v1

latestSwagger 2.02026-07-1760185352.5 KB
frontend

Complete Verification Flow

Use this endpoint to complete a verification flow. This endpoint behaves differently for API and browser flows and has several states:

choose_method expects flow (in the URL query) and email (in the body) to be sent and works with API- and Browser-initiated flows. For API clients and Browser clients with HTTP Header Accept: application/json it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid and a HTTP 303 See Other redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired). For Browser clients without HTTP Header Accept or with Accept: text/* it returns a HTTP 303 See Other redirect to the Verification UI URL with the Verification Flow ID appended. sent_email is the success state after choose_method when using the link method and allows the user to request another verification email. It works for both API and Browser-initiated flows and returns the same responses as the flow in choose_method state. passed_challenge expects a token to be sent in the URL query and given the nature of the flow ("sending a verification link") does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL (if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with a new Verification Flow ID which contains an error message that the verification link was invalid.

More information can be found at Ory Kratos Email and Phone Verification Documentation.

post/self-service/verification

Query parameters

flowstring required

The Verification Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /verification?flow=abcde).

tokenstring

Verification Token

The verification token which completes the verification request. If the token is invalid (e.g. expired) an error will be shown to the end-user.

This parameter is usually set in a link and not used by any direct API call.

Headers

Cookiestring

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request body

UpdateVerificationFlowBody required

Update Verification Flow Request Body

Response

verificationFlow

activestring

Active, if set, contains the registration method that is being used. It is initially not set.

expires_atstring date-time

ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated.

idstring uuid required

ID represents the request's unique ID. When performing the verification flow, this represents the id in the verify ui's query parameter: http://<selfservice.flows.verification.ui_url>?request=<id>

type: string format: uuid

issued_atstring date-time

IssuedAt is the time (UTC) when the request occurred.

request_urlstring

RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.

return_tostring

ReturnTo contains the requested return_to URL.

{"stackTrail":"components:schemas:verificationFlow:properties:state","oasType":"schema","type":"unknown","description":"State represents the state of this request:\n\nchoose_method: ask the user to choose a method (e.g. verify your email)\nsent_email: the email has been sent to the user\npassed_challenge: the request was successful and the verification challenge was passed."}
transient_payloadobject

TransientPayload is used to pass data from the verification flow to hooks and email templates

typestring required

The flow type can either be api or browser.