frontend

Create Registration Flow for Native Apps

Changed on Nov 7, 2025

This endpoint initiates a registration flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error will be returned unless the URL query parameter ?refresh=true is set.

To fetch an existing registration flow call /self-service/registration/flows?flow=<flow_id>.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

In the case of an error, the error.id of the JSON response body can be one of:

session_already_available: The user is already signed in. security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos User Login and User Registration Documentation.

get/self-service/registration/api

Request

Base URL
/ (relative, and the document was published on a file host, not at the API’s origin)
URL
/self-service/registration/api
Auth
none declared

Query parameters

return_session_token_exchange_codeboolean

EnableSessionTokenExchangeCode requests the login flow to include a code that can be used to retrieve the session token after the login flow has been completed.

return_tostring

The URL to return the browser to after the flow was completed.

organizationstring

An optional organization ID that should be used to register this user. This parameter is only effective in the Ory Network.

identity_schemastring

An optional identity schema to use for the registration flow.

Response

registrationFlow

Active, if set, contains the registration method that is being used. It is initially not set. password CredentialsTypePassword oidc CredentialsTypeOIDC totp CredentialsTypeTOTP lookup_secret CredentialsTypeLookup webauthn CredentialsTypeWebAuthn code CredentialsTypeCodeAuth passkey CredentialsTypePasskey profile CredentialsTypeProfile saml CredentialsTypeSAML link_recovery CredentialsTypeRecoveryLink CredentialsTypeRecoveryLink is a special credential type linked to the link strategy (recovery flow). It is not used within the credentials object itself. code_recovery CredentialsTypeRecoveryCode

expires_atstring date-time required

ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to log in, a new flow has to be initiated.

idstring uuid required

ID represents the flow's unique ID. When performing the registration flow, this represents the id in the registration ui's query parameter: http://<selfservice.flows.registration.ui_url>/?flow=<id>

identity_schemastring

IdentitySchema optionally holds the ID of the identity schema that is used for this flow. This value can be set by the user when creating the flow and should be retained when the flow is saved or converted to another flow.

issued_atstring date-time required

IssuedAt is the time (UTC) when the flow occurred.

oauth2_login_challengestring

Ory OAuth 2.0 Login Challenge.

This value is set using the login_challenge query parameter of the registration and login endpoints. If set will cooperate with Ory OAuth2 and OpenID to act as an OAuth2 server / OpenID Provider.

organization_idstring uuid4 nullable

request_urlstring required

RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.

return_tostring

ReturnTo contains the requested return_to URL.

session_token_exchange_codestring

SessionTokenExchangeCode holds the secret code that the client can use to retrieve a session token after the flow has been completed. This is only set if the client has requested a session token exchange code, and if the flow is of type "api", and only on creating the flow.

stateunknown required

transient_payloadobject

TransientPayload is used to pass data from the registration to a webhook

typestring required

The flow type can either be api or browser.

Example response

{
  "identity_schema": "identity_schema",
  "active": "password",
  "return_to": "return_to",
  "session_token_exchange_code": "session_token_exchange_code",
  "type": "type",
  "issued_at": "2000-01-23T04:56:07.000+00:00",
  "request_url": "request_url",
  "expires_at": "2000-01-23T04:56:07.000+00:00",
  "oauth2_login_request": {
    "requested_access_token_audience": [
      "requested_access_token_audience",
      "requested_access_token_audience"
    ],
    "subject": "subject",
    "oidc_context": {
      "login_hint": "login_hint",
      "ui_locales": [
        "ui_locales",
        "ui_locales"
      ],
      "id_token_hint_claims": {
        "key": ""
      },
      "acr_values": [
        "acr_values",
        "acr_values"
      ],
      "display": "display"
    },
    "challenge": "challenge",
    "client": {
      "metadata": "",
      "token_endpoint_auth_signing_alg": "token_endpoint_auth_signing_alg",
      "client_uri": "client_uri",
      "jwt_bearer_grant_access_token_lifespan": "jwt_bearer_grant_access_token_lifespan",
      "jwks": "",
      "logo_uri": "logo_uri",
      "created_at": "2000-01-23T04:56:07.000+00:00",
      "registration_client_uri": "registration_client_uri",
      "allowed_cors_origins": [
        "allowed_cors_origins",
        "allowed_cors_origins"
      ],
      "refresh_token_grant_access_token_lifespan": "refresh_token_grant_access_token_lifespan",
      "registration_access_token": "registration_access_token",
      "client_id": "client_id",
      "token_endpoint_auth_method": "token_endpoint_auth_method",
      "userinfo_signed_response_alg": "userinfo_signed_response_alg",
      "authorization_code_grant_id_token_lifespan": "authorization_code_grant_id_token_lifespan",
      "authorization_code_grant_refresh_token_lifespan": "authorization_code_grant_refresh_token_lifespan",
      "client_credentials_grant_access_token_lifespan": "client_credentials_grant_access_token_lifespan",
      "updated_at": "2000-01-23T04:56:07.000+00:00",
      "scope": "scope",
      "request_uris": [
        "request_uris",
        "request_uris"
      ],
      "client_secret": "client_secret",
      "backchannel_logout_session_required": true,
      "backchannel_logout_uri": "backchannel_logout_uri",
      "client_name": "client_name",
      "policy_uri": "policy_uri",
      "owner": "owner",
      "skip_consent": true,
      "audience": [
        "audience",
        "audience"
      ],
      "authorization_code_grant_access_token_lifespan": "authorization_code_grant_access_token_lifespan",
      "post_logout_redirect_uris": [
        "post_logout_redirect_uris",
        "post_logout_redirect_uris"
      ],
      "grant_types": [
        "grant_types",
        "grant_types"
      ],
      "subject_type": "subject_type",
      "refresh_token_grant_refresh_token_lifespan": "refresh_token_grant_refresh_token_lifespan",
      "redirect_uris": [
        "redirect_uris",
        "redirect_uris"
      ],
      "sector_identifier_uri": "sector_identifier_uri",
      "frontchannel_logout_session_required": true,
      "frontchannel_logout_uri": "frontchannel_logout_uri",
      "skip_logout_consent": true,
      "refresh_token_grant_id_token_lifespan": "refresh_token_grant_id_token_lifespan",
      "implicit_grant_id_token_lifespan": "implicit_grant_id_token_lifespan",
      "client_secret_expires_at": 0,
      "implicit_grant_access_token_lifespan": "implicit_grant_access_token_lifespan",
      "access_token_strategy": "access_token_strategy",
      "jwks_uri": "jwks_uri",
      "request_object_signing_alg": "request_object_signing_alg",
      "tos_uri": "tos_uri",
      "contacts": [
        "contacts",
        "contacts"
      ],
      "response_types": [
        "response_types",
        "response_types"
      ]
    },
    "session_id": "session_id",
    "skip": true,
    "request_url": "request_url",
    "requested_scope": [
      "requested_scope",
      "requested_scope"
    ]
  },
  "transient_payload": "{}",
  "ui": {
    "nodes": [
      {
        "meta": {
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        },
        "messages": [
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        ],
        "attributes": {
          "autocomplete": "email",
          "maxlength": 1,
          "onclick": "onclick",
          "pattern": "pattern",
          "onclickTrigger": "oryWebAuthnRegistration",
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          "type": "text",
          "required": true,
          "onload": "onload",
          "node_type": "input",
          "onloadTrigger": "oryWebAuthnRegistration",
          "name": "name",
          "disabled": true,
          "value": ""
        },
        "type": "text",
        "group": "default"
      },
      {
        "meta": {
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        },
        "messages": [
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        ],
        "attributes": {
          "autocomplete": "email",
          "maxlength": 1,
          "onclick": "onclick",
          "pattern": "pattern",
          "onclickTrigger": "oryWebAuthnRegistration",
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          "type": "text",
          "required": true,
          "onload": "onload",
          "node_type": "input",
          "onloadTrigger": "oryWebAuthnRegistration",
          "name": "name",
          "disabled": true,
          "value": ""
        },
        "type": "text",
        "group": "default"
      }
    ],
    "method": "method",
    "action": "action",
    "messages": [
      {
        "context": "{}",
        "id": 6,
        "text": "text",
        "type": "info"
      },
      {
        "context": "{}",
        "id": 6,
        "text": "text",
        "type": "info"
      }
    ]
  },
  "oauth2_login_challenge": "oauth2_login_challenge",
  "organization_id": "organization_id",
  "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
  "state": ""
}

Changes

Nov 7, 20255f08e5827b5e Revision changes
- breaking
  added to the /// response property oneOf list for the response status
- warning
  added the new div enum value to the /// response property for the response status
- warning
  added the new username webauthn enum value to the //////// response property for the response status
- info
  added the new optional query request parameter identity_schema
- info
  added the optional property to the response with the status
- info
  added div discriminator mapping keys to the /// response property for the response status
- info
  removed the a enum value from the //////// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the img enum value from the //////// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the script enum value from the //////// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the text enum value from the //////// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
Feb 25, 2025df2fe8db7397 Revision changes
- warning
  added the new captcha enum value to the /// response property for the response status
- warning
  added the new identifier_first enum value to the /// response property for the response status
- warning
  added the new saml enum value to the response property for the response status
- warning
  added the new saml enum value to the /// response property for the response status
- info
  added the new optional query request parameter organization
- info
  added the optional property //////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property //////// to the response with the status

Operation history (13 revisions)