initialize Recovery Flow for APIs, Services, Apps, ...

This endpoint initiates a recovery flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error.

To fetch an existing recovery flow call /self-service/recovery/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos Account Recovery Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Initialize Recovery Flow for Browsers

This endpoint initializes a browser-based account recovery flow. Once initialized, the browser will be redirected to selfservice.flows.recovery.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists, the browser is returned to the configured return URL.

If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects or a 400 bad request error if the user is already authenticated.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Get Recovery Flow

This endpoint returns a recovery flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/recovery', async function (req, res) {
const flow = await client.getSelfServiceRecoveryFlow(req.header('Cookie'), req.query['flow'])

res.render('recovery', flow)
})

More information can be found at Ory Kratos Account Recovery Documentation.

query Parameters
id
required
string

The Flow ID

The value for this parameter comes from request URL Query parameter sent to your application (e.g. /recovery?flow=abcde).

header Parameters
cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Submit a Registration Flow

Use this endpoint to complete a registration flow by sending an identity's traits and password. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and respond with HTTP 200 and a application/json body with the created identity success - if the session hook is configured the session and session_token will also be included; HTTP 303 redirect to a fresh registration flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after registration URL or the return_to value if it was set and if the registration succeeded; a HTTP 303 redirect to the registration UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
flow
required
string

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

Request Body schema:
application/json
application/json
application/x-www-form-urlencoded
csrf_token
string

The CSRF Token

method
required
string

Method to use

This field must be set to oidc when using the oidc method.

oidc
oidc
password
webauthn
provider
required
string

The provider to register with

traits
object

The identity traits

Responses

Request samples

Content type
application/json
application/json
application/x-www-form-urlencoded
Example
oidc
oidc
password
webauthn
{
  • "csrf_token": "string",
  • "method": "oidc",
  • "provider": "string",
  • "traits": { }
}

Response samples

Content type
application/json
{
  • "identity": {
    },
  • "session": {
    },
  • "session_token": "string"
}

Initialize Registration Flow for APIs, Services, Apps, ...

This endpoint initiates a registration flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing registration flow call /self-service/registration/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "type": "string",
  • "ui": {
    }
}

Initialize Registration Flow for Browsers

This endpoint initializes a browser-based user registration flow. This endpoint will set the appropriate cookies and anti-CSRF measures required for browser-based flows.

:::info

This endpoint is EXPERIMENTAL and subject to potential breaking changes in the future.

:::

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.registration.ui_url with the flow ID set as the query parameter ?flow=. If a valid user session exists already, the browser will be redirected to urls.default_redirect_url.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

If this endpoint is called via an AJAX request, the response contains the registration flow without a redirect.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "type": "string",
  • "ui": {
    }
}

Get Registration Flow

This endpoint returns a registration flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

pseudo-code example
router.get('/registration', async function (req, res) {
const flow = await client.getSelfServiceRegistrationFlow(req.header('cookie'), req.query['flow'])

res.render('registration', flow)
})

This request may fail due to several reasons. The error.id can be one of:

session_already_available: The user is already signed in. self_service_flow_expired: The flow is expired and you should request a new one.

More information can be found at Ory Kratos User Login and User Registration Documentation.

query Parameters
id
required
string

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

header Parameters
cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here.

Responses

Response samples

Content type
application/json
{
  • "active": "password",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "type": "string",
  • "ui": {
    }
}

Complete Settings Flow

Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint behaves differently for API and browser flows.

API-initiated flows expect application/json to be sent in the body and respond with HTTP 200 and an application/json body with the session token on success; HTTP 303 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors. HTTP 401 when the endpoint is called without a valid session token. HTTP 403 when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low. Implies that the user needs to re-authenticate.

Browser flows without HTTP Header Accept or with Accept: text/* respond with a HTTP 303 redirect to the post/after settings URL or the return_to value if it was set and if the flow succeeded; a HTTP 303 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise. a HTTP 303 redirect to the login endpoint when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low.

Browser flows with HTTP Header Accept: application/json respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 401 when the endpoint is called without a valid session cookie. HTTP 403 when the page is accessed without a session cookie or the session's AAL is too low. HTTP 400 on form validation errors.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called with a Accept: application/json HTTP header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_refresh_required: The identity requested to change something that needs a privileged session. Redirect the identity to the login init endpoint with query parameters ?refresh=true&return_to=<the-current-browser-url>, or initiate a refresh login flow otherwise. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

Authorizations:
None
query Parameters
flow
required
string

The Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Request Body schema:
application/json
application/json
application/x-www-form-urlencoded
csrf_token
string

CSRFToken is the anti-CSRF token

lookup_secret_confirm
boolean

If set to true will save the regenerated lookup secrets

lookup_secret_disable
boolean

Disables this method if true.

lookup_secret_regenerate
boolean

If set to true will regenerate the lookup secrets

lookup_secret_reveal
boolean

If set to true will reveal the lookup secrets

method
required
string

Method

Should be set to "lookup" when trying to add, update, or remove a lookup pairing.

lookup_secret
lookup_secret
oidc
password
profile
totp
webauthn

Responses

Request samples

Content type
application/json
application/json
application/x-www-form-urlencoded
Example
lookup_secret
lookup_secret
oidc
password
profile
totp
webauthn
{
  • "csrf_token": "string",
  • "lookup_secret_confirm": true,
  • "lookup_secret_disable": true,
  • "lookup_secret_regenerate": true,
  • "lookup_secret_reveal": true,
  • "method": "lookup_secret"
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "show_form",
  • "type": "string",
  • "ui": {
    }
}

Initialize Settings Flow for APIs, Services, Apps, ...

This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on. You must provide a valid Ory Kratos Session Token for this endpoint to respond with HTTP 200 OK.

To fetch an existing settings flow call /self-service/settings/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

header Parameters
X-Session-Token
string

The Session Token of the Identity performing the settings flow.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "show_form",
  • "type": "string",
  • "ui": {
    }
}

Initialize Settings Flow for Browsers

This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid user session was set, the browser will be redirected to the login endpoint.

If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects or a 401 forbidden error if no valid session was set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "show_form",
  • "type": "string",
  • "ui": {
    }
}

Get Settings Flow

When accessing this endpoint through Ory Kratos' Public API you must ensure that either the Ory Kratos Session Cookie or the Ory Kratos Session Token are set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

You can access this endpoint without credentials when using Ory Kratos' Admin API.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

query Parameters
id
required
string

ID is the Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

header Parameters
X-Session-Token
string

The Session Token

When using the SDK in an app without a browser, please include the session token here.

cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here. You only need to do this for browser- based flows.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "show_form",
  • "type": "string",
  • "ui": {
    }
}

Complete Verification Flow

Use this endpoint to complete a verification flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid and a HTTP 303 See Other redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Verification UI URL with the Verification Flow ID appended. sent_email is the success state after choose_method when using the link method and allows the user to request another verification email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a verification link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with a new Verification Flow ID which contains an error message that the verification link was invalid.

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
flow
required
string

The Verification Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /verification?flow=abcde).

token
string

Verification Token

The verification token which completes the verification request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

Request Body schema:
application/json
application/json
application/x-www-form-urlencoded
csrf_token
string

Sending the anti-csrf token is only required for browser login flows.

email
required
string

Email to Verify

Needs to be set when initiating the flow. If the email is a registered verification email, a verification link will be sent. If the email is not known, a email with details on what happened will be sent instead.

format: email

method
required
string

Method supports link only right now.

link
link

Responses

Request samples

Content type
application/json
application/json
application/x-www-form-urlencoded
{
  • "csrf_token": "string",
  • "email": "string",
  • "method": "link"
}

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Initialize Verification Flow for APIs, Services, Apps, ...

This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on.

To fetch an existing verification flow call /self-service/verification/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos Email and Phone Verification Documentation.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Initialize Verification Flow for Browser Clients

This endpoint initializes a browser-based account verification flow. Once initialized, the browser will be redirected to selfservice.flows.verification.ui_url with the flow ID set as the query parameter ?flow=.

If this endpoint is called via an AJAX request, the response contains the recovery flow without any redirects.

This endpoint is NOT INTENDED for API clients and only works with browsers (Chrome, Firefox, ...).

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
return_to
string

The URL to return the browser to after the flow was completed.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Get Verification Flow

This endpoint returns a verification flow's context with, for example, error details and other information.

Browser flows expect the anti-CSRF cookie to be included in the request's HTTP Cookie Header. For AJAX requests you must ensure that cookies are included in the request or requests will fail.

If you use the browser-flow for server-side apps, the services need to run on a common top-level-domain and you need to forward the incoming HTTP Cookie header to this endpoint:

```js pseudo-code example router.get('/recovery', async function (req, res) { const flow = await client.getSelfServiceVerificationFlow(req.header('cookie'), req.query['flow'])

res.render('verification', flow) })

More information can be found at Ory Kratos Email and Phone Verification Documentation.

query Parameters
id
required
string

The Flow ID

The value for this parameter comes from request URL Query parameter sent to your application (e.g. /verification?flow=abcde).

header Parameters
cookie
string

HTTP Cookies

When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here.

Responses

Response samples

Content type
application/json
{
  • "active": "string",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "issued_at": "2019-08-24T14:15:22Z",
  • "request_url": "string",
  • "return_to": "string",
  • "state": "choose_method",
  • "type": "string",
  • "ui": {
    }
}

Calling this endpoint invalidates all except the current session that belong to the logged-in user. Session data are not deleted.

This endpoint is useful for:

To forcefully logout the current user from all other devices and sessions

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "count": 0
}

This endpoints returns all other active sessions that belong to the logged-in user. The current session can be retrieved by calling the `/sessions/whoami` endpoint.

This endpoint is useful for:

Displaying all other sessions that belong to the logged-in user

query Parameters
per_page
integer <int64> [ 1 .. 1000 ]
Default: 250

Items per Page

This is the number of items per page.

page
integer <int64> >= 1
Default: 1

Pagination Page

header Parameters
X-Session-Token
string

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Check Who the Current HTTP Session Belongs To

Uses the HTTP Headers in the GET request to determine (e.g. by using checking the cookies) who is authenticated. Returns a session object in the body or 401 if the credentials are invalid or no credentials were sent. Additionally when the request it successful it adds the user ID to the 'X-Kratos-Authenticated-Identity-Id' header in the response.

If you call this endpoint from a server-side application, you must forward the HTTP Cookie Header to this endpoint:

pseudo-code example
router.get('/protected-endpoint', async function (req, res) {
const session = await client.toSession(undefined, req.header('cookie'))

console.log(session)
})

When calling this endpoint from a non-browser application (e.g. mobile app) you must include the session token:

pseudo-code example
...
const session = await client.toSession("the-session-token")

console.log(session)

Depending on your configuration this endpoint might return a 403 status code if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor or change the configuration.

This endpoint is useful for:

AJAX calls. Remember to send credentials and set up CORS correctly! Reverse proxies and API Gateways Server-side calls - use the X-Session-Token header!

This endpoint authenticates users by checking

if the Cookie HTTP header was set containing an Ory Kratos Session Cookie; if the Authorization: bearer <ory-session-token> HTTP header was set with a valid Ory Kratos Session Token; if the X-Session-Token HTTP header was set with a valid Ory Kratos Session Token.

If none of these headers are set or the cooke or token are invalid, the endpoint returns a HTTP 401 status code.

As explained above, this request may fail due to several reasons. The error.id can be one of:

session_inactive: No active session was found in the request (e.g. no Ory Session Cookie / Ory Session Token). session_aal2_required: An active session was found but it does not fulfil the Authenticator Assurance Level, implying that the session must (e.g.) authenticate the second factor.

header Parameters
X-Session-Token
string
Example: MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookie
string
Example: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Responses

Response samples

Content type
application/json
{
  • "active": true,
  • "authenticated_at": "2019-08-24T14:15:22Z",
  • "authentication_methods": [
    ],
  • "authenticator_assurance_level": "aal0",
  • "expires_at": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "identity": {
    },
  • "issued_at": "2019-08-24T14:15:22Z"
}

Calling this endpoint invalidates the specified session. The current session cannot be revoked. Session data are not deleted.

This endpoint is useful for:

To forcefully logout the current user from another device or session

path Parameters
id
required
string

ID is the session's ID.

Responses

Response samples

Content type
application/json
{
  • "error": {
    }
}

metadata

Check HTTP Server Status

This endpoint returns a HTTP 200 status code when Ory Kratos is accepting incoming HTTP requests. This status does currently not include checks whether the database connection is working.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of this service, the health status will never refer to the cluster state, only to a single instance.

Responses

Response samples

Content type
application/json
{
  • "status": "string"
}

Check HTTP Server and Database Status

This endpoint returns a HTTP 200 status code when Ory Kratos is up running and the environment dependencies (e.g. the database) are responsive as well.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of Ory Kratos, the health status will never refer to the cluster state, only to a single instance.

Responses

Response samples

Content type
application/json
{
  • "status": "string"
}

Return Running Software Version.

This endpoint returns the version of Ory Kratos.

If the service supports TLS Edge Termination, this endpoint does not require the X-Forwarded-Proto header to be set.

Be aware that if you are running multiple nodes of this service, the version will never refer to the cluster state, only to a single instance.

Responses

Response samples

Content type
application/json
{
  • "version": "string"
}