---
title: "Initialize Settings Flow for Browsers"
method: GET
path: "/self-service/settings/browser"
tags: ["v0alpha1"]
---

# Initialize Settings Flow for Browsers

`GET /self-service/settings/browser`

This endpoint initializes a browser-based user settings flow. Once initialized, the browser will be redirected to
`selfservice.flows.settings.ui_url` with the flow ID set as the query parameter `?flow=`. If no valid
Ory Kratos Session Cookie is included in the request, a login flow will be initialized.

If this endpoint is opened as a link in the browser, it will be redirected to
`selfservice.flows.settings.ui_url` with the flow ID set as the query parameter `?flow=`. If no valid user session
was set, the browser will be redirected to the login endpoint.

If this endpoint is called via an AJAX request, the response contains the settings flow without any redirects
or a 403 forbidden error if no valid session was set.

This endpoint is NOT INTENDED for clients that do not have a browser (Chrome, Firefox, ...) as cookies are needed.

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Headers

- `Cookie` string

## Response `200`

selfServiceSettingsFlow

- SelfServiceSettingsFlow — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
  - `id` string, uuid4, required
  - `identity` Identity, required — An identity can be a real human, a service, an IoT device - everything that can be described as an "actor" in a system.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `id` string, uuid4, required
    - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid4, required
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — The state can either be `active` or `inactive`.
    - `state_changed_at` string, date-time
    - `traits` unknown, required
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid4, required
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` string, required — VerifiableAddressType must not exceed 16 characters as that is the limitation in the SQL Schema
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `state` 'show_form' | 'success', required — show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings flow has been updated successfully with the provided data. Done will stay true when repeatedly checking. If set to true, done will revert back to false only when a flow with invalid (e.g. "please use a valid phone number") data was sent.
  - `type` string — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` string, required
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
          - `name` string, required — The input's element name.
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` string, required
          - `value` unknown
        - UiNodeTextAttributes
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeImageAttributes
          - `src` string, required — The image's source URL. format: uri
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
      - `group` string, required
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` string, required
      - `meta` Meta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` string, required
      - `type` string, required

## Other responses

- `302` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
- `403` — jsonError
- `500` — jsonError

## Changes

- **2021-07-22** `071bec03ddcd` — 2 breaking, 2 warning
  - the response property `identity/state` became optional for the status `200`
  - the `identity/state` response's property type/format changed from ``/`` to `string`/`` for status `200`
  - added the new `active` enum value to the `identity/state` response property for the response status `200`
  - added the new `inactive` enum value to the `identity/state` response property for the response status `200`
- **2021-07-13** `8f1b399ab6e6` — 7 info
  - api operation id `initializeSelfServiceSettingsForBrowsers` removed and replaced with `initializeSelfServiceSettingsFlowForBrowsers`
  - the endpoint scheme security `sessionToken` was removed from the API
  - api tag `v0alpha1` added
  - api tag `public` removed
  - …3 more
- **2021-05-18** `9123bcead5ed` — 3 info
  - api operation id `initializeSelfServiceSettingsViaBrowserFlow` removed and replaced with `initializeSelfServiceSettingsForBrowsers`
  - the response property `error` became required for the status `500`
  - the response property `error/message` became required for the status `500`
- **2021-05-05** `381c760af46e` — 1 breaking, 2 warning, 10 info
  - removed the success response with the status `200`
  - deleted the `header` request parameter `Cookie`
  - deleted the `query` request parameter `return_to`
  - api operation id `createBrowserSettingsFlow` removed and replaced with `initializeSelfServiceSettingsViaBrowserFlow`
  - …9 more

[Change history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/settings/browser/get.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/071bec03ddcd/schema)