v1

latestSwagger 2.02026-07-1760185352.5 KB

frontend

Complete Settings Flow

Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint behaves differently for API and browser flows.

API-initiated flows expect application/json to be sent in the body and respond with HTTP 200 and an application/json body with the session token on success; HTTP 303 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors. HTTP 401 when the endpoint is called without a valid session token. HTTP 403 when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low. Implies that the user needs to re-authenticate.

Browser flows without HTTP Header Accept or with Accept: text/* respond with a HTTP 303 redirect to the post/after settings URL or the return_to value if it was set and if the flow succeeded; a HTTP 303 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise. a HTTP 303 redirect to the login endpoint when selfservice.flows.settings.privileged_session_max_age was reached or the session's AAL is too low.

Browser flows with HTTP Header Accept: application/json respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 401 when the endpoint is called without a valid session cookie. HTTP 403 when the page is accessed without a session cookie or the session's AAL is too low. HTTP 400 on form validation errors.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called with a Accept: application/json HTTP header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_refresh_required: The identity requested to change something that needs a privileged session. Redirect the identity to the login init endpoint with query parameters ?refresh=true&return_to=<the-current-browser-url>, or initiate a refresh login flow otherwise. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The flow was interrupted with session_refresh_required but apparently some other identity logged in instead. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

post/self-service/settings

Query parameters

flowstring required

The Settings Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /settings?flow=abcde).

Headers

X-Session-Tokenstring

The Session Token of the Identity performing the settings flow.

Cookiestring

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request body

UpdateSettingsFlowBody required

Update Settings Flow Request Body

Response

settingsFlow

activestring

Active, if set, contains the registration method that is being used. It is initially not set.

continue_withContinueWith[]

Contains a list of actions, that could follow this flow

It can, for example, contain a reference to the verification flow, created as part of the user's registration.

expires_atstring date-time required

ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.

idstring uuid required

ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id>

issued_atstring date-time required

IssuedAt is the time (UTC) when the flow occurred.

request_urlstring required

RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.

return_tostring

ReturnTo contains the requested return_to URL.

{"stackTrail":"components:schemas:settingsFlow:properties:state","oasType":"schema","type":"unknown","description":"State represents the state of this flow. It knows two states:\n\nshow_form: No user data has been collected, or it is invalid, and thus the form should be shown.\nsuccess: Indicates that the settings flow has been updated successfully with the provided data.\nDone will stay true when repeatedly checking. If set to true, done will revert back to false only\nwhen a flow with invalid (e.g. \"please use a valid phone number\") data was sent."}

transient_payloadobject

TransientPayload is used to pass data from the settings flow to hooks and email templates

typestring required

The flow type can either be api or browser.

Example response

{
  "identity": {
    "verifiable_addresses": [
      {
        "created_at": "2014-01-01T23:28:56.782Z",
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified": true,
        "via": "email"
      }
    ]
  }
}