---
title: "Complete Verification Flow"
method: POST
path: "/self-service/verification"
tags: ["v0alpha1"]
---

# Complete Verification Flow

`POST /self-service/verification`

Use this endpoint to complete a verification flow. This endpoint
behaves differently for API and browser flows and has several states:

`choose_method` expects `flow` (in the URL query) and `email` (in the body) to be sent
and works with API- and Browser-initiated flows.
For API clients and Browser clients with HTTP Header `Accept: application/json` it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid
and a HTTP 302 Found redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired).
For Browser clients without HTTP Header `Accept` or with `Accept: text/*` it returns a HTTP 302 Found redirect to the Verification UI URL with the Verification Flow ID appended.
`sent_email` is the success state after `choose_method` when using the `link` method and allows the user to request another verification email. It
works for both API and Browser-initiated flows and returns the same responses as the flow in `choose_method` state.
`passed_challenge` expects a `token` to be sent in the URL query and given the nature of the flow ("sending a verification link")
does not have any API capabilities. The server responds with a HTTP 302 Found redirect either to the Settings UI URL
(if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with
a new Verification Flow ID which contains an error message that the verification link was invalid.

More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation).

## Query parameters

- `flow` string, required
- `token` string

## Request body

- SubmitSelfServiceVerificationFlowBody
  - `csrf_token` string — Sending the anti-csrf token is only required for browser login flows.
  - `email` string, required — Email to Verify Needs to be set when initiating the flow. If the email is a registered verification email, a verification link will be sent. If the email is not known, a email with details on what happened will be sent instead. format: email
  - `method` 'link', required — Method supports `link` only right now.

## Response `200`

selfServiceVerificationFlow

- SelfServiceVerificationFlow — Used to verify an out-of-band communication channel such as an email address or a phone number. For more information head over to: https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time — ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated.
  - `id` string, uuid4, required
  - `issued_at` string, date-time — IssuedAt is the time (UTC) when the request occurred.
  - `request_url` string — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `state` 'choose_method' | 'sent_email' | 'passed_challenge', required — The state represents the state of the verification flow. choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the recovery challenge was passed.
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` string, required
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
          - `name` string, required — The input's element name.
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` string, required
          - `value` unknown
        - UiNodeTextAttributes
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeImageAttributes
          - `src` string, required — The image's source URL. format: uri
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
      - `group` string, required
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` string, required
      - `meta` Meta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` string, required
      - `type` string, required

## Other responses

- `302` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
- `400` — selfServiceVerificationFlow
- `500` — jsonError

## Changes

- **2021-07-22** `071bec03ddcd` — 4 breaking, 2 info
  - removed the enum value `oidc` of the request property `oneOf[#/components/schemas/submitSelfServiceVerificationFlowWithLinkMethodBody]/method` (media type: application/json)
  - removed the enum value `oidc` of the request property `oneOf[#/components/schemas/submitSelfServiceVerificationFlowWithLinkMethodBody]/method` (media type: application/x-www-form-urlencoded)
  - removed the enum value `password` of the request property `oneOf[#/components/schemas/submitSelfServiceVerificationFlowWithLinkMethodBody]/method` (media type: application/json)
  - removed the enum value `password` of the request property `oneOf[#/components/schemas/submitSelfServiceVerificationFlowWithLinkMethodBody]/method` (media type: application/x-www-form-urlencoded)
  - …2 more
- **2021-07-13** `8f1b399ab6e6` — 1 info
  - endpoint added
- **2021-05-05** `381c760af46e` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/verification/post.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/071bec03ddcd/schema)