frontend

Create Settings Flow for Browsers

Changed on Nov 7, 2025

This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

If this endpoint is opened as a link in the browser, it will be redirected to selfservice.flows.settings.ui_url with the flow ID set as the query parameter ?flow=. If no valid user session was set, the browser will be redirected to the login endpoint.

If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects or a 401 forbidden error if no valid session was set.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user to sign in with the second factor (happens automatically for server-side browser flows) or change the configuration.

If this endpoint is called via an AJAX request, the response contains the flow without a redirect. In the case of an error, the error.id of the JSON response body can be one of:

security_csrf_violation: Unable to fetch the flow because a CSRF violation occurred. session_inactive: No Ory Session was found - sign in a user first. security_identity_mismatch: The requested ?return_to address is not allowed to be used. Adjust this in the configuration!

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at Ory Kratos User Settings & Profile Management Documentation.

get/self-service/settings/browser

Request

Base URL
/ (relative, and the document was published on a file host, not at the API’s origin)
URL
/self-service/settings/browser
Auth
none declared

Query parameters

return_tostring

The URL to return the browser to after the flow was completed.

Headers

Cookiestring

HTTP Cookies

When using the SDK in a browser app, on the server side you must include the HTTP Cookie Header sent by the client to your server here. This ensures that CSRF and session cookies are respected.

Response

settingsFlow

activestring

Active, if set, contains the registration method that is being used. It is initially not set.

expires_atstring date-time required

ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.

idstring uuid required

ID represents the flow's unique ID. When performing the settings flow, this represents the id in the settings ui's query parameter: http://<selfservice.flows.settings.ui_url>?flow=<id>

issued_atstring date-time required

IssuedAt is the time (UTC) when the flow occurred.

request_urlstring required

RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.

return_tostring

ReturnTo contains the requested return_to URL.

stateunknown required

transient_payloadobject

TransientPayload is used to pass data from the settings flow to hooks and email templates

typestring required

The flow type can either be api or browser.

Example response

{
  "expires_at": "2000-01-23T04:56:07.000+00:00",
  "transient_payload": "{}",
  "ui": {
    "nodes": [
      {
        "meta": {
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        },
        "messages": [
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        ],
        "attributes": {
          "autocomplete": "email",
          "maxlength": 1,
          "onclick": "onclick",
          "pattern": "pattern",
          "onclickTrigger": "oryWebAuthnRegistration",
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          "type": "text",
          "required": true,
          "onload": "onload",
          "node_type": "input",
          "onloadTrigger": "oryWebAuthnRegistration",
          "name": "name",
          "disabled": true,
          "value": ""
        },
        "type": "text",
        "group": "default"
      },
      {
        "meta": {
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        },
        "messages": [
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          }
        ],
        "attributes": {
          "autocomplete": "email",
          "maxlength": 1,
          "onclick": "onclick",
          "pattern": "pattern",
          "onclickTrigger": "oryWebAuthnRegistration",
          "label": {
            "context": "{}",
            "id": 6,
            "text": "text",
            "type": "info"
          },
          "type": "text",
          "required": true,
          "onload": "onload",
          "node_type": "input",
          "onloadTrigger": "oryWebAuthnRegistration",
          "name": "name",
          "disabled": true,
          "value": ""
        },
        "type": "text",
        "group": "default"
      }
    ],
    "method": "method",
    "action": "action",
    "messages": [
      {
        "context": "{}",
        "id": 6,
        "text": "text",
        "type": "info"
      },
      {
        "context": "{}",
        "id": 6,
        "text": "text",
        "type": "info"
      }
    ]
  },
  "identity": {
    "traits": "",
    "credentials": {
      "key": {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "identifiers": [
          "identifiers",
          "identifiers"
        ],
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "type": "password",
        "config": "{}",
        "version": 0
      }
    },
    "state_changed_at": "2000-01-23T04:56:07.000+00:00",
    "created_at": "2000-01-23T04:56:07.000+00:00",
    "external_id": "external_id",
    "recovery_addresses": [
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "via": "via"
      },
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "via": "via"
      }
    ],
    "metadata_admin": "",
    "updated_at": "2000-01-23T04:56:07.000+00:00",
    "verifiable_addresses": [
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "status": "status",
        "via": "email"
      },
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "value": "value",
        "status": "status",
        "via": "email"
      }
    ],
    "organization_id": "organization_id",
    "schema_id": "schema_id",
    "schema_url": "schema_url",
    "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
    "state": "active",
    "metadata_public": ""
  },
  "continue_with": [
    {
      "action": "show_verification_ui",
      "flow": {
        "verifiable_address": "verifiable_address",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "url": "url"
      }
    },
    {
      "action": "show_verification_ui",
      "flow": {
        "verifiable_address": "verifiable_address",
        "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
        "url": "url"
      }
    }
  ],
  "active": "active",
  "return_to": "return_to",
  "id": "046b6c7f-0b8a-43b9-b35d-6489e6daee91",
  "state": "",
  "type": "type",
  "issued_at": "2000-01-23T04:56:07.000+00:00",
  "request_url": "request_url"
}

Changes

Nov 7, 20255f08e5827b5e Revision changes
- breaking
  the response property /// became optional for the status
- breaking
  added to the /// response property oneOf list for the response status
- warning
  added the new div enum value to the /// response property for the response status
- warning
  added the new username webauthn enum value to the //////// response property for the response status
- info
  added the optional property / to the response with the status
- info
  added div discriminator mapping keys to the /// response property for the response status
- info
  removed the a enum value from the //////// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the a enum value from the ///// response property for the response status
- info
  removed the img enum value from the //////// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the img enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the input enum value from the ///// response property for the response status
- info
  removed the script enum value from the //////// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the script enum value from the ///// response property for the response status
- info
  removed the text enum value from the //////// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
- info
  removed the text enum value from the ///// response property for the response status
Feb 25, 2025df2fe8db7397 Revision changes
- breaking
  added to the / response property oneOf list for the response status
- breaking
  the / response's property type changed from no type to object for status
- warning
  added the new captcha enum value to the /// response property for the response status
- warning
  added the new identifier_first enum value to the /// response property for the response status
- warning
  added the new saml enum value to the /// response property for the response status
- warning
  added the new saml enum value to the /// response property for the response status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added redirect_browser_to discriminator mapping keys to the / response property for the response status

Operation history (13 revisions)