---
title: "Create Settings Flow for Browsers"
method: GET
path: "/self-service/settings/browser"
tags: ["frontend"]
---

# Create Settings Flow for Browsers

`GET /self-service/settings/browser`

This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to
`selfservice.flows.settings.ui_url` with the flow ID set as the query parameter `?flow=`. If no valid
Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

If this endpoint is opened as a link in the browser, it will be redirected to
`selfservice.flows.settings.ui_url` with the flow ID set as the query parameter `?flow=`. If no valid user session
was set, the browser will be redirected to the login endpoint.

If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects
or a 401 forbidden error if no valid session was set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the
case of an error, the `error.id` of the JSON response body can be one of:

`security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
`session_inactive`: No Ory Session was found - sign in a user first.
`security_identity_mismatch`: The requested `?return_to` address is not allowed to be used. Adjust this in the configuration!

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Query parameters

- `return_to` string

## Headers

- `Cookie` string

## Response `200`

settingsFlow

- SettingsFlow — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `continue_with` ContinueWith[] — Contains a list of actions, that could follow this flow It can, for example, contain a reference to the verification flow, created as part of the user's registration.
    - union
      - object — Indicates, that the UI flow could be continued by showing a verification ui
        - `action` 'show_verification_ui', required — Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString
        - `flow` ContinueWithVerificationUiFlow, required
          - `id` string, uuid, required — The ID of the verification flow
          - `url` string — The URL of the verification flow If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
          - `verifiable_address` string, required — The address that should be verified in this flow
      - object — Indicates that a session was issued, and the application should use this token for authenticated requests
        - `action` 'set_ory_session_token', required — Action will always be `set_ory_session_token` set_ory_session_token ContinueWithActionSetOrySessionTokenString
        - `ory_session_token` string, required — Token is the token of the session
      - object — Indicates, that the UI flow could be continued by showing a settings ui
        - `action` 'show_settings_ui', required — Action will always be `show_settings_ui` show_settings_ui ContinueWithActionShowSettingsUIString
        - `flow` ContinueWithSettingsUiFlow, required
          - `id` string, uuid, required — The ID of the settings flow
          - `url` string — The URL of the settings flow If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
      - object — Indicates, that the UI flow could be continued by showing a recovery ui
        - `action` 'show_recovery_ui', required — Action will always be `show_recovery_ui` show_recovery_ui ContinueWithActionShowRecoveryUIString
        - `flow` ContinueWithRecoveryUiFlow, required
          - `id` string, uuid, required — The ID of the recovery flow
          - `url` string — The URL of the recovery flow If this value is set, redirect the user's browser to this URL. This value is typically unset for native clients / API flows.
      - object — Indicates, that the UI flow could be continued by showing a recovery ui
        - `action` 'redirect_browser_to', required — Action will always be `redirect_browser_to` redirect_browser_to ContinueWithActionRedirectBrowserToString
        - `redirect_browser_to` string, required — The URL to redirect the browser to
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
  - `id` string, uuid, required — ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id>
  - `identity` Identity, required — An [identity](https://www.ory.sh/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `external_id` string — ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities.
    - `id` string, uuid, required — ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB.
    - `metadata_admin` unknown
    - `metadata_public` unknown
    - `organization_id` string, uuid4, nullable
    - `recovery_addresses` RecoveryIdentityAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive
    - `state_changed_at` string, date-time
    - `traits` unknown, required
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid — The ID
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` 'email' | 'sms', required — The delivery method
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `return_to` string — ReturnTo contains the requested return_to URL.
  - `state` unknown, required
  - `transient_payload` object — TransientPayload is used to pass data from the settings flow to hooks and email templates
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `autocomplete` 'email' | 'tel' | 'url' | 'current-password' | 'new-password' | 'one-time-code' | 'username webauthn' — The autocomplete attribute for the input. email InputAttributeAutocompleteEmail tel InputAttributeAutocompleteTel url InputAttributeAutocompleteUrl current-password InputAttributeAutocompleteCurrentPassword new-password InputAttributeAutocompleteNewPassword one-time-code InputAttributeAutocompleteOneTimeCode username webauthn InputAttributeAutocompleteUsernameWebauthn
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
          - `maxlength` integer — MaxLength may contain the input's maximum length.
          - `name` string, required — The input's element name.
          - `node_type` 'input', required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "input". text Text input Input img Image a Anchor script Script div Division
          - `onclick` string — OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn. Deprecated: Using OnClick requires the use of eval() which is a security risk. Use OnClickTrigger instead.
          - `onclickTrigger` 'oryWebAuthnRegistration' | 'oryWebAuthnLogin' | 'oryPasskeyLogin' | 'oryPasskeyLoginAutocompleteInit' | 'oryPasskeyRegistration' | 'oryPasskeySettingsRegistration' — OnClickTrigger may contain a WebAuthn trigger which should be executed on click. The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login. oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration oryWebAuthnLogin WebAuthnTriggersWebAuthnLogin oryPasskeyLogin WebAuthnTriggersPasskeyLogin oryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit oryPasskeyRegistration WebAuthnTriggersPasskeyRegistration oryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration
          - `onload` string — OnLoad may contain javascript which should be executed on load. This is primarily used for WebAuthn. Deprecated: Using OnLoad requires the use of eval() which is a security risk. Use OnLoadTrigger instead.
          - `onloadTrigger` 'oryWebAuthnRegistration' | 'oryWebAuthnLogin' | 'oryPasskeyLogin' | 'oryPasskeyLoginAutocompleteInit' | 'oryPasskeyRegistration' | 'oryPasskeySettingsRegistration' — OnLoadTrigger may contain a WebAuthn trigger which should be executed on load. The trigger maps to a JavaScript function provided by Ory, which triggers actions such as PassKey registration or login. oryWebAuthnRegistration WebAuthnTriggersWebAuthnRegistration oryWebAuthnLogin WebAuthnTriggersWebAuthnLogin oryPasskeyLogin WebAuthnTriggersPasskeyLogin oryPasskeyLoginAutocompleteInit WebAuthnTriggersPasskeyLoginAutocompleteInit oryPasskeyRegistration WebAuthnTriggersPasskeyRegistration oryPasskeySettingsRegistration WebAuthnTriggersPasskeySettingsRegistration
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` 'text' | 'password' | 'number' | 'checkbox' | 'hidden' | 'email' | 'tel' | 'submit' | 'button' | 'datetime-local' | 'date' | 'url', required — The input's element type. text InputAttributeTypeText password InputAttributeTypePassword number InputAttributeTypeNumber checkbox InputAttributeTypeCheckbox hidden InputAttributeTypeHidden email InputAttributeTypeEmail tel InputAttributeTypeTel submit InputAttributeTypeSubmit button InputAttributeTypeButton datetime-local InputAttributeTypeDateTimeLocal date InputAttributeTypeDate url InputAttributeTypeURI
          - `value` unknown
        - UiNodeTextAttributes
          - `id` string, required — A unique identifier
          - `node_type` 'text', required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "text". text Text input Input img Image a Anchor script Script div Division
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
        - UiNodeImageAttributes
          - `height` integer, required — Height of the image
          - `id` string, required — A unique identifier
          - `node_type` 'img', required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "img". text Text input Input img Image a Anchor script Script div Division
          - `src` string, required — The image's source URL. format: uri
          - `width` integer, required — Width of the image
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `id` string, required — A unique identifier
          - `node_type` 'a', required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "a". text Text input Input img Image a Anchor script Script div Division
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
        - UiNodeScriptAttributes
          - `async` boolean, required — The script async type
          - `crossorigin` string, required — The script cross origin policy
          - `id` string, required — A unique identifier
          - `integrity` string, required — The script's integrity hash
          - `node_type` 'script', required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "script". text Text input Input img Image a Anchor script Script div Division
          - `nonce` string, required — Nonce for CSP A nonce you may want to use to improve your Content Security Policy. You do not have to use this value but if you want to improve your CSP policies you may use it. You can also choose to use your own nonce value!
          - `referrerpolicy` string, required — The script referrer policy
          - `src` string, required — The script source
          - `type` string, required — The script MIME type
        - UiNodeDivisionAttributes — Division sections are used for interactive widgets that require a hook in the DOM / view.
          - `class` string — A classname that should be rendered into the DOM.
          - `data` object — Data is a map of key-value pairs that are passed to the division. They may be used for `data-...` attributes.
          - `id` string, required — A unique identifier
          - `node_type` 'div', required — NodeType represents this node's type. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "script". text Text input Input img Image a Anchor script Script div Division
      - `group` 'default' | 'password' | 'oidc' | 'profile' | 'link' | 'code' | 'totp' | 'lookup_secret' | 'webauthn' | 'passkey' | 'identifier_first' | 'captcha' | 'saml', required — Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup identifier_first IdentifierFirstGroup captcha CaptchaGroup saml SAMLGroup
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `meta` UiNodeMeta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `type` 'text' | 'input' | 'img' | 'a' | 'script' | 'div', required — The node's type text Text input Input img Image a Anchor script Script div Division

## Other responses

- `303` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204.
- `400` — errorGeneric
- `401` — errorGeneric
- `403` — errorGeneric
- `default` — errorGeneric

---

[API](https://skmtc.net/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.net/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-identities-api/versions/7a0df90e2f13/schema)