---
title: "Update Recovery Flow"
method: POST
path: "/self-service/recovery"
tags: ["frontend"]
---

# Update Recovery Flow

`POST /self-service/recovery`

Use this endpoint to update a recovery flow. This endpoint
behaves differently for API and browser flows and has several states:

`choose_method` expects `flow` (in the URL query) and `email` (in the body) to be sent
and works with API- and Browser-initiated flows.
For API clients and Browser clients with HTTP Header `Accept: application/json` it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid.
and a HTTP 303 See Other redirect with a fresh recovery flow if the flow was otherwise invalid (e.g. expired).
For Browser clients without HTTP Header `Accept` or with `Accept: text/*` it returns a HTTP 303 See Other redirect to the Recovery UI URL with the Recovery Flow ID appended.
`sent_email` is the success state after `choose_method` for the `link` method and allows the user to request another recovery email. It
works for both API and Browser-initiated flows and returns the same responses as the flow in `choose_method` state.
`passed_challenge` expects a `token` to be sent in the URL query and given the nature of the flow ("sending a recovery link")
does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL
(if the link was valid) and instructs the user to update their password, or a redirect to the Recover UI URL with
a new Recovery Flow ID which contains an error message that the recovery link was invalid.

More information can be found at [Ory Kratos Account Recovery Documentation](../self-service/flows/account-recovery).

## Query parameters

- `flow` string, required
- `token` string

## Headers

- `Cookie` string

## Request body

- UpdateRecoveryFlowBody — Update Recovery Flow Request Body

## Response `200`

recoveryFlow

- RecoveryFlow — This request is used when an identity wants to recover their account. We recommend reading the [Account Recovery Documentation](../self-service/flows/password-reset-account-recovery)
  - `active` string — Active, if set, contains the recovery method that is being used. It is initially not set.
  - `continue_with` ContinueWith[] — Contains possible actions that could follow this flow
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated.
  - `id` string, uuid, required — ID represents the request's unique ID. When performing the recovery flow, this represents the id in the recovery ui's query parameter: http://<selfservice.flows.recovery.ui_url>?request=<id>
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the request occurred.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `return_to` string — ReturnTo contains the requested return_to URL.
  - `state` unknown, required
  - `transient_payload` object — TransientPayload is used to pass data from the recovery flow to hooks and email templates
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` UiNodeAttributes, required
      - `group` 'default' | 'password' | 'oidc' | 'profile' | 'link' | 'code' | 'totp' | 'lookup_secret' | 'webauthn' | 'passkey' | 'identifier_first' | 'captcha' | 'saml' | 'deviceauthn', required — Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup identifier_first IdentifierFirstGroup captcha CaptchaGroup saml SAMLGroup deviceauthn DeviceAuthnGroup
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `meta` UiNodeMeta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `type` 'text' | 'input' | 'img' | 'a' | 'script' | 'div', required — The node's type text Text input Input img Image a Anchor script Script div Division

## Other responses

- `303` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204.
- `400` — recoveryFlow
- `410` — errorGeneric
- `422` — errorBrowserLocationChangeRequired
- `default` — errorGeneric

---

[API](https://skmtc.net/ory/apis/ory-kratos.md) · [All operations](https://skmtc.net/ory/apis/ory-kratos/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-kratos/versions/cc87f41fbd6d/schema)