---
title: "Get Settings Flow"
method: GET
path: "/self-service/settings/flows"
tags: ["frontend"]
---

# Get Settings Flow

`GET /self-service/settings/flows`

When accessing this endpoint through Ory Kratos' Public API you must ensure that either the Ory Kratos Session Cookie
or the Ory Kratos Session Token are set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
to sign in with the second factor or change the configuration.

You can access this endpoint without credentials when using Ory Kratos' Admin API.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the
case of an error, the `error.id` of the JSON response body can be one of:

`security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
`session_inactive`: No Ory Session was found - sign in a user first.
`security_identity_mismatch`: The flow was interrupted with `session_refresh_required` but apparently some other
identity logged in instead.

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Query parameters

- `id` string, required

## Headers

- `X-Session-Token` string
- `Cookie` string

## Response `200`

settingsFlow

- SettingsFlow — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `continue_with` ContinueWith[] — Contains a list of actions, that could follow this flow It can, for example, contain a reference to the verification flow, created as part of the user's registration.
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
  - `id` string, uuid, required — ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id>
  - `identity` Identity, required — An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `external_id` string — ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities.
    - `id` string, uuid, required — ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB.
    - `metadata_admin` NullJsonRawMessage — NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable-
    - `metadata_public` NullJsonRawMessage — NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable-
    - `organization_id` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database.
      - `UUID` string, uuid
      - `Valid` boolean
    - `recovery_addresses` RecoveryIdentityAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `break_glass_for_organization` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database.
        - `UUID` string, uuid
        - `Valid` boolean
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `region` 'eu-central' | 'asia-northeast' | 'us-east' | 'us-west' | 'eu' | 'asia' | 'us' | 'global' — Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east USEast us-west USWest eu EU asia Asia us US global Global
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive
    - `state_changed_at` string, date-time
    - `traits` IdentityTraits, required — Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in `schema_url`.
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid — The ID
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` 'email' | 'sms', required — The delivery method
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
  - `organization_id` NullUUID — NullUUID can be used with the standard sql package to represent a UUID value that can be NULL in the database.
    - `UUID` string, uuid
    - `Valid` boolean
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `return_to` string — ReturnTo contains the requested return_to URL.
  - `state` unknown, required
  - `transient_payload` object — TransientPayload is used to pass data from the settings flow to hooks and email templates
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` UiNodeAttributes, required
      - `group` 'default' | 'password' | 'oidc' | 'profile' | 'link' | 'code' | 'totp' | 'lookup_secret' | 'webauthn' | 'passkey' | 'identifier_first' | 'captcha' | 'saml' | 'deviceauthn', required — Group specifies which group (e.g. password authenticator) this node belongs to. default DefaultGroup password PasswordGroup oidc OpenIDConnectGroup profile ProfileGroup link LinkGroup code CodeGroup totp TOTPGroup lookup_secret LookupGroup webauthn WebAuthnGroup passkey PasskeyGroup identifier_first IdentifierFirstGroup captcha CaptchaGroup saml SAMLGroup deviceauthn DeviceAuthnGroup
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `meta` UiNodeMeta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` 'info' | 'error' | 'success', required — The message type. info Info error Error success Success
      - `type` 'text' | 'input' | 'img' | 'a' | 'script' | 'div', required — The node's type text Text input Input img Image a Anchor script Script div Division

## Other responses

- `401` — errorGeneric
- `403` — errorGeneric
- `404` — errorGeneric
- `410` — errorGeneric
- `default` — errorGeneric

---

[API](https://skmtc.net/ory/apis/ory-kratos.md) · [All operations](https://skmtc.net/ory/apis/ory-kratos/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-kratos/versions/cc87f41fbd6d/schema)