---
title: "Update Registration Flow"
method: POST
path: "/self-service/registration"
tags: ["frontend"]
---

# Update Registration Flow

`POST /self-service/registration`

Use this endpoint to complete a registration flow by sending an identity's traits and password. This endpoint
behaves differently for API and browser flows.

API flows expect `application/json` to be sent in the body and respond with
HTTP 200 and a application/json body with the created identity success - if the session hook is configured the
`session` and `session_token` will also be included;
HTTP 410 if the original flow expired with the appropriate error messages set and optionally a `use_flow_id` parameter in the body;
HTTP 400 on form validation errors.

Browser flows expect a Content-Type of `application/x-www-form-urlencoded` or `application/json` to be sent in the body and respond with
a HTTP 303 redirect to the post/after registration URL or the `return_to` value if it was set and if the registration succeeded;
a HTTP 303 redirect to the registration UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of `application/json` will not redirect but instead respond with
HTTP 200 and a application/json body with the signed in identity and a `Set-Cookie` header on success;
HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set;
HTTP 400 on form validation errors.

If this endpoint is called with `Accept: application/json` in the header, the response contains the flow without a redirect. In the
case of an error, the `error.id` of the JSON response body can be one of:

`session_already_available`: The user is already signed in.
`security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
`security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!
`browser_location_change_required`: Usually sent when an AJAX request indicates that the browser needs to open a specific URL.
Most likely used in Social Sign In flows.

More information can be found at [Ory Kratos User Login](https://www.ory.sh/docs/kratos/self-service/flows/user-login) and [User Registration Documentation](https://www.ory.sh/docs/kratos/self-service/flows/user-registration).

## Query parameters

- `flow` string, required

## Headers

- `Cookie` string

## Request body

- union — Update Registration Request Body
  - UpdateRegistrationFlowWithPasswordMethod — Update Registration Flow with Password Method
    - `csrf_token` string — The CSRF Token
    - `method` string, required — Method to use This field must be set to `password` when using the password method.
    - `password` string, required — Password to sign the user up with
    - `traits` object, required — The identity's traits
    - `transient_payload` object — Transient data to pass along to any webhooks
  - UpdateRegistrationFlowWithOidcMethod — Update Registration Flow with OpenID Connect Method
    - `csrf_token` string — The CSRF Token
    - `id_token` string — IDToken is an optional id token provided by an OIDC provider If submitted, it is verified using the OIDC provider's public key set and the claims are used to populate the OIDC credentials of the identity. If the OIDC provider does not store additional claims (such as name, etc.) in the IDToken itself, you can use the `traits` field to populate the identity's traits. Note, that Apple only includes the users email in the IDToken. Supported providers are Apple Google
    - `id_token_nonce` string — IDTokenNonce is the nonce, used when generating the IDToken. If the provider supports nonce validation, the nonce will be validated against this value and is required.
    - `method` string, required — Method to use This field must be set to `oidc` when using the oidc method.
    - `provider` string, required — The provider to register with
    - `traits` object — The identity traits
    - `transient_payload` object — Transient data to pass along to any webhooks
    - `upstream_parameters` object — UpstreamParameters are the parameters that are passed to the upstream identity provider. These parameters are optional and depend on what the upstream identity provider supports. Supported parameters are: `login_hint` (string): The `login_hint` parameter suppresses the account chooser and either pre-fills the email box on the sign-in form, or selects the proper session. `hd` (string): The `hd` parameter limits the login/registration process to a Google Organization, e.g. `mycollege.edu`. `prompt` (string): The `prompt` specifies whether the Authorization Server prompts the End-User for reauthentication and consent, e.g. `select_account`. `acr_values` (string): The `acr_values` specifies the Authentication Context Class Reference values for the authorization request.
  - UpdateRegistrationFlowWithSamlMethod — Update registration flow using SAML
    - `csrf_token` string — The CSRF Token
    - `method` string, required — Method to use This field must be set to `saml` when using the saml method.
    - `provider` string, required — The provider to register with
    - `traits` object — The identity traits
    - `transient_payload` object — Transient data to pass along to any webhooks
  - UpdateRegistrationFlowWithWebAuthnMethod — Update Registration Flow with WebAuthn Method
    - `csrf_token` string — CSRFToken is the anti-CSRF token
    - `method` string, required — Method Should be set to "webauthn" when trying to add, update, or remove a webAuthn pairing.
    - `traits` object, required — The identity's traits
    - `transient_payload` object — Transient data to pass along to any webhooks
    - `webauthn_register` string — Register a WebAuthn Security Key It is expected that the JSON returned by the WebAuthn registration process is included here.
    - `webauthn_register_displayname` string — Name of the WebAuthn Security Key to be Added A human-readable name for the security key which will be added.
  - UpdateRegistrationFlowWithCodeMethod — Update Registration Flow with Code Method
    - `code` string — The OTP Code sent to the user
    - `csrf_token` string — The CSRF Token
    - `method` string, required — Method to use This field must be set to `code` when using the code method.
    - `resend` string — Resend restarts the flow with a new code
    - `traits` object, required — The identity's traits
    - `transient_payload` object — Transient data to pass along to any webhooks
  - UpdateRegistrationFlowWithPasskeyMethod — Update Registration Flow with Passkey Method
    - `csrf_token` string — CSRFToken is the anti-CSRF token
    - `method` string, required — Method Should be set to "passkey" when trying to add, update, or remove a Passkey.
    - `passkey_register` string — Register a WebAuthn Security Key It is expected that the JSON returned by the WebAuthn registration process is included here.
    - `traits` object, required — The identity's traits
    - `transient_payload` object — Transient data to pass along to any webhooks
  - UpdateRegistrationFlowWithProfileMethod — Update Registration Flow with Profile Method
    - `csrf_token` string — The Anti-CSRF Token This token is only required when performing browser flows.
    - `method` string, required — Method Should be set to profile when trying to update a profile.
    - `screen` 'credential-selection' | 'previous' — Screen requests navigation to a previous screen. This must be set to credential-selection to go back to the credential selection screen. credential-selection RegistrationScreenCredentialSelection nolint:gosec // not a credential previous RegistrationScreenPrevious
    - `traits` object, required — Traits The identity's traits.
    - `transient_payload` object — Transient data to pass along to any webhooks

## Response `200`

successfulNativeRegistration

- SuccessfulNativeRegistration — The Response for Registration Flows via API
  - `continue_with` ContinueWith[] — Contains a list of actions, that could follow this flow It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the session.
    - union
      - object — Indicates, that the UI flow could be continued by showing a verification ui
        - `action` 'show_verification_ui', required — Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString
        - `flow` ContinueWithVerificationUiFlow, required
          - `id` string, uuid, required — The ID of the verification flow
          - `url` string — The URL of the verification flow If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
          - `verifiable_address` string, required — The address that should be verified in this flow
      - object — Indicates that a session was issued, and the application should use this token for authenticated requests
        - `action` 'set_ory_session_token', required — Action will always be `set_ory_session_token` set_ory_session_token ContinueWithActionSetOrySessionTokenString
        - `ory_session_token` string, required — Token is the token of the session
      - object — Indicates, that the UI flow could be continued by showing a settings ui
        - `action` 'show_settings_ui', required — Action will always be `show_settings_ui` show_settings_ui ContinueWithActionShowSettingsUIString
        - `flow` ContinueWithSettingsUiFlow, required
          - `id` string, uuid, required — The ID of the settings flow
          - `url` string — The URL of the settings flow If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
      - object — Indicates, that the UI flow could be continued by showing a recovery ui
        - `action` 'show_recovery_ui', required — Action will always be `show_recovery_ui` show_recovery_ui ContinueWithActionShowRecoveryUIString
        - `flow` ContinueWithRecoveryUiFlow, required
          - `id` string, uuid, required — The ID of the recovery flow
          - `url` string — The URL of the recovery flow If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
      - object — Indicates, that the UI flow could be continued by showing a recovery ui
        - `action` 'redirect_browser_to', required — Action will always be `redirect_browser_to` redirect_browser_to ContinueWithActionRedirectBrowserToString
        - `redirect_browser_to` string, required — The URL to redirect the browser to
  - `identity` Identity, required — An [identity](https://www.ory.sh/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `external_id` string — ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities.
    - `id` string, uuid, required — ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB.
    - `metadata_admin` unknown
    - `metadata_public` unknown
    - `organization_id` string, uuid4, nullable
    - `recovery_addresses` RecoveryIdentityAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive
    - `state_changed_at` string, date-time
    - `traits` unknown, required
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid — The ID
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` 'email' | 'sms', required — The delivery method
  - `session` Session — A Session
    - `active` boolean — Active state. If false the session is no longer active.
    - `authenticated_at` string, date-time — The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code challenge was completed).
    - `authentication_methods` SessionAuthenticationMethod[] — A list of authenticators which were used to authenticate the session.
      - `aal` 'aal0' | 'aal1' | 'aal2' | 'aal3' — The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used. To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials
      - `completed_at` string, date-time — When the authentication challenge was completed.
      - `method` 'password' | 'oidc' | 'totp' | 'lookup_secret' | 'webauthn' | 'code' | 'passkey' | 'profile' | 'saml' | 'link_recovery' | 'code_recovery' — The method used in this authenticator. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode
      - `organization` string — The Organization id used for authentication
      - `provider` string — OIDC or SAML provider id used for authentication
    - `authenticator_assurance_level` 'aal0' | 'aal1' | 'aal2' | 'aal3' — The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one authentication factor was used while AAL2 implies that two factors (e.g. password + TOTP) have been used. To learn more about these levels please head over to: https://www.ory.sh/kratos/docs/concepts/credentials
    - `devices` SessionDevice[] — Devices has history of all endpoints where the session was used
      - `id` string, uuid, required — Device record ID
      - `ip_address` string — IPAddress of the client
      - `location` string — Geo Location corresponding to the IP Address
      - `user_agent` string — UserAgent of the client
    - `expires_at` string, date-time — The Session Expiry When this session expires at.
    - `id` string, uuid, required — Session ID
    - `identity` Identity — An [identity](https://www.ory.sh/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
      - `external_id` string — ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities.
      - `id` string, uuid, required — ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB.
      - `metadata_admin` unknown
      - `metadata_public` unknown
      - `organization_id` string, uuid4, nullable
      - `recovery_addresses` RecoveryIdentityAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
        - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
        - `id` string, uuid
        - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
        - `value` string, required
        - `via` string, required
      - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
      - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
      - `state` 'active' | 'inactive' — State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive
      - `state_changed_at` string, date-time
      - `traits` unknown, required
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
        - `created_at` string, date-time — When this entry was created
        - `id` string, uuid — The ID
        - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
        - `updated_at` string, date-time — When this entry was last updated
        - `value` string, required — The address value example foo@user.com
        - `verified` boolean, required — Indicates if the address has already been verified
        - `verified_at` string, date-time
        - `via` 'email' | 'sms', required — The delivery method
    - `issued_at` string, date-time — The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`.
    - `tokenized` string — Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`.
  - `session_token` string — The Session Token This field is only set when the session hook is configured as a post-registration hook. A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for API flows, not for Browser flows!

## Other responses

- `303` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204.
- `400` — registrationFlow
- `410` — errorGeneric
- `422` — errorBrowserLocationChangeRequired
- `default` — errorGeneric

---

[API](https://skmtc.net/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.net/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-identities-api/versions/7a0df90e2f13/schema)