---
title: "Initialize Settings Flow for APIs, Services, Apps, ..."
method: GET
path: "/self-service/settings/api"
tags: ["v0alpha2"]
---

# Initialize Settings Flow for APIs, Services, Apps, ...

`GET /self-service/settings/api`

This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on.
You must provide a valid Ory Kratos Session Token for this endpoint to respond with HTTP 200 OK.

To fetch an existing settings flow call `/self-service/settings/flows?flow=<flow_id>`.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
you vulnerable to a variety of CSRF attacks.

Depending on your configuration this endpoint might return a 403 error if the session has a lower Authenticator
Assurance Level (AAL) than is possible for the identity. This can happen if the identity has password + webauthn
credentials (which would result in AAL2) but the session has only AAL1. If this error occurs, ask the user
to sign in with the second factor or change the configuration.

In the case of an error, the `error.id` of the JSON response body can be one of:

`security_csrf_violation`: Unable to fetch the flow because a CSRF violation occurred.
`session_inactive`: No Ory Session was found - sign in a user first.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Headers

- `X-Session-Token` string

## Response `200`

selfServiceSettingsFlow

- SelfServiceSettingsFlow — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
  - `id` string, uuid4, required
  - `identity` Identity, required — An identity can be a real human, a service, an IoT device - everything that can be described as an "actor" in a system.
    - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
    - `credentials` object — Credentials represents all credentials that can be used for authenticating this identity.
    - `id` string, uuid4, required
    - `metadata_admin` unknown
    - `metadata_public` unknown
    - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `created_at` string, date-time — CreatedAt is a helper struct field for gobuffalo.pop.
      - `id` string, uuid4, required
      - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `state` 'active' | 'inactive' — The state can either be `active` or `inactive`.
    - `state_changed_at` string, date-time
    - `traits` unknown, required
    - `updated_at` string, date-time — UpdatedAt is a helper struct field for gobuffalo.pop.
    - `verifiable_addresses` VerifiableIdentityAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `created_at` string, date-time — When this entry was created
      - `id` string, uuid4, required
      - `status` string, required — VerifiableAddressStatus must not exceed 16 characters as that is the limitation in the SQL Schema
      - `updated_at` string, date-time — When this entry was last updated
      - `value` string, required — The address value example foo@user.com
      - `verified` boolean, required — Indicates if the address has already been verified
      - `verified_at` string, date-time
      - `via` string, required — VerifiableAddressType must not exceed 16 characters as that is the limitation in the SQL Schema
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `return_to` string — ReturnTo contains the requested return_to URL.
  - `state` 'show_form' | 'success', required — show_form: No user data has been collected, or it is invalid, and thus the form should be shown. success: Indicates that the settings flow has been updated successfully with the provided data. Done will stay true when repeatedly checking. If set to true, done will revert back to false only when a flow with invalid (e.g. "please use a valid phone number") data was sent.
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` string, required
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
          - `name` string, required — The input's element name.
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "input".
          - `onclick` string — OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` string, required
          - `value` unknown
        - UiNodeTextAttributes
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "text".
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeImageAttributes
          - `height` integer, required — Height of the image
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "img".
          - `src` string, required — The image's source URL. format: uri
          - `width` integer, required — Width of the image
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "a".
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeScriptAttributes
          - `async` boolean, required — The script async type
          - `crossorigin` string, required — The script cross origin policy
          - `id` string, required — A unique identifier
          - `integrity` string, required — The script's integrity hash
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "script".
          - `nonce` string, required — Nonce for CSP A nonce you may want to use to improve your Content Security Policy. You do not have to use this value but if you want to improve your CSP policies you may use it. You can also choose to use your own nonce value!
          - `referrerpolicy` string, required — The script referrer policy
          - `src` string, required — The script source
          - `type` string, required — The script MIME type
      - `group` 'default' | 'password' | 'oidc' | 'profile' | 'link' | 'totp' | 'lookup_secret' | 'webauthn', required — Group specifies which group (e.g. password authenticator) this node belongs to.
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` string, required
      - `meta` UiNodeMeta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` string, required
      - `type` 'text' | 'input' | 'img' | 'a' | 'script', required — The node's type

## Other responses

- `400` — jsonError
- `500` — jsonError

## Changes

- **2022-06-01** `fca041c7721f` — 13 warning, 5 info
  - added the new `a` enum value to the `ui/nodes/items/type` response property for the response status `200`
  - added the new `default` enum value to the `ui/nodes/items/group` response property for the response status `200`
  - added the new `img` enum value to the `ui/nodes/items/type` response property for the response status `200`
  - added the new `input` enum value to the `ui/nodes/items/type` response property for the response status `200`
  - …14 more
- **2022-03-22** `028a4cf83c15` — 2 warning, 4 info
  - added the new `lookup_secret` enum value to the `identity/credentials/additionalProperties/type` response property for the response status `200`
  - added the new `webauthn` enum value to the `identity/credentials/additionalProperties/type` response property for the response status `200`
  - added the optional property `identity/credentials/additionalProperties/version` to the response with the `200` status
  - the response property `ui/nodes/items/attributes/oneOf[subschema #3: ImageAttributes represents the attributes of an image node.]/height` became required for the status `200`
  - …2 more
- …earlier changes not shown

[Full history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/settings/api/get.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/fca041c7721f/schema)