--- title: "Update an Identity" method: PUT path: "/admin/identities/{id}" tags: ["identity"] --- # Update an Identity `PUT /admin/identities/{id}` This endpoint updates an [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model). The full identity payload (except credentials) is expected. It is possible to update the identity's credentials as well. Using this operation, credentials will not be overwritten but instead added to the list. For example, if a user has a social sign in connection set up, updating the credentials will keep the social sign in connection and add the new credentials to the list. This prevents accidentally overwriting credentials and locking out users. A complete view of all credential types is here: `password`: The existing password credential will be completely replaced with the new configuration. You can provide either a hashed password, a plaintext password (which will be hashed), or enable the password migration hook. `oidc`, `saml`: The existing OIDC and SAML credentials will be kept and the new credentials will be added to the list. `totp`: The existing TOTP credentials will be replaced with the new configuration. `lookup_secret`: The existing Lookup Secret codes will be kept and the new codes will be added to the list. `webauthn`, `passkey`: The existing credentials are preserved, new credentials are added, and credentials with matching IDs are updated with new values. If a new `user_handle` is provided, it's added to the identity's identifiers list while preserving previous user handles. `code`: To import code credentials, configure your identity schema to use one of the identity traits as an identifier source (`{"ory.sh/kratos":{"code":{"identifier":true", "via":"email"}}}`). ## Path parameters - `id` string, required ## Request body - UpdateIdentityBody — Update Identity Body - `credentials` IdentityWithCredentials — Create Identity and Import Credentials - `lookup_secret` AdminIdentityImportCredentialsLookupSecret — Create Identity and Import Lookup Secret Credentials - `config` AdminIdentityImportCredentialsLookupSecretConfig — Create Identity and Import Lookup Secret Credentials Configuration - `codes` IdentityCredentialsLookupSecretCode[] — Codes is a list of "lookup secret" codes configured for the user. - `code` string — A recovery code - `used_at` string, date-time - `oidc` IdentityWithCredentialsOidc — Create Identity and Import Social Sign In Credentials - `config` IdentityWithCredentialsOidcConfig - `providers` IdentityWithCredentialsOidcConfigProvider[] — A list of OpenID Connect Providers - `organization` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database. - `UUID` string, uuid - `Valid` boolean - `provider` string, required — The OpenID Connect provider to link the subject to. Usually something like `google` or `github`. - `subject` string, required — The subject (`sub`) of the OpenID Connect connection. Usually the `sub` field of the ID Token. - `use_auto_link` boolean — If set, this credential allows the user to sign in using the OpenID Connect provider without setting the subject first. - `passkey` IdentityWithCredentialsPasskey — Create Identity and Import Passkey Credentials - `config` IdentityWithCredentialsPasskeyConfig — Create Identity and Import Passkey Credentials Configuration - `credentials` IdentityCredentialsWebAuthn[] - `added_at` string, date-time - `attestation` IdentityCredentialsWebAuthnAttestation - `authenticator_data` integer[] - `client_dataJSON` integer[] - `client_data_hash` integer[] - `object` integer[] - `public_key_algorithm` integer - `attestation_type` string - `authenticator` IdentityCredentialsWebAuthnAuthenticator - `aaguid` integer[] - `clone_warning` boolean - `sign_count` integer - `display_name` string - `flags` IdentityCredentialsWebAuthnFlags - `backup_eligible` boolean - `backup_state` boolean - `user_present` boolean - `user_verified` boolean - `id` integer[] - `is_passwordless` boolean - `public_key` integer[] - `transport` AuthenticatorTransport[] - `user_handle` integer[] — UserHandle is the user handle of the webauthn credential. - `password` IdentityWithCredentialsPassword — Create Identity and Import Password Credentials - `config` IdentityWithCredentialsPasswordConfig — Create Identity and Import Password Credentials Configuration - `hashed_password` string — The hashed password in [PHC format](https://www.ory.com/docs/kratos/manage-identities/import-user-accounts-identities#hashed-passwords) - `password` string — The password in plain text if no hash is available. - `use_password_migration_hook` boolean — If set to true, the password will be migrated using the password migration hook. - `saml` IdentityWithCredentialsSaml — Payload to import SAML credentials - `config` IdentityWithCredentialsSamlConfig — Payload of SAML providers - `providers` IdentityWithCredentialsSamlConfigProvider[] — A list of SAML Providers - `organization` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database. - `UUID` string, uuid - `Valid` boolean - `provider` string, required — The SAML provider to link the subject to. - `subject` string, required — The unique subject of the SAML connection. This value must be immutable at the source. - `totp` IdentityWithCredentialsTotp — Create Identity and Import TOTP 2FA Credentials - `config` IdentityWithCredentialsTotpConfig — Create Identity and Import TOTP 2FA Credentials Configuration - `totp_url` string — TOTPURL is the TOTP URL For more details see: https://github.com/google/google-authenticator/wiki/Key-Uri-Format - `webauthn` IdentityWithCredentialsWebAuthn — Create Identity and Import WebAuthn Credentials - `config` IdentityWithCredentialsWebAuthnConfig — Create Identity and Import WebAuthn Credentials Configuration - `credentials` IdentityCredentialsWebAuthn[] - `added_at` string, date-time - `attestation` IdentityCredentialsWebAuthnAttestation - `authenticator_data` integer[] - `client_dataJSON` integer[] - `client_data_hash` integer[] - `object` integer[] - `public_key_algorithm` integer - `attestation_type` string - `authenticator` IdentityCredentialsWebAuthnAuthenticator - `aaguid` integer[] - `clone_warning` boolean - `sign_count` integer - `display_name` string - `flags` IdentityCredentialsWebAuthnFlags - `backup_eligible` boolean - `backup_state` boolean - `user_present` boolean - `user_verified` boolean - `id` integer[] - `is_passwordless` boolean - `public_key` integer[] - `transport` AuthenticatorTransport[] - `user_handle` integer[] — UserHandle is the user handle of the webauthn credential. - `external_id` string — ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. - `metadata_admin` object — Store metadata about the user which is only accessible through admin APIs such as `GET /admin/identities/`. - `metadata_public` object — Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this field. - `region` 'eu-central' | 'asia-northeast' | 'us-east' | 'us-west' | 'eu' | 'asia' | 'us' | 'global' — Region is the Ory Network region this identity is homed in. Optional; omit to leave the current region unchanged. eu-central EUCentral asia-northeast AsiaNorthEast us-east USEast us-west USWest eu EU asia Asia us US global Global - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. If set will update the Identity's SchemaID. - `state` 'active' | 'inactive', required — State is the identity's state. active StateActive inactive StateInactive - `traits` object, required — Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in `schema_id`. ## Response `200` identity - Identity — An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop. - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity. - `external_id` string — ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. - `id` string, uuid, required — ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. - `metadata_admin` NullJsonRawMessage — NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- - `metadata_public` NullJsonRawMessage — NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- - `organization_id` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database. - `UUID` string, uuid - `Valid` boolean - `recovery_addresses` RecoveryIdentityAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity. - `break_glass_for_organization` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database. - `UUID` string, uuid - `Valid` boolean - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop. - `id` string, uuid - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop. - `value` string, required - `via` string, required - `region` 'eu-central' | 'asia-northeast' | 'us-east' | 'us-west' | 'eu' | 'asia' | 'us' | 'global' — Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east USEast us-west USWest eu EU asia Asia us US global Global - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url - `state` 'active' | 'inactive' — State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive - `state_changed_at` string, date-time - `traits` IdentityTraits, required — Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in `schema_url`. - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop. - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user. - `created_at` string, date-time — When this entry was created - `id` string, uuid — The ID - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema - `updated_at` string, date-time — When this entry was last updated - `value` string, required — The address value example foo@user.com - `verified` boolean, required — Indicates if the address has already been verified - `verified_at` string, date-time - `via` 'email' | 'sms', required — The delivery method ## Other responses - `400` — errorGeneric - `404` — errorGeneric - `409` — errorGeneric - `default` — errorGeneric --- [API](https://skmtc.net/ory/apis/ory-kratos.md) · [All operations](https://skmtc.net/ory/apis/ory-kratos/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-kratos/revisions/cc87f41fbd6d/schema)