<!-- Generated by `just docs` from catalog/toolkits/ory_kratos.yaml, catalog/expansions/ory_kratos.yaml, catalog/evals/scorecard.json. Edit the source, not this file. -->

# Ory Identities

User identity and login. Manage identities and their schemas, run registration, recovery, and verification, and end sessions.

| Property | Value |
| --- | --- |
| Slug | `ory_kratos` |
| Definition version | `0.1.0` |
| Base URL | `https://{{account.project_slug}}.projects.oryapis.com` |
| Auth schemes | `api_key` |
| Action tools | 49 |
| By class | 35 read, 13 write, 1 destructive |
| Triggers | 0 |
| Provider rate limit | not declared, so outbound calls are unpaced |

## Measured routing accuracy

63 golden cases replayed through the router over the whole index: measured over corpus `ea4f12ad2948` (65 toolkits, 2283 tools indexed and 13 declared uncallable), 49 cases written by hand and 14 cases from the paraphrase pass. A case counts as top-1 when its gold tool ranked first and top-8 when it reached the slate at all.

| Measure | Cases | Share |
| --- | --- | --- |
| top-1 | 51/63 | 81.0% |
| top-8 | 63/63 | 100.0% |

The sweep is offline: the reranker is a deterministic identity fake that returns candidates in the order retrieval produced them, so top-1 measures retrieval order rather than a reranked slate. `just eval-live` measures the same cases through the live reranker.

## Authentication

Connect an entity with `ConnectionsService.InitiateConnection`, naming this toolkit's slug. Credentials stay in the connections vault; callers hold connected-account ids only.

### `api_key`

| Property | Value |
| --- | --- |
| Placement | `header` |
| Name | `Authorization` |
| Rendered as | `{key}` |

Submit the key with `ConnectionsService` rather than putting it in a request; it is sealed at rest and never returned.

## Tools

49 action tools. The catalog-wide slug is `ory_kratos.<tool>`, which is what `search_tools` returns and `call_tool` takes.

### `ory_kratos.get_web_authn_java_script`

Get WebAuthn JavaScript. This endpoint provides JavaScript which is needed in order to perform WebAuthn login and registration. Calls GET /.well-known/ory/webauthn.js.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /.well-known/ory/webauthn.js`.

Takes no arguments.

Also retrieved by: "the browser script for passkeys", "js needed to register a security key", "client code for webauthn prompts".

### `ory_kratos.list_courier_messages`

List the outbound message queue: the emails and sms Ory has sent or is about to send, filtered by status and recipient. Calls GET /admin/courier/messages.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/courier/messages`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `page_size` | integer (int64) | no | Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |
| `recipient` | string | no | Recipient filters out messages based on recipient. If no value is provided, it doesn't take effect on filter. |
| `status` | string, one of queued, sent, processing, abandoned | no | Status filters out messages based on status. If no value is provided, it doesn't take effect on filter. |

Also retrieved by: "show the outbound email and sms queue", "what mail has Ory sent", "check the delivery queue".

### `ory_kratos.get_courier_message`

Get a Message. Gets a specific messages by the given ID. Calls GET /admin/courier/messages/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/courier/messages/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | MessageID is the ID of the message. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `body` | string |  |
| `channel` | string |  |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `dispatches` | array of object | Dispatches store information about the attempts of delivering a message May contain an error if any happened, or just the `success` state. |
| `dispatches[].created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `dispatches[].error` | object |  |
| `dispatches[].id` | string (uuid) | The ID of this message dispatch |
| `dispatches[].message_id` | string (uuid) | The ID of the message being dispatched |
| `dispatches[].status` | string, one of failed, success | The status of this dispatch Either "failed" or "success" failed CourierMessageDispatchStatusFailed success CourierMessageDispatchStatusSuccess |
| `dispatches[].updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `id` | string (uuid) |  |
| `recipient` | string |  |
| `send_count` | integer (int64) |  |
| `status` | string, one of queued, sent, processing, abandoned | A Message's Status |
| `subject` | string |  |
| `template_type` | string, one of recovery_invalid, recovery_valid, recovery_code_invalid, recovery_code_valid, verification_invalid, verification_valid, verification_code_invalid, verification_code_valid, stub, login_code_valid, registration_code_valid, verifiable_address_changed, authenticator_key_added | recovery_invalid TypeRecoveryInvalid recovery_valid TypeRecoveryValid recovery_code_invalid TypeRecoveryCodeInvalid recovery_code_valid TypeRecoveryCodeValid verification_invalid... |
| `type` | string, one of email, phone | It can either be `email` or `phone` |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |

Also retrieved by: "look up a Message", "check a Message", "pull up a Message".

### `ory_kratos.list_identities`

List the user accounts in the directory: every identity Ory holds, with their traits and credentials. Use to browse or page all users. Calls GET /admin/identities.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/identities`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `consistency` | string, one of , strong, eventual | no | Read Consistency Level (preview) The read consistency level determines the consistency guarantee for reads: strong (slow): The read is guaranteed to return the most recent data committed at the start... |
| `credentials_identifier` | string | no | CredentialsIdentifier is the identifier (username, email) of the credentials to look up using exact match. Only one of CredentialsIdentifier and CredentialsIdentifierSimilar can be used. |
| `ids` | array of string | no | Retrieve multiple identities by their IDs. This parameter has the following limitations: Duplicate or non-existent IDs are ignored. The order of returned IDs may be different from the request. This... |
| `include_credential` | array of string | no | Include Credentials in Response Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh... |
| `organization_id` | string | no | List identities that belong to a specific organization. |
| `page` | integer (int64) | no | Deprecated Pagination Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This value is currently an integer, but it is not sequential. The value is not... |
| `page_size` | integer (int64) | no | Page Size This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |
| `per_page` | integer (int64) | no | Deprecated Items per Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This is the number of items per page. Defaults to 250. |
| `preview_credentials_identifier_similar` | string | no | This is an EXPERIMENTAL parameter that WILL CHANGE. Do NOT rely on consistent, deterministic behavior. THIS PARAMETER WILL BE REMOVED IN AN UPCOMING RELEASE WITHOUT ANY MIGRATION PATH... |

Also retrieved by: "show every user account in the directory", "browse all the users we have", "page through the whole user list".

### `ory_kratos.create_identity`

Add a new user account to the directory: create an identity with its profile traits and credentials. Calls POST /admin/identities.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/identities`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `credentials` | object | no | Create Identity and Import Credentials |
| `credentials.lookup_secret` | object | no | Create Identity and Import Lookup Secret Credentials |
| `credentials.oidc` | object | no | Create Identity and Import Social Sign In Credentials |
| `credentials.passkey` | object | no | Create Identity and Import Passkey Credentials |
| `credentials.password` | object | no | Create Identity and Import Password Credentials |
| `credentials.saml` | object | no | Payload to import SAML credentials |
| `credentials.totp` | object | no | Create Identity and Import TOTP 2FA Credentials |
| `credentials.webauthn` | object | no | Create Identity and Import WebAuthn Credentials |
| `external_id` | string | no | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `metadata_admin` | object | no | Store metadata about the user which is only accessible through admin APIs such as `GET /admin/identities/<id>`. |
| `metadata_public` | object | no | Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this... |
| `organization_id` | string (uuid4) | no |  |
| `recovery_addresses` | array of object | no | RecoveryAddresses contains all the addresses that can be used to recover an identity. Use this structure to import recovery addresses for an identity. Please keep in mind that the address needs to be... |
| `recovery_addresses[].break_glass_for_organization` | string (uuid4) | no |  |
| `recovery_addresses[].created_at` | string (date-time) | no | CreatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].id` | string (uuid) | no |  |
| `recovery_addresses[].updated_at` | string (date-time) | no | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].value` | string | **yes** |  |
| `recovery_addresses[].via` | string | **yes** |  |
| `region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | no | Region is the Ory Network region this identity will be created in. Optional; defaults to the project home region if omitted. Only effective on the Ory Network. eu-central EUCentral asia-northeast... |
| `schema_id` | string | **yes** | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `state` | string, one of active, inactive | no | State is the identity's state. active StateActive inactive StateInactive |
| `traits` | object | **yes** | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `verifiable_addresses` | array of object | no | VerifiableAddresses contains all the addresses that can be verified by the user. Use this structure to import verified addresses for an identity. Please keep in mind that the address needs to be... |
| `verifiable_addresses[].created_at` | string (date-time) | no | When this entry was created |
| `verifiable_addresses[].id` | string (uuid) | no | The ID |
| `verifiable_addresses[].status` | string | **yes** | VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema |
| `verifiable_addresses[].updated_at` | string (date-time) | no | When this entry was last updated |
| `verifiable_addresses[].value` | string | **yes** | The address value example foo@user.com |
| `verifiable_addresses[].verified` | boolean | **yes** | Indicates if the address has already been verified |
| `verifiable_addresses[].verified_at` | string (date-time) | no |  |
| `verifiable_addresses[].via` | string, one of email, sms | **yes** | The delivery method |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `organization_id` | string (uuid4) |  |
| `recovery_addresses` | array of object | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `recovery_addresses[].break_glass_for_organization` | string (uuid4) |  |
| `recovery_addresses[].created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].id` | string (uuid) |  |
| `recovery_addresses[].updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].value` | string |  |
| `recovery_addresses[].via` | string |  |
| `region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `state_changed_at` | string (date-time) |  |
| `traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `verifiable_addresses` | array of object | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `verifiable_addresses[].created_at` | string (date-time) | When this entry was created |
| `verifiable_addresses[].id` | string (uuid) | The ID |
| `verifiable_addresses[].status` | string | VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema |
| `verifiable_addresses[].updated_at` | string (date-time) | When this entry was last updated |
| `verifiable_addresses[].value` | string | The address value example foo@user.com |
| `verifiable_addresses[].verified` | boolean | Indicates if the address has already been verified |
| `verifiable_addresses[].verified_at` | string (date-time) |  |
| `verifiable_addresses[].via` | string, one of email, sms | The delivery method |

Also retrieved by: "add a new user account", "register a person in the directory", "make a new user".

### `ory_kratos.batch_patch_identities`

Create multiple identities. Creates multiple [identities](https://www.ory.com/docs/kratos/concepts/identity-user-model). Calls PATCH /admin/identities.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PATCH /admin/identities`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `identities` | array of object | no | Identities holds the list of patches to apply required |
| `identities[].create` | object | no | Create Identity Body |
| `identities[].patch_id` | string (uuid) | no | The ID of this patch. The patch ID is optional. If specified, the ID will be returned in the response, so consumers of this API can correlate the response with the patch. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `identities` | array of object | The patch responses for the individual identities. |
| `identities[].action` | string, one of create, error | The action for this specific patch create ActionCreate Create this identity. error ActionError Error indicates that the patch failed. |
| `identities[].error` | object | From https://go.dev/wiki/CodeReviewComments#receiver-type: > Can function or methods, either concurrently or when called from this method, be mutating the receiver? A value type creates a copy of the... |
| `identities[].identity` | string (uuid) | The identity ID payload of this patch |
| `identities[].patch_id` | string (uuid) | The ID of this patch response, if an ID was specified in the patch. |

Also retrieved by: "create many user accounts at once", "bulk insert and update people", "apply a list of account changes in one call".

### `ory_kratos.get_identity_by_external_id`

Read one user account by its external id: the identity matched to your own external key rather than Ory's internal id. Calls GET /admin/identities/by/external/{externalID}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/identities/by/external/{{params.externalID}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `externalID` | string | **yes** | ExternalID must be set to the ID of identity you want to get |
| `include_credential` | array of string | no | Include Credentials in Response Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `organization_id` | string (uuid4) |  |
| `recovery_addresses` | array of object | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `recovery_addresses[].break_glass_for_organization` | string (uuid4) |  |
| `recovery_addresses[].created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].id` | string (uuid) |  |
| `recovery_addresses[].updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].value` | string |  |
| `recovery_addresses[].via` | string |  |
| `region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `state_changed_at` | string (date-time) |  |
| `traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `verifiable_addresses` | array of object | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `verifiable_addresses[].created_at` | string (date-time) | When this entry was created |
| `verifiable_addresses[].id` | string (uuid) | The ID |
| `verifiable_addresses[].status` | string | VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema |
| `verifiable_addresses[].updated_at` | string (date-time) | When this entry was last updated |
| `verifiable_addresses[].value` | string | The address value example foo@user.com |
| `verifiable_addresses[].verified` | boolean | Indicates if the address has already been verified |
| `verifiable_addresses[].verified_at` | string (date-time) |  |
| `verifiable_addresses[].via` | string, one of email, sms | The delivery method |

Also retrieved by: "find a user by our own key", "look up an account with a third-party id", "match a person on an external reference".

### `ory_kratos.get_identity`

Read one user account by its internal id: the identity's profile traits, credentials, and state. Calls GET /admin/identities/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/identities/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | ID must be set to the ID of identity you want to get |
| `include_credential` | array of string | no | Include Credentials in Response Include any credential, for example `password` or `oidc`, in the response. When set to `oidc`, This will return the initial OAuth 2.0 Access Token, OAuth 2.0 Refresh... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `organization_id` | string (uuid4) |  |
| `recovery_addresses` | array of object | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `recovery_addresses[].break_glass_for_organization` | string (uuid4) |  |
| `recovery_addresses[].created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].id` | string (uuid) |  |
| `recovery_addresses[].updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].value` | string |  |
| `recovery_addresses[].via` | string |  |
| `region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `state_changed_at` | string (date-time) |  |
| `traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `verifiable_addresses` | array of object | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `verifiable_addresses[].created_at` | string (date-time) | When this entry was created |
| `verifiable_addresses[].id` | string (uuid) | The ID |
| `verifiable_addresses[].status` | string | VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema |
| `verifiable_addresses[].updated_at` | string (date-time) | When this entry was last updated |
| `verifiable_addresses[].value` | string | The address value example foo@user.com |
| `verifiable_addresses[].verified` | boolean | Indicates if the address has already been verified |
| `verifiable_addresses[].verified_at` | string (date-time) |  |
| `verifiable_addresses[].via` | string, one of email, sms | The delivery method |

Also retrieved by: "look up one user account by id", "read a single user's profile", "fetch one person's traits".

### `ory_kratos.update_identity`

Change a user account: update an identity's profile traits, details, and state. Calls PUT /admin/identities/{id}.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PUT /admin/identities/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `credentials` | object | no | Create Identity and Import Credentials |
| `credentials.lookup_secret` | object | no | Create Identity and Import Lookup Secret Credentials |
| `credentials.oidc` | object | no | Create Identity and Import Social Sign In Credentials |
| `credentials.passkey` | object | no | Create Identity and Import Passkey Credentials |
| `credentials.password` | object | no | Create Identity and Import Password Credentials |
| `credentials.saml` | object | no | Payload to import SAML credentials |
| `credentials.totp` | object | no | Create Identity and Import TOTP 2FA Credentials |
| `credentials.webauthn` | object | no | Create Identity and Import WebAuthn Credentials |
| `external_id` | string | no | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `id` | string | **yes** | ID must be set to the ID of identity you want to update |
| `metadata_admin` | object | no | Store metadata about the user which is only accessible through admin APIs such as `GET /admin/identities/<id>`. |
| `metadata_public` | object | no | Store metadata about the identity which the identity itself can see when calling for example the session endpoint. Do not store sensitive information (e.g. credit score) about the identity in this... |
| `region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | no | Region is the Ory Network region this identity is homed in. Optional; omit to leave the current region unchanged. eu-central EUCentral asia-northeast AsiaNorthEast us-east USEast us-west USWest eu EU... |
| `schema_id` | string | **yes** | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. If set will update the Identity's SchemaID. |
| `state` | string, one of active, inactive | **yes** | State is the identity's state. active StateActive inactive StateInactive |
| `traits` | object | **yes** | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `organization_id` | string (uuid4) |  |
| `recovery_addresses` | array of object | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `recovery_addresses[].break_glass_for_organization` | string (uuid4) |  |
| `recovery_addresses[].created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].id` | string (uuid) |  |
| `recovery_addresses[].updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `recovery_addresses[].value` | string |  |
| `recovery_addresses[].via` | string |  |
| `region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `state_changed_at` | string (date-time) |  |
| `traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `verifiable_addresses` | array of object | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `verifiable_addresses[].created_at` | string (date-time) | When this entry was created |
| `verifiable_addresses[].id` | string (uuid) | The ID |
| `verifiable_addresses[].status` | string | VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema |
| `verifiable_addresses[].updated_at` | string (date-time) | When this entry was last updated |
| `verifiable_addresses[].value` | string | The address value example foo@user.com |
| `verifiable_addresses[].verified` | boolean | Indicates if the address has already been verified |
| `verifiable_addresses[].verified_at` | string (date-time) |  |
| `verifiable_addresses[].via` | string, one of email, sms | The delivery method |

Also retrieved by: "change a user's profile traits", "edit a person's account details", "modify one user's state".

### `ory_kratos.list_identity_sessions`

List an Identity's Sessions. This endpoint returns all sessions that belong to the given Identity. Calls GET /admin/identities/{id}/sessions.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/identities/{{params.id}}/sessions`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `active` | boolean | no | Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned. |
| `id` | string | **yes** | ID is the identity's ID. |
| `page` | integer (int64) | no | Deprecated Pagination Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This value is currently an integer, but it is not sequential. The value is not... |
| `page_size` | integer (int64) | no | Page Size This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |
| `per_page` | integer (int64) | no | Deprecated Items per Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This is the number of items per page. Defaults to 250. |

Also retrieved by: "where is this person signed in", "active logins for one account", "every device a user has a session on".

### `ory_kratos.create_recovery_code_for_identity`

Generate a one-time reset code for a user account: a short pin the person enters to recover or activate their account. Calls POST /admin/recovery/code.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/recovery/code`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `expires_in` | string | no | Code Expires In The recovery code will expire after that amount of time has passed. Defaults to the configuration value of `selfservice.methods.code.config.lifespan`. |
| `flow_type` | string | no | The flow type can either be `api` or `browser`. |
| `identity_id` | string (uuid) | **yes** | Identity to Recover The identity's ID you wish to recover. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `expires_at` | string (date-time) | Expires At is the timestamp of when the recovery flow expires The timestamp when the recovery code expires. |
| `recovery_code` | string | RecoveryCode is the code that can be used to recover the account |
| `recovery_link` | string | RecoveryLink with flow This link opens the recovery UI with an empty `code` field. |

Also retrieved by: "generate a one-time reset pin for a user", "issue an account recovery code", "give someone a code to regain access".

### `ory_kratos.create_recovery_link_for_identity`

Generate a password reset link for a user account: a recovery url to email the person so they can regain access. Calls POST /admin/recovery/link.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/recovery/link`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `expires_in` | string | no | Link Expires In The recovery link will expire after that amount of time has passed. Defaults to the configuration value of `selfservice.methods.code.config.lifespan`. |
| `identity_id` | string (uuid) | **yes** | Identity to Recover The identity's ID you wish to recover. |
| `return_to` | string | no |  |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `expires_at` | string (date-time) | Recovery Link Expires At The timestamp when the recovery link expires. |
| `recovery_link` | string | Recovery Link This link can be used to recover the account. |

Also retrieved by: "make a password reset url for a user", "email someone a recovery link", "send a link to regain access".

### `ory_kratos.list_sessions`

List every active login on the system: all sessions across all user accounts. Calls GET /admin/sessions.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/sessions`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `active` | boolean | no | Active is a boolean flag that filters out sessions based on the state. If no value is provided, all sessions are returned. |
| `expand` | array of string | no | ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session. If no value is provided, the expandable properties are skipped. |
| `page_size` | integer (int64) | no | Items per Page This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |

Also retrieved by: "show every active login on the system", "who is signed in right now, everyone", "list all logins across all users".

### `ory_kratos.manage_sessions`

Manage sessions in bulk. Disable or delete sessions for a list of identities or a list of sessions in a single call. Calls POST /admin/sessions.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/sessions`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `action` | string, one of disable, delete | **yes** | Action to perform on the matching sessions. disable ManageSessionsActionDisable delete ManageSessionsActionDelete |
| `identities` | array of string | no | Identity IDs whose sessions should be disabled or deleted, or `["*"]` to operate on every session in the network. Mutually exclusive with `sessions`. |
| `sessions` | array of string | no | Session IDs to disable or delete. Mutually exclusive with `identities`. The wildcard `["*"]` is not accepted in this field — pass `identities: ["*"]` to scope the operation to every session in the... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `more` | boolean | True when the call reached the per-call batch limit and additional matching rows may remain. Always false for explicit-IDs requests. |
| `processed` | integer (int64) | Number of sessions processed in this call. For `disable`, counts only sessions that were active before the call (already-inactive sessions are skipped). For `delete`, counts every matching row... |

Also retrieved by: "sign many people out at once", "disable or delete logins in bulk", "revoke sessions for a list of accounts".

### `ory_kratos.get_session`

Read one active login by its id: the session object for a signed-in user account. Calls GET /admin/sessions/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /admin/sessions/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `expand` | array of string | no | ExpandOptions is a query parameter encoded list of all properties that must be expanded in the Session. Example - ?expand=Identity&expand=Devices If no value is provided, the expandable properties... |
| `id` | string | **yes** | ID is the session's ID. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | boolean | Active state. If false the session is no longer active. |
| `authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `authentication_methods` | array of object | A list of authenticators which were used to authenticate the session. |
| `authentication_methods[].aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `authentication_methods[].completed_at` | string (date-time) | When the authentication challenge was completed. |
| `authentication_methods[].method` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The method used in this authenticator. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code... |
| `authentication_methods[].organization` | string | The Organization id used for authentication |
| `authentication_methods[].provider` | string | OIDC or SAML provider id used for authentication |
| `authentication_methods[].upstream_acr` | string | UpstreamACR is the `acr` claim reported by the upstream OIDC provider, if any. Populated only for OIDC login methods when the upstream ID token contained an `acr` claim. |
| `authentication_methods[].upstream_amr` | array | UpstreamAMR is the `amr` claim reported by the upstream OIDC provider, if any. Populated only for OIDC login methods when the upstream ID token contained an `amr` claim. |
| `authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `devices` | array of object | Devices has history of all endpoints where the session was used |
| `devices[].id` | string (uuid) | Device record ID |
| `devices[].ip_address` | string | IPAddress of the client |
| `devices[].location` | string | Geo Location corresponding to the IP Address |
| `devices[].user_agent` | string | UserAgent of the client |
| `expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `id` | string (uuid) | Session ID |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |

Also retrieved by: "look up one active login by id", "read a single signed-in session", "fetch one login object".

### `ory_kratos.extend_session`

Extend a Session. Calling this endpoint extends the given session ID. Calls PATCH /admin/sessions/{id}/extend.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `PATCH /admin/sessions/{{params.id}}/extend`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | ID is the session's ID. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | boolean | Active state. If false the session is no longer active. |
| `authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `authentication_methods` | array of object | A list of authenticators which were used to authenticate the session. |
| `authentication_methods[].aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `authentication_methods[].completed_at` | string (date-time) | When the authentication challenge was completed. |
| `authentication_methods[].method` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The method used in this authenticator. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code... |
| `authentication_methods[].organization` | string | The Organization id used for authentication |
| `authentication_methods[].provider` | string | OIDC or SAML provider id used for authentication |
| `authentication_methods[].upstream_acr` | string | UpstreamACR is the `acr` claim reported by the upstream OIDC provider, if any. Populated only for OIDC login methods when the upstream ID token contained an `acr` claim. |
| `authentication_methods[].upstream_amr` | array | UpstreamAMR is the `amr` claim reported by the upstream OIDC provider, if any. Populated only for OIDC login methods when the upstream ID token contained an `amr` claim. |
| `authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `devices` | array of object | Devices has history of all endpoints where the session was used |
| `devices[].id` | string (uuid) | Device record ID |
| `devices[].ip_address` | string | IPAddress of the client |
| `devices[].location` | string | Geo Location corresponding to the IP Address |
| `devices[].user_agent` | string | UserAgent of the client |
| `expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `id` | string (uuid) | Session ID |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |

Also retrieved by: "change a Session", "edit a Session", "adjust a Session".

### `ory_kratos.create_test_login_flow`

Create a test OIDC login flow. Creates a dry-run OIDC test login flow pre-scoped to one provider. Calls POST /admin/test-login-flows.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /admin/test-login-flows`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `provider_id` | string | **yes** | ID of the OIDC provider to test. Must match a provider configured on the project that serves this request. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The active login method If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow started. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `refresh` | boolean | Refresh stores whether this login flow should enforce re-authentication. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `requested_aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method to sign in with sent_email: the email has been sent to the user passed_challenge: the request was successful... |
| `test_context` | object | Admin-test extension of a login flow. Populated only for flows created by the admin test endpoint; included in the flow's API response so the admin UI can render the pre-scoped provider and (once... |
| `test_context.debug_payload` | object | Contains the parsed claims, the Jsonnet mapper input and output, and any schema validation errors. Bearer tokens (id_token, access_token, refresh_token) are intentionally excluded to limit the blast... |
| `test_context.provider_id` | string | The ID of the OIDC provider this test flow targets. |
| `transient_payload` | object | TransientPayload is used to pass data from the login to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |

Also retrieved by: "dry-run a sign-in against one provider", "make a throwaway oidc journey for testing", "try social login without a real user".

### `ory_kratos.is_alive`

Check HTTP Server Status. This endpoint returns a HTTP 200 status code when Ory Kratos is accepting incoming HTTP requests. Calls GET /health/alive.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /health/alive`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `status` | string | Always "ok". |

Also retrieved by: "is the process responding", "liveness probe for the service", "does the server answer requests yet".

### `ory_kratos.is_ready`

Check HTTP Server and Database Status. This endpoint returns a HTTP 200 status code when Ory Kratos is up running and the environment dependencies (e.g. Calls GET /health/ready.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /health/ready`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `status` | string | Always "ok". |

Also retrieved by: "can the service take traffic", "readiness including the database", "are dependencies connected".

### `ory_kratos.list_identity_schemas`

Get all Identity Schemas. Returns a list of all identity schemas currently in use. Calls GET /schemas.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /schemas`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `page` | integer (int64) | no | Deprecated Pagination Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This value is currently an integer, but it is not sequential. The value is not... |
| `page_size` | integer (int64) | no | Page Size This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |
| `per_page` | integer (int64) | no | Deprecated Items per Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This is the number of items per page. Defaults to 250. |

Also retrieved by: "every account model in use", "which traits definitions exist", "all user json schemas on this instance".

### `ory_kratos.get_identity_schema`

Get Identity JSON Schema. Return a specific identity schema. Calls GET /schemas/{id}.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /schemas/{{params.id}}`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | ID must be set to the ID of schema you want to get |

Also retrieved by: "the traits definition one account type uses", "read a json schema by id", "which fields does this user model allow".

### `ory_kratos.get_flow_error`

Get User-Flow Errors. This endpoint returns the error associated with a user-facing self service errors. Calls GET /self-service/errors.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/errors`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `id` | string | **yes** | Error is the error's ID |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `error` | object |  |
| `id` | string (uuid) | ID of the error container. |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |

Also retrieved by: "why did a self-service journey fail", "read the error behind a redirect", "details of a failed sign-in attempt".

### `ory_kratos.create_fedcm_flow`

Get FedCM Parameters. This endpoint returns a list of all available FedCM providers. Calls GET /self-service/fed-cm/parameters.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/fed-cm/parameters`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `csrf_token` | string |  |
| `providers` | array of object |  |
| `providers[].client_id` | string | The RP's client identifier, issued by the IdP. |
| `providers[].config_url` | string | A full path of the IdP config file. |
| `providers[].domain_hint` | string | By specifying one of domain_hints values provided by the accounts endpoints, the FedCM dialog selectively shows the specified account. |
| `providers[].fields` | array | Array of strings that specifies the user information ("name", " email", "picture") that RP needs IdP to share with them. Note: Field API is supported by Chrome 132 and later. |
| `providers[].login_hint` | string | By specifying one of login_hints values provided by the accounts endpoints, the FedCM dialog selectively shows the specified account. |
| `providers[].nonce` | string | A random string to ensure the response is issued for this specific request. Prevents replay attacks. |
| `providers[].parameters` | object | Custom object that allows to specify additional key-value parameters: scope: A string value containing additional permissions that RP needs to request, for example " drive.readonly calendar.readonly"... |

Also retrieved by: "which fedcm providers are available", "parameters for browser federated sign-in", "config the identity chooser needs".

### `ory_kratos.update_fedcm_flow`

Submit a FedCM token. Use this endpoint to submit a token from a FedCM provider through `navigator.credentials.get` and log the user in. Calls POST /self-service/fed-cm/token.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /self-service/fed-cm/token`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `csrf_token` | string | **yes** | CSRFToken is the anti-CSRF token. |
| `nonce` | string | no | Nonce is the nonce that was used in the `navigator.credentials.get` call. If specified, it must match the `nonce` claim in the token. |
| `token` | string | **yes** | Token contains the result of `navigator.credentials.get`. |
| `transient_payload` | object | no | Transient data to pass along to any webhooks. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the... |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `session` | object | A Session |
| `session.active` | boolean | Active state. If false the session is no longer active. |
| `session.authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `session.authentication_methods` | array | A list of authenticators which were used to authenticate the session. |
| `session.authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `session.devices` | array | Devices has history of all endpoints where the session was used |
| `session.expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `session.id` | string (uuid) | Session ID |
| `session.identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `session.issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `session.tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |
| `session_token` | string | The Session Token A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for... |

Also retrieved by: "submit a token from the browser identity chooser", "finish federated sign-in with a credential", "log the user in from navigator credentials".

### `ory_kratos.update_login_flow`

Submit a Login Flow. Use this endpoint to complete a login flow. Calls POST /self-service/login.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /self-service/login`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `X_Session_Token` | string | no | The Session Token of the Identity performing the settings flow. |
| `csrf_token` | string | no | Sending the anti-csrf token is only required for browser login flows. |
| `flow` | string | **yes** | The Login Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/login?flow=abcde`). |
| `identifier` | string | **yes** | Identifier is the email or username of the user trying to log in. |
| `method` | string | **yes** | Method should be set to "password" when logging in using the identifier and password strategy. |
| `password` | string | **yes** | The user's password. |
| `password_identifier` | string | no | Identifier is the email or username of the user trying to log in. This field is deprecated! |
| `transient_payload` | object | no | Transient data to pass along to any webhooks |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the... |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `session` | object | A Session |
| `session.active` | boolean | Active state. If false the session is no longer active. |
| `session.authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `session.authentication_methods` | array | A list of authenticators which were used to authenticate the session. |
| `session.authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `session.devices` | array | Devices has history of all endpoints where the session was used |
| `session.expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `session.id` | string (uuid) | Session ID |
| `session.identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `session.issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `session.tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |
| `session_token` | string | The Session Token A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for... |

Also retrieved by: "submit a password and finish signing in", "complete an authentication journey", "send credentials to log someone in".

### `ory_kratos.create_native_login_flow`

Start a sign-in from a mobile app or API client: begin a login flow that returns JSON, for phones, smart TVs, and native apps rather than a web browser. Calls GET /self-service/login/api.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/login/api`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `X_Session_Token` | string | no | The Session Token of the Identity performing the settings flow. |
| `aal` | string | no | Request a Specific AuthenticationMethod Assurance Level Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor... |
| `identity_schema` | string | no | An optional identity schema to use for the login flow. |
| `organization` | string | no | An optional organization ID that should be used for logging this user in. This parameter is only effective in the Ory Network. |
| `refresh` | boolean | no | Refresh a login session If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session. |
| `return_session_token_exchange_code` | boolean | no | EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed. |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |
| `via` | string | no | Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows. DEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The active login method If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow started. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `refresh` | boolean | Refresh stores whether this login flow should enforce re-authentication. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `requested_aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method to sign in with sent_email: the email has been sent to the user passed_challenge: the request was successful... |
| `test_context` | object | Admin-test extension of a login flow. Populated only for flows created by the admin test endpoint; included in the flow's API response so the admin UI can render the pre-scoped provider and (once... |
| `test_context.debug_payload` | object | Contains the parsed claims, the Jsonnet mapper input and output, and any schema validation errors. Bearer tokens (id_token, access_token, refresh_token) are intentionally excluded to limit the blast... |
| `test_context.provider_id` | string | The ID of the OIDC provider this test flow targets. |
| `transient_payload` | object | TransientPayload is used to pass data from the login to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |

Also retrieved by: "begin a sign-in from a mobile app", "start an api login for a phone", "kick off a json login for a native client".

### `ory_kratos.create_browser_login_flow`

Start a web sign-in for a user in their browser: begin a redirect-based login flow that returns an HTML page and cookies. Calls GET /self-service/login/browser.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/login/browser`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `aal` | string | no | Request a Specific AuthenticationMethod Assurance Level Use this parameter to upgrade an existing session's authenticator assurance level (AAL). This allows you to ask for multi-factor... |
| `identity_schema` | string | no | An optional identity schema to use for the login flow. |
| `login_challenge` | string | no | An optional Hydra login challenge. If present, Kratos will cooperate with Ory Hydra to act as an OAuth2 identity provider. The value for this parameter comes from `login_challenge` URL Query... |
| `organization` | string | no | An optional organization ID that should be used for logging this user in. This parameter is only effective in the Ory Network. |
| `refresh` | boolean | no | Refresh a login session If set to true, this will refresh an existing login session by asking the user to sign in again. This will reset the authenticated_at time of the session. |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |
| `via` | string | no | Via should contain the identity's credential the code should be sent to. Only relevant in aal2 flows. DEPRECATED: This field is deprecated. Please remove it from your requests. The user will now see... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The active login method If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow started. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `refresh` | boolean | Refresh stores whether this login flow should enforce re-authentication. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `requested_aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method to sign in with sent_email: the email has been sent to the user passed_challenge: the request was successful... |
| `test_context` | object | Admin-test extension of a login flow. Populated only for flows created by the admin test endpoint; included in the flow's API response so the admin UI can render the pre-scoped provider and (once... |
| `test_context.debug_payload` | object | Contains the parsed claims, the Jsonnet mapper input and output, and any schema validation errors. Bearer tokens (id_token, access_token, refresh_token) are intentionally excluded to limit the blast... |
| `test_context.provider_id` | string | The ID of the OIDC provider this test flow targets. |
| `transient_payload` | object | TransientPayload is used to pass data from the login to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |

Also retrieved by: "begin a web sign-in in the browser", "start a redirect login for a page", "kick off an html login for a user".

### `ory_kratos.get_login_flow`

Get Login Flow. This endpoint returns a login flow's context with, for example, error details and other information. Calls GET /self-service/login/flows.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/login/flows`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `id` | string | **yes** | The Login Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/login?flow=abcde`). |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The active login method If set contains the login method used. If the flow is new, it is unset. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the login flow, this represents the id in the login UI's query parameter: http://<selfservice.flows.login.ui_url>/?flow=<flow_id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow started. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `refresh` | boolean | Refresh stores whether this login flow should enforce re-authentication. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `requested_aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the login flow has been completed. This is only set if the client has requested a session... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method to sign in with sent_email: the email has been sent to the user passed_challenge: the request was successful... |
| `test_context` | object | Admin-test extension of a login flow. Populated only for flows created by the admin test endpoint; included in the flow's API response so the admin UI can render the pre-scoped provider and (once... |
| `test_context.debug_payload` | object | Contains the parsed claims, the Jsonnet mapper input and output, and any schema validation errors. Bearer tokens (id_token, access_token, refresh_token) are intentionally excluded to limit the blast... |
| `test_context.provider_id` | string | The ID of the OIDC provider this test flow targets. |
| `transient_payload` | object | TransientPayload is used to pass data from the login to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |
| `updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |

Also retrieved by: "look up Login Flow", "check Login Flow", "pull up Login Flow".

### `ory_kratos.create_browser_logout_flow`

Create a Logout URL for Browsers. This endpoint initializes a browser-based user logout flow and a URL which can be used to log out the user. Calls GET /self-service/logout/browser.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/logout/browser`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `cookie` | string | no | HTTP Cookies If you call this endpoint from a backend, please include the original Cookie header in the request. |
| `return_to` | string | no | Return to URL The URL to which the browser should be redirected to after the logout has been performed. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `logout_token` | string | LogoutToken can be used to perform logout using AJAX. |
| `logout_url` | string | LogoutURL can be opened in a browser to sign the user out. format: uri |

Also retrieved by: "start signing a user out of the browser", "get the url that ends a web session", "begin browser sign-out".

### `ory_kratos.update_recovery_flow`

Update Recovery Flow. Use this endpoint to update a recovery flow. Calls POST /self-service/recovery.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /self-service/recovery`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `csrf_token` | string | no | Sending the anti-csrf token is only required for browser login flows. |
| `email` | string | **yes** | Email to Recover Needs to be set when initiating the flow. If the email is a registered recovery email, a recovery link will be sent. If the email is not known, an email with details on what happened... |
| `flow` | string | **yes** | The Recovery Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/recovery?flow=abcde`). |
| `method` | string, one of link, code | **yes** | Method is the method that should be used for this recovery flow Allowed values are `link` and `code` link RecoveryStrategyLink code RecoveryStrategyCode |
| `token` | string | no | Recovery Token The recovery token which completes the recovery request. If the token is invalid (e.g. expired) an error will be shown to the end-user. This parameter is usually set in a link and not... |
| `transient_payload` | object | no | Transient data to pass along to any webhooks |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the recovery method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains possible actions that could follow this flow |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the recovery flow, this represents the id in the recovery ui's query parameter: http://<selfservice.flows.recovery.ui_url>?request=<id> |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the... |
| `transient_payload` | object | TransientPayload is used to pass data from the recovery flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "submit a recovery code", "finish resetting a forgotten password", "complete account recovery with the emailed link".

### `ory_kratos.create_native_recovery_flow`

Create Recovery Flow for Native Apps. This endpoint initiates a recovery flow for API clients such as mobile devices, smart TVs, and so on. Calls GET /self-service/recovery/api.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/recovery/api`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the recovery method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains possible actions that could follow this flow |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the recovery flow, this represents the id in the recovery ui's query parameter: http://<selfservice.flows.recovery.ui_url>?request=<id> |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the... |
| `transient_payload` | object | TransientPayload is used to pass data from the recovery flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start account recovery from a mobile app", "begin forgot-password on an api client", "kick off password reset for native".

### `ory_kratos.create_browser_recovery_flow`

Create Recovery Flow for Browsers. This endpoint initializes a browser-based account recovery flow. Calls GET /self-service/recovery/browser.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/recovery/browser`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |
| `skip_settings` | string | no | Skip redirection to the settings UI after the recovery flow was completed. Instead, the user will be redirected to the URL specified in `return_to` query parameter or the default return URL if... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the recovery method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains possible actions that could follow this flow |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the recovery flow, this represents the id in the recovery ui's query parameter: http://<selfservice.flows.recovery.ui_url>?request=<id> |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the... |
| `transient_payload` | object | TransientPayload is used to pass data from the recovery flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start account recovery in a web page", "begin a forgot-password journey for browsers", "kick off password reset from the site".

### `ory_kratos.get_recovery_flow`

Get Recovery Flow. This endpoint returns a recovery flow's context with, for example, error details and other information. Calls GET /self-service/recovery/flows.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/recovery/flows`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `id` | string | **yes** | The Flow ID The value for this parameter comes from `request` URL Query parameter sent to your application (e.g. `/recovery?flow=abcde`). |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the recovery method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains possible actions that could follow this flow |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the recovery flow, this represents the id in the recovery ui's query parameter: http://<selfservice.flows.recovery.ui_url>?request=<id> |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the... |
| `transient_payload` | object | TransientPayload is used to pass data from the recovery flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "state of a password reset in progress", "read a recovery journey and its errors", "what step is account recovery on".

### `ory_kratos.update_registration_flow`

Update Registration Flow. Use this endpoint to complete a registration flow by sending an identity's traits and password. Calls POST /self-service/registration.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /self-service/registration`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `csrf_token` | string | no | The CSRF Token |
| `flow` | string | **yes** | The Registration Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/registration?flow=abcde`). |
| `method` | string | **yes** | Method to use This field must be set to `password` when using the password method. |
| `password` | string | **yes** | Password to sign the user up with |
| `traits` | object | **yes** | The identity's traits |
| `transient_payload` | object | no | Transient data to pass along to any webhooks |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the... |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `session` | object | A Session |
| `session.active` | boolean | Active state. If false the session is no longer active. |
| `session.authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `session.authentication_methods` | array | A list of authenticators which were used to authenticate the session. |
| `session.authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `session.devices` | array | Devices has history of all endpoints where the session was used |
| `session.expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `session.id` | string (uuid) | Session ID |
| `session.identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `session.issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `session.tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |
| `session_token` | string | The Session Token This field is only set when the session hook is configured as a post-registration hook. A session token is equivalent to a session cookie, but it can be sent in the HTTP... |

Also retrieved by: "submit traits and a password to sign up", "finish creating an account", "complete the register journey".

### `ory_kratos.create_native_registration_flow`

Create Registration Flow for Native Apps. This endpoint initiates a registration flow for API clients such as mobile devices, smart TVs, and so on. Calls GET /self-service/registration/api.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/registration/api`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `identity_schema` | string | no | An optional identity schema to use for the registration flow. |
| `organization` | string | no | An optional organization ID that should be used to register this user. This parameter is only effective in the Ory Network. |
| `return_session_token_exchange_code` | boolean | no | EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed. |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the registration flow, this represents the id in the registration ui's query parameter: http://<selfservice.flows.registration.ui_url>/?flow=<id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow occurred. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the flow has been completed. This is only set if the client has requested a session token... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. registration with email) sent_email: the email has been sent to the user passed_challenge: the request... |
| `transient_payload` | object | TransientPayload is used to pass data from the registration to a webhook |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start signup from a mobile app", "begin account creation on an api client", "open the register journey for native".

### `ory_kratos.create_browser_registration_flow`

Create Registration Flow for Browsers. This endpoint initializes a browser-based user registration flow. Calls GET /self-service/registration/browser.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/registration/browser`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `after_verification_return_to` | string | no | The URL to return the browser to after the verification flow was completed. After the registration flow is completed, the user will be sent a verification email. Upon completing the verification... |
| `identity_schema` | string | no | An optional identity schema to use for the registration flow. |
| `login_challenge` | string | no | Ory OAuth 2.0 Login Challenge. If set will cooperate with Ory OAuth2 and OpenID to act as an OAuth2 server / OpenID Provider. The value for this parameter comes from `login_challenge` URL Query... |
| `organization` | string | no | An optional organization ID that should be used to register this user. This parameter is only effective in the Ory Network. |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the registration flow, this represents the id in the registration ui's query parameter: http://<selfservice.flows.registration.ui_url>/?flow=<id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow occurred. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the flow has been completed. This is only set if the client has requested a session token... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. registration with email) sent_email: the email has been sent to the user passed_challenge: the request... |
| `transient_payload` | object | TransientPayload is used to pass data from the registration to a webhook |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start signup in a web page", "begin browser account creation", "open the register journey for a site".

### `ory_kratos.get_registration_flow`

Get Registration Flow. This endpoint returns a registration flow's context with, for example, error details and other information. Calls GET /self-service/registration/flows.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/registration/flows`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `id` | string | **yes** | The Registration Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/registration?flow=abcde`). |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret... |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the registration flow, this represents the id in the registration ui's query parameter: http://<selfservice.flows.registration.ui_url>/?flow=<id> |
| `identity_schema` | string | IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow occurred. |
| `oauth2_login_challenge` | string | Ory OAuth 2.0 Login Challenge. This value is set using the `login_challenge` query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an... |
| `oauth2_login_request` | object | OAuth2LoginRequest struct for OAuth2LoginRequest |
| `oauth2_login_request.challenge` | string | ID is the identifier (\"login challenge\") of the login request. It is used to identify the session. |
| `oauth2_login_request.client` | object |  |
| `oauth2_login_request.oidc_context` | object | OAuth2ConsentRequestOpenIDConnectContext struct for OAuth2ConsentRequestOpenIDConnectContext |
| `oauth2_login_request.request_url` | string | RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is... |
| `oauth2_login_request.requested_access_token_audience` | array |  |
| `oauth2_login_request.requested_scope` | array |  |
| `oauth2_login_request.session_id` | string | SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication... |
| `oauth2_login_request.skip` | boolean | Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to... |
| `oauth2_login_request.subject` | string | Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST... |
| `organization_id` | string (uuid4) |  |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `session_token_exchange_code` | string | SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the flow has been completed. This is only set if the client has requested a session token... |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. registration with email) sent_email: the email has been sent to the user passed_challenge: the request... |
| `transient_payload` | object | TransientPayload is used to pass data from the registration to a webhook |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "state of a signup in progress", "read a register journey and its form fields", "what step is account creation on".

### `ory_kratos.create_native_settings_flow`

Create Settings Flow for Native Apps. This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on. Calls GET /self-service/settings/api.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/settings/api`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `X_Session_Token` | string | no | The Session Token of the Identity performing the settings flow. |
| `organization` | string | no | An optional organization ID that scopes the settings flow to providers of that organization. This parameter is only effective in the Ory Network. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, contain a reference to the verification flow, created as part of the user's registration. |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id> |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow occurred. |
| `organization_id` | string (uuid4) |  |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this flow. It knows two states: show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings... |
| `transient_payload` | object | TransientPayload is used to pass data from the settings flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start profile editing from a mobile app", "begin changing account details on an api client", "open self-service settings for native".

### `ory_kratos.create_browser_settings_flow`

Create Settings Flow for Browsers. This endpoint initializes a browser-based user settings flow. Calls GET /self-service/settings/browser.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/settings/browser`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `organization` | string | no | An optional organization ID that scopes the settings flow to providers of that organization. This parameter is only effective in the Ory Network. |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, contain a reference to the verification flow, created as part of the user's registration. |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id> |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow occurred. |
| `organization_id` | string (uuid4) |  |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this flow. It knows two states: show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings... |
| `transient_payload` | object | TransientPayload is used to pass data from the settings flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start profile editing in a web page", "begin the browser journey for changing account details", "open self-service settings on the site".

### `ory_kratos.get_settings_flow`

Get Settings Flow. When accessing this endpoint through Ory Kratos' Public API you must ensure that either the Ory Kratos Session Cookie or the Ory Kratos Session Token are set. Calls GET /self-service/settings/flows.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/settings/flows`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `X_Session_Token` | string | no | The Session Token When using the SDK in an app without a browser, please include the session token here. |
| `id` | string | **yes** | ID is the Settings Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/settings?flow=abcde`). |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, contain a reference to the verification flow, created as part of the user's registration. |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated. |
| `id` | string (uuid) | ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id> |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the flow occurred. |
| `organization_id` | string (uuid4) |  |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this flow. It knows two states: show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings... |
| `transient_payload` | object | TransientPayload is used to pass data from the settings flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "state of a profile edit in progress", "read the settings journey and its errors", "what step is changing account details on".

### `ory_kratos.update_verification_flow`

Complete Verification Flow. Use this endpoint to complete a verification flow. Calls POST /self-service/verification.

Class `write` (writes, no confirmation needed). No scopes beyond the connection's defaults. Calls `POST /self-service/verification`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | HTTP Cookies When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are... |
| `csrf_token` | string | no | Sending the anti-csrf token is only required for browser login flows. |
| `email` | string | **yes** | Email to Verify Needs to be set when initiating the flow. If the email is a registered verification email, a verification link will be sent. If the email is not known, a email with details on what... |
| `flow` | string | **yes** | The Verification Flow ID The value for this parameter comes from `flow` URL Query parameter sent to your application (e.g. `/verification?flow=abcde`). |
| `method` | string, one of link, code | **yes** | Method is the method that should be used for this verification flow Allowed values are `link` and `code` link VerificationStrategyLink code VerificationStrategyCode |
| `token` | string | no | Verification Token The verification token which completes the verification request. If the token is invalid (e.g. expired) an error will be shown to the end-user. This parameter is usually set in a... |
| `transient_payload` | object | no | Transient data to pass along to any webhooks |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the verification flow, this represents the id in the verify ui's query parameter: http://<selfservice.flows.verification.ui_url>?request=<id>... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. verify your email) sent_email: the email has been sent to the user passed_challenge: the request was... |
| `transient_payload` | object | TransientPayload is used to pass data from the verification flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "submit the emailed confirmation code", "finish verifying an address", "complete email confirmation".

### `ory_kratos.create_native_verification_flow`

Create Verification Flow for Native Apps. This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on. Calls GET /self-service/verification/api.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/verification/api`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `return_to` | string | no | A URL contained in the return_to key of the verification flow. This piece of data has no effect on the actual logic of the flow and is purely informational. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the verification flow, this represents the id in the verify ui's query parameter: http://<selfservice.flows.verification.ui_url>?request=<id>... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. verify your email) sent_email: the email has been sent to the user passed_challenge: the request was... |
| `transient_payload` | object | TransientPayload is used to pass data from the verification flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start email confirmation from a mobile app", "begin address verification on an api client", "open the confirm-your-email journey for native".

### `ory_kratos.create_browser_verification_flow`

Create Verification Flow for Browser Clients. This endpoint initializes a browser-based account verification flow. Calls GET /self-service/verification/browser.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/verification/browser`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `return_to` | string | no | The URL to return the browser to after the flow was completed. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the verification flow, this represents the id in the verify ui's query parameter: http://<selfservice.flows.verification.ui_url>?request=<id>... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. verify your email) sent_email: the email has been sent to the user passed_challenge: the request was... |
| `transient_payload` | object | TransientPayload is used to pass data from the verification flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "start email confirmation in a web page", "begin browser address verification", "open the confirm-your-email journey on a site".

### `ory_kratos.get_verification_flow`

Get Verification Flow. This endpoint returns a verification flow's context with, for example, error details and other information. Calls GET /self-service/verification/flows.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /self-service/verification/flows`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `cookie` | string | no | HTTP Cookies When using the SDK on the server side you must include the HTTP Cookie Header originally sent to your HTTP handler here. |
| `id` | string | **yes** | The Flow ID The value for this parameter comes from `request` URL Query parameter sent to your application (e.g. `/verification?flow=abcde`). |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | string | Active, if set, contains the registration method that is being used. It is initially not set. |
| `expires_at` | string (date-time) | ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated. |
| `id` | string (uuid) | ID represents the request's unique ID. When performing the verification flow, this represents the id in the verify ui's query parameter: http://<selfservice.flows.verification.ui_url>?request=<id>... |
| `issued_at` | string (date-time) | IssuedAt is the time (UTC) when the request occurred. |
| `request_url` | string | RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example. |
| `return_to` | string | ReturnTo contains the requested return_to URL. |
| `state` | object | State represents the state of this request: choose_method: ask the user to choose a method (e.g. verify your email) sent_email: the email has been sent to the user passed_challenge: the request was... |
| `transient_payload` | object | TransientPayload is used to pass data from the verification flow to hooks and email templates |
| `type` | string | The flow type can either be `api` or `browser`. |
| `ui` | object | Container represents a HTML Form. The container can work with both HTTP Form and JSON requests |
| `ui.action` | string | Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`. |
| `ui.messages` | array |  |
| `ui.method` | string | Method is the form method (e.g. POST) |
| `ui.nodes` | array |  |

Also retrieved by: "state of an email confirmation in progress", "read a verification journey and its errors", "what step is address confirmation on".

### `ory_kratos.list_my_sessions`

List the current user's own active logins: which devices and browsers the signed-in person is logged in on. Calls GET /sessions.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /sessions`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in... |
| `X_Session_Token` | string | no | Set the Session Token when calling from non-browser clients. A session token has a format of `MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj`. |
| `page` | integer (int64) | no | Deprecated Pagination Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This value is currently an integer, but it is not sequential. The value is not... |
| `page_size` | integer (int64) | no | Page Size This is the number of items per page to return. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). Defaults to 250. |
| `page_token` | string | no | Next Page Token The next page token. For details on pagination please head over to the [pagination documentation](https://www.ory.com/docs/ecosystem/api-design#pagination). |
| `per_page` | integer (int64) | no | Deprecated Items per Page DEPRECATED: Please use `page_token` instead. This parameter will be removed in the future. This is the number of items per page. Defaults to 250. |

Also retrieved by: "which devices am I signed in on", "show my own active logins", "where am I currently logged in".

### `ory_kratos.disable_my_other_sessions`

Sign the current user out everywhere else: invalidate every active login except this one, logging the person off all other devices. Calls DELETE /sessions.

Class `destructive` (held by the mutation gate until the call's own arguments carry `"confirm": true`). No scopes beyond the connection's defaults. Calls `DELETE /sessions`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in... |
| `X_Session_Token` | string | no | Set the Session Token when calling from non-browser clients. A session token has a format of `MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj`. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `count` | integer (int64) | The number of sessions that were revoked. |

Also retrieved by: "sign me out everywhere except here", "log off all my other devices", "end my other logins".

### `ory_kratos.exchange_session_token`

Exchange Session Token. Calls GET /sessions/token-exchange.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /sessions/token-exchange`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `init_code` | string | **yes** | The part of the code return when initializing the flow. |
| `return_to_code` | string | **yes** | The part of the code returned by the return_to URL. |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `continue_with` | array of object | Contains a list of actions, that could follow this flow It can, for example, this will contain a reference to the verification flow, created as part of the user's registration or the token of the... |
| `continue_with[].action` | string, one of show_verification_ui | Action will always be `show_verification_ui` show_verification_ui ContinueWithActionShowVerificationUIString |
| `continue_with[].flow` | object |  |
| `session` | object | A Session |
| `session.active` | boolean | Active state. If false the session is no longer active. |
| `session.authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `session.authentication_methods` | array | A list of authenticators which were used to authenticate the session. |
| `session.authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `session.devices` | array | Devices has history of all endpoints where the session was used |
| `session.expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `session.id` | string (uuid) | Session ID |
| `session.identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `session.issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `session.tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |
| `session_token` | string | The Session Token A session token is equivalent to a session cookie, but it can be sent in the HTTP Authorization Header: Authorization: bearer ${session-token} The session token is only issued for... |

Also retrieved by: "trade a one-time code for a session", "swap an exchange code after native login", "turn a returned token into a logged-in session".

### `ory_kratos.to_session`

Check Who the Current HTTP Session Belongs To. Uses the HTTP Headers in the GET request to determine (e.g. Calls GET /sessions/whoami.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /sessions/whoami`.

Arguments:

| Argument | Type | Required | Notes |
| --- | --- | --- | --- |
| `Cookie` | string | no | Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in... |
| `X_Session_Token` | string | no | Set the Session Token when calling from non-browser clients. A session token has a format of `MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj`. |
| `tokenize_as` | string | no | Returns the session additionally as a token (such as a JWT) The value of this parameter has to be a valid, configured Ory Session token template. For more information head over to [the... |

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `active` | boolean | Active state. If false the session is no longer active. |
| `authenticated_at` | string (date-time) | The Session Authentication Timestamp When this session was authenticated at. If multi-factor authentication was used this is the time when the last factor was authenticated (e.g. the TOTP code... |
| `authentication_methods` | array of object | A list of authenticators which were used to authenticate the session. |
| `authentication_methods[].aal` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `authentication_methods[].completed_at` | string (date-time) | When the authentication challenge was completed. |
| `authentication_methods[].method` | string, one of password, oidc, totp, lookup_secret, webauthn, code, passkey, profile, saml, deviceauthn, identifier_first, link_recovery, code_recovery | The method used in this authenticator. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code... |
| `authentication_methods[].organization` | string | The Organization id used for authentication |
| `authentication_methods[].provider` | string | OIDC or SAML provider id used for authentication |
| `authentication_methods[].upstream_acr` | string | UpstreamACR is the `acr` claim reported by the upstream OIDC provider, if any. Populated only for OIDC login methods when the upstream ID token contained an `acr` claim. |
| `authentication_methods[].upstream_amr` | array | UpstreamAMR is the `amr` claim reported by the upstream OIDC provider, if any. Populated only for OIDC login methods when the upstream ID token contained an `amr` claim. |
| `authenticator_assurance_level` | string, one of aal0, aal1, aal2, aal3 | The authenticator assurance level can be one of "aal1", "aal2", or "aal3". A higher number means that it is harder for an attacker to compromise the account. Generally, "aal1" implies that one... |
| `devices` | array of object | Devices has history of all endpoints where the session was used |
| `devices[].id` | string (uuid) | Device record ID |
| `devices[].ip_address` | string | IPAddress of the client |
| `devices[].location` | string | Geo Location corresponding to the IP Address |
| `devices[].user_agent` | string | UserAgent of the client |
| `expires_at` | string (date-time) | The Session Expiry When this session expires at. |
| `id` | string (uuid) | Session ID |
| `identity` | object | An [identity](https://www.ory.com/docs/kratos/concepts/identity-user-model) represents a (human) user in Ory. |
| `identity.created_at` | string (date-time) | CreatedAt is a helper struct field for gobuffalo.pop. |
| `identity.credentials` | object | Credentials represents all credentials that can be used for authenticating this identity. |
| `identity.external_id` | string | ExternalID is an optional external ID of the identity. This is used to link the identity to an external system. If set, the external ID must be unique across all identities. |
| `identity.id` | string (uuid) | ID is the identity's unique identifier. The Identity ID can not be changed and can not be chosen. This ensures future compatibility and optimization for distributed stores such as CockroachDB. |
| `identity.metadata_admin` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.metadata_public` | object | NullJSONRawMessage represents a json.RawMessage that works well with JSON, SQL, and Swagger and is NULLable- |
| `identity.organization_id` | string (uuid4) |  |
| `identity.recovery_addresses` | array | RecoveryAddresses contains all the addresses that can be used to recover an identity. |
| `identity.region` | string, one of eu-central, asia-northeast, us-east, us-west, eu, asia, us, global | Region is the Ory Network region this identity is homed in. Set by the multi-region persister; empty on OSS and single-region deployments. eu-central EUCentral asia-northeast AsiaNorthEast us-east... |
| `identity.schema_id` | string | SchemaID is the ID of the JSON Schema to be used for validating the identity's traits. |
| `identity.schema_url` | string | SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url |
| `identity.state` | string, one of active, inactive | State is the identity's state. This value has currently no effect. active StateActive inactive StateInactive |
| `identity.state_changed_at` | string (date-time) |  |
| `identity.traits` | object | Traits represent an identity's traits. The identity is able to create, modify, and delete traits in a self-service manner. The input will always be validated against the JSON Schema defined in... |
| `identity.updated_at` | string (date-time) | UpdatedAt is a helper struct field for gobuffalo.pop. |
| `identity.verifiable_addresses` | array | VerifiableAddresses contains all the addresses that can be verified by the user. |
| `issued_at` | string (date-time) | The Session Issuance Timestamp When this session was issued at. Usually equal or close to `authenticated_at`. |
| `tokenized` | string | Tokenized is the tokenized (e.g. JWT) version of the session. It is only set when the `tokenize_as` query parameter was set to a valid tokenize template during calls to `/session/whoami`. |

Also retrieved by: "who is calling me", "resolve the cookie to a user", "whoami for the current request".

### `ory_kratos.get_version`

Report the running server release: the version string of this Ory identity server. Calls GET /version.

Class `read` (reads only). No scopes beyond the connection's defaults. Calls `GET /version`.

Takes no arguments.

Result fields (the payload is trimmed to these before it reaches the model):

| Field | Type | Notes |
| --- | --- | --- |
| `version` | string | The version of Ory Kratos. |

Also retrieved by: "what release is the identity server", "show the server build number", "which version is running".