v1

latestSwagger 2.02026-07-1760185352.5 KB

frontend

Update Registration Flow

Use this endpoint to complete a registration flow by sending an identity's traits and password. This endpoint behaves differently for API and browser flows.

API flows expect application/json to be sent in the body and respond with HTTP 200 and a application/json body with the created identity success - if the session hook is configured the session and session_token will also be included; HTTP 410 if the original flow expired with the appropriate error messages set and optionally a use_flow_id parameter in the body; HTTP 400 on form validation errors.

Browser flows expect a Content-Type of application/x-www-form-urlencoded or application/json to be sent in the body and respond with a HTTP 303 redirect to the post/after registration URL or the return_to value if it was set and if the registration succeeded; a HTTP 303 redirect to the registration UI URL with the flow ID containing the validation errors otherwise.

Browser flows with an accept header of application/json will not redirect but instead respond with HTTP 200 and a application/json body with the signed in identity and a Set-Cookie header on success; HTTP 303 redirect to a fresh login flow if the original flow expired with the appropriate error messages set; HTTP 400 on form validation errors.

If this endpoint is called with Accept: application/json in the header, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration! browser_location_change_required: Usually sent when an AJAX request indicates that the browser needs to open a specific URL. Most likely used in Social Sign In flows.

More information can be found at Ory Kratos User Login and User Registration Documentation.

post/self-service/registration

Query parameters

flowstring required

The Registration Flow ID

The value for this parameter comes from flow URL Query parameter sent to your application (e.g. /registration?flow=abcde).

Headers

Cookiestring

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Request body

UpdateRegistrationFlowBody required

Update Registration Request Body

Response

successfulNativeRegistration

continue_withContinueWith[]

Contains a list of actions, that could follow this flow

It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the session.

session_tokenstring

The Session Token

This field is only set when the session hook is configured as a post-registration hook.

A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header:

Authorization: bearer ${session-token}

The session token is only issued for API flows, not for Browser flows!

Example response

{
  "identity": {
    "verifiable_addresses": [
      {
        "created_at": "2014-01-01T23:28:56.782Z",
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified": true,
        "via": "email"
      }
    ]
  },
  "session": {
    "identity": {
      "verifiable_addresses": [
        {
          "created_at": "2014-01-01T23:28:56.782Z",
          "updated_at": "2014-01-01T23:28:56.782Z",
          "verified": true,
          "via": "email"
        }
      ]
    }
  }
}