--- title: "Registration" method: POST path: "/registration" tags: ["flow"] --- # Registration `POST /registration` Initialize or advance a registration flow. ## Query parameters - `action` string ## Headers - `X-Language` 'bn' | 'de' | 'en' | 'fr' | 'it' | 'nl' | 'pt-BR' | 'zh' ## Request body - object - `input_data` union - InputDataRegisterClientCapabilities — Input data for the `register_client_capabilities` action. - `webauthn_available` boolean, required - `webauthn_conditional_mediation_available` boolean - `webauthn_platform_authenticator_available` boolean - InputDataRegisterLoginIdentifier — Input data for the `register_login_identifier` action. - `email` string, email - `username` string - InputDataRememberMe — Input data for the `remember_me` action. - `remember_me` boolean, required - InputDataRegisterPassword — Input data for the `register_password` action. - `new_password` string, required - InputDataVerifyPasscode — Input data for the `verify_passcode` action. - `code` string, required - InputDataOTPCodeVerify — Input data for the `otp_code_verify` action. - `otp_code` string, required - InputDataThirdPartyOauth — Input data for the `thirdparty_oauth` action. - `provider` 'apple' | 'discord' | 'facebook' | 'github' | 'google' | 'linkedin' | 'microsoft', required - `redirect_to` string, uri, required - `code_verifier` string - InputDataExchangeToken — Input data for the `exchange_token` action. - `token` string, required - InputDataWebauthnVerifyAttestationResponse — Input data for the `webauthn_verify_attestation_response` action. - `public_key` object, required — The [AuthenticatorAttestationResponse](https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAttestationResponse) from the WebAuthn API. - `csrf_token` string — Not required on flow initialization, i.e. on requests without an `action` query parameter. Required on all other requests performing an action, i.e. on requests that use an `action` query parameter. Should be the `csrf_token` value from the most recent flow state response. ## Response `200` RegistrationFlowResponse - union - StatePreflight - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `register_client_capabilities` ActionRegisterClientCapabilities — Action - `action` 'register_client_capabilities' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `webauthn_available` InputWebauthnAvailable, required — Indicates whether the client the device is capable of creating and using passkeys/WebAuthn credentials. - `name` 'webauthn_available' - `type` 'boolean' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `webauthn_conditional_mediation_available` InputWebauthnConditionalMediationAvailable - `name` 'webauthn_conditional_mediation_available' - `type` 'boolean' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `webauthn_platform_authenticator_available` InputWebauthnPlatformAuthenticatorAvailable - `name` 'webauthn_platform_authenticator_available' - `type` 'boolean' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `name` 'preflight' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateRegistrationInit — Represents the initial state of a registration flow. - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `register_login_identifier` ActionRegisterLoginIdentifier — unresolved $ref - `thirdparty_oauth` ActionThirdPartyOauth — Action - `action` 'thirdparty_oauth' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `provider` InputProvider, required - `name` 'provider' - `type` 'string' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `redirect_to` InputRedirectTo, required - `name` 'redirect_to' - `type` 'string' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `code_verifier` InputCodeVerifier - `name` 'code_verifier' - `type` 'string' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `remember_me` ActionRememberMe — Action - `action` 'remember_me' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `remember_me` InputRememberMe - `name` 'remember_me' - `type` 'boolean' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `name` 'registration_init' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StatePasscodeConfirmation - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `verify_passcode` ActionVerifyPasscode — Action - `action` 'verify_passcode' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `code` InputCode, required - `name` 'code' - `type` 'string' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `resend_passcode` ActionResendPasscode — Action - `action` 'resend_passcode' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'passcode_confirmation' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StatePasswordCreation - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `register_password` ActionRegisterPassword — unresolved $ref - `skip` ActionSkip — Action - `action` 'skip' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'password_creation' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateCredentialOnboardingChooser - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `continue_to_passkey_registration` ActionContinueToPasskeyRegistration — Action - `action` 'continue_to_passkey_registration' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `continue_to_password_registration` ActionContinueToPasswordRegistration — Action - `action` 'continue_to_password_registration' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `skip` ActionSkip — Action - `action` 'skip' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'credential_onboarding_chooser' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateMFAMethodChooser - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `continue_to_otp_secret_creation` ActionContinueToOTPSecretCreation — Action - `action` 'continue_to_otp_secret_creation' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `continue_to_security_key_creation` ActionContinueToSecurityKeyCreation — Action - `action` 'continue_to_security_key_creation' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `skip` ActionSkip — Action - `action` 'skip' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'mfa_method_chooser' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateMFAOTPSecretCreation - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `otp_code_verify` ActionOTPCodeVerify — Action - `action` 'otp_code_verify' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `otp_code` InputOTPCode, required - `name` 'otp_code' - `type` 'string' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'mfa_otp_secret_creation' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `otp_image_source` string — Contains a QR code to scan with an authenticator app as a string in ["data" URL](https://datatracker.ietf.org/doc/html/rfc2397) format. Can be directly used as the value for the `src` attribute in an HTML `img` element. - `otp_secret` string — Shared secret that can be provided to authenticator apps if scanning a QR code is not available. - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateMFASecurityKeyCreation - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `webauthn_generate_creation_options` ActionWebauthnGenerateCreationOptions — Action - `action` 'webauthn_generate_creation_options' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'mfa_security_key_creation' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateOnboardingCreatePasskey - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `webauthn_generate_creation_options` ActionWebauthnGenerateCreationOptions — Action - `action` 'webauthn_generate_creation_options' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `skip` ActionSkip — Action - `action` 'skip' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'onboarding_create_passkey' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateOnboardingVerifyPasskeyAttestation - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `webauthn_verify_attestation_response` object - `action` 'webauthn_verify_attestation_response' - `inputs` InputsWebauthnVerifyAttestationResponse - `public_key` InputPublicKey, required - `name` 'public-key' - `type` 'json' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'onboarding_verify_passkey_attestation' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `creation_options` CredentialCreationOptions, required — Options for credential creation with the WebAuthn API - `publicKey` object - `rp` object - `name` string - `id` string - `user` object - `id` string - `name` string - `displayName` string - `challenge` string, base64url - `pubKeyCredParams` object[] - `type` 'public-key' - `alg` number - `timeout` number - `authenticatorSelection` object - `authenticatorAttachment` 'platform' | 'cross-platform' - `requireResidentKey` boolean - `residentKey` 'discouraged' | 'preferred' | 'required' - `userVerification` 'discouraged' | 'preferred' | 'required' - `attestation` 'none' | 'indirect' | 'direct' | 'enterprise' - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateThirdParty - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `exchange_token` ActionExchangeToken — Action - `action` 'exchange_token' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `token` InputToken - `name` 'token' - `type` 'string' - `required` boolean - `min_length` integer - `max_length` integer - `hidden` boolean - `value` string - `allowed_values` object[] - … - `back` ActionBack — Action - `action` 'back' — The name of the action. - `href` string — The action target as a URL relative to the API tenant base URL. - `description` string — The description for the action. - `inputs` object — The inputs for the action. An input indicates that when making a request to perform an action, the `input_data` value of the request body must contain a key with the given `name` value of the respective input. The corresponding value for that key is specified by the remaining properties of the input. - `name` 'thirdparty' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `redirect_url` string, uri, required - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. - StateSuccessRegistration - `actions` object — List of actions that can be performed in the current flow state in order to advance the flow to the next state. Depending on user details (e.g. presence or absence of credentials) or the tenant's configuration some actions may or may not be present in the response. - `name` 'success' — The name of the flow state. - `payload` object — Additional data that can be used by the client (e.g. `user` or `sessions` data provided in the profile flow) or should/must be used as intermediary data in an out of band process to produce input data for advancing the flow (e.g. the WebAuthn credential request/creation options that must be passed to the Webauthn API to produce an assertion/attestation). - `user` ProfileDataUser — Data pertaining to the user associated with the current session. - `user_id` string, uuid - `passkeys` WebauthnCredential[] - `aaguid` string, uuid - `attestation_type` 'none' | 'packed' | 'tpm' | 'android-key' | 'android-safetynet' | 'fido-u2f' | 'apple' - `backup_eligible` boolean - `backup_state` boolean - `created_at` string, date-time - `id` string, uuid - `last_used_at` string, date-time - `mfa_only` boolean - `public-key` string - `transports` string[] - `security_keys` WebauthnCredential[] - `aaguid` string, uuid - `attestation_type` 'none' | 'packed' | 'tpm' | 'android-key' | 'android-safetynet' | 'fido-u2f' | 'apple' - `backup_eligible` boolean - `backup_state` boolean - `created_at` string, date-time - `id` string, uuid - `last_used_at` string, date-time - `mfa_only` boolean - `public-key` string - `transports` string[] - `emails` object[] - `id` string, uuid - `address` string, email - `is_primary` boolean - `is_verified` boolean - `identity` object — Deprecated. See `identities` instead. - `id` string — Contains the ID of the user at the provider. - `provider` string — Contains the display name of the provider, if available. Otherwise contains the provider ID. - `identities` object[] — Deprecated. See top-level `identities` instead. - `id` string — ID of the user at the provider - `provider` string — Contains the display name of the provider, if available. Otherwise contains the provider ID. - `identities` object[] — The user's third party connections/identities. - `id` string — The ID of the user at the provider - `identity_id` string, uuid4 — The identity's ID - `provider` string — Contains the display name of the provider, if available. Otherwise contains the provider ID. - `metadata` object - `public_metadata` object - `unsafe_metadata` object - `mfa_config` object - `auth_app_set_up` boolean — Indicates whether the user has set up an authenticator app for 2FA. - `totp_enabled` boolean — Indicates whether 2FA via authenticator app is enabled on this tenant. To check whether a user has set up an authenticator app for 2FA, see [`payload.user.mfa_config.app_auth_set_up`](#response-one-of-1-payload-user-mfa-config-app-auth-set-up). - `security_keys_enabled` boolean — Indicates whether 2FA via security keys is enabled on this tenant. To check whether a user has enrolled security keys for 2FA, see [`payload.user.security_keys`](#response-one-of-1-payload-user-security-keys). - `created_at` string, date-time - `updated_at` string, date-time - `name` string - `given_name` string - `family_name` string - `picture` string, uri - `claims` Claims — Contains the claims of a user as they appear in the payload of session JWTs. - `amr` string[] — Authentication Method References, JSON array of strings that are identifiers for authentication methods used in the authentication. - `subject` string, uuid4 - `issued_at` string, date-time - `audience` string[] - `issuer` string - `email` object - `address` string - `is_verified` boolean - `is_primary` boolean - `status` 200 — The HTTP response status code for this flow response. - `csrf_token` string — Token to prevent Cross-Site Request Forgeries. - `links` Link[], nullable - `name` string — The name of the link. - `href` string, uri — The destination of the link. - `category` string — The category of the link. - `target` '_self' | '_blank' | '_parent' | '_top' — The target of the link. ## Other responses - `400` — RegistrationFlowResponseBadRequestError - `401` — FlowResponseUnauthorizedError - `403` — FlowResponseForbiddenError - `410` — FlowResponseGoneError - `429` — FlowResponseTooManyRequestsError - `500` — FlowResponseInternalServerError --- [API](https://skmtc.dev/hanko/apis/flow-api.md) · [All operations](https://skmtc.dev/hanko/apis/flow-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hanko/flow-api/revisions/bb0677884e6b/schema)