---
title: "Complete Verification Flow"
method: POST
path: "/self-service/verification"
tags: ["v0alpha2"]
---

# Complete Verification Flow

`POST /self-service/verification`

Use this endpoint to complete a verification flow. This endpoint
behaves differently for API and browser flows and has several states:

`choose_method` expects `flow` (in the URL query) and `email` (in the body) to be sent
and works with API- and Browser-initiated flows.
For API clients and Browser clients with HTTP Header `Accept: application/json` it either returns a HTTP 200 OK when the form is valid and HTTP 400 OK when the form is invalid
and a HTTP 303 See Other redirect with a fresh verification flow if the flow was otherwise invalid (e.g. expired).
For Browser clients without HTTP Header `Accept` or with `Accept: text/*` it returns a HTTP 303 See Other redirect to the Verification UI URL with the Verification Flow ID appended.
`sent_email` is the success state after `choose_method` when using the `link` method and allows the user to request another verification email. It
works for both API and Browser-initiated flows and returns the same responses as the flow in `choose_method` state.
`passed_challenge` expects a `token` to be sent in the URL query and given the nature of the flow ("sending a verification link")
does not have any API capabilities. The server responds with a HTTP 303 See Other redirect either to the Settings UI URL
(if the link was valid) and instructs the user to update their password, or a redirect to the Verification UI URL with
a new Verification Flow ID which contains an error message that the verification link was invalid.

More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation).

## Query parameters

- `flow` string, required
- `token` string

## Headers

- `Cookie` string

## Request body

- SubmitSelfServiceVerificationFlowBody
  - `csrf_token` string — Sending the anti-csrf token is only required for browser login flows.
  - `email` string, required — Email to Verify Needs to be set when initiating the flow. If the email is a registered verification email, a verification link will be sent. If the email is not known, a email with details on what happened will be sent instead. format: email
  - `method` string, required — Method supports `link` only right now.

## Response `200`

selfServiceVerificationFlow

- SelfServiceVerificationFlow — Used to verify an out-of-band communication channel such as an email address or a phone number. For more information head over to: https://www.ory.sh/docs/kratos/selfservice/flows/verify-email-account-activation
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time — ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated.
  - `id` string, uuid4, required
  - `issued_at` string, date-time — IssuedAt is the time (UTC) when the request occurred.
  - `request_url` string — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `return_to` string — ReturnTo contains the requested return_to URL.
  - `state` 'choose_method' | 'sent_email' | 'passed_challenge', required — The state represents the state of the verification flow. choose_method: ask the user to choose a method (e.g. recover account via email) sent_email: the email has been sent to the user passed_challenge: the request was successful and the recovery challenge was passed.
  - `type` string, required — The flow type can either be `api` or `browser`.
  - `ui` UiContainer, required — Container represents a HTML Form. The container can work with both HTTP Form and JSON requests
    - `action` string, required — Action should be used as the form action URL `<form action="{{ .Action }}" method="post">`.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` string, required
    - `method` string, required — Method is the form method (e.g. POST)
    - `nodes` UiNode[], required
      - `attributes` union, required
        - UiNodeInputAttributes — InputAttributes represents the attributes of an input node
          - `disabled` boolean, required — Sets the input's disabled field to true or false.
          - `label` UiText
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
          - `name` string, required — The input's element name.
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "input".
          - `onclick` string — OnClick may contain javascript which should be executed on click. This is primarily used for WebAuthn.
          - `pattern` string — The input's pattern.
          - `required` boolean — Mark this input field as required.
          - `type` string, required
          - `value` unknown
        - UiNodeTextAttributes
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "text".
          - `text` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeImageAttributes
          - `height` integer, required — Height of the image
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "img".
          - `src` string, required — The image's source URL. format: uri
          - `width` integer, required — Width of the image
        - UiNodeAnchorAttributes
          - `href` string, required — The link's href (destination) URL. format: uri
          - `id` string, required — A unique identifier
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "a".
          - `title` UiText, required
            - `context` object — The message's context. Useful when customizing messages.
            - `id` integer, required
            - `text` string, required — The message text. Written in american english.
            - `type` string, required
        - UiNodeScriptAttributes
          - `async` boolean, required — The script async type
          - `crossorigin` string, required — The script cross origin policy
          - `id` string, required — A unique identifier
          - `integrity` string, required — The script's integrity hash
          - `node_type` string, required — NodeType represents this node's types. It is a mirror of `node.type` and is primarily used to allow compatibility with OpenAPI 3.0. In this struct it technically always is "script".
          - `nonce` string, required — Nonce for CSP A nonce you may want to use to improve your Content Security Policy. You do not have to use this value but if you want to improve your CSP policies you may use it. You can also choose to use your own nonce value!
          - `referrerpolicy` string, required — The script referrer policy
          - `src` string, required — The script source
          - `type` string, required — The script MIME type
      - `group` 'default' | 'password' | 'oidc' | 'profile' | 'link' | 'totp' | 'lookup_secret' | 'webauthn', required — Group specifies which group (e.g. password authenticator) this node belongs to.
      - `messages` UiText[], required
        - `context` object — The message's context. Useful when customizing messages.
        - `id` integer, required
        - `text` string, required — The message text. Written in american english.
        - `type` string, required
      - `meta` UiNodeMeta, required — This might include a label and other information that can optionally be used to render UIs.
        - `label` UiText
          - `context` object — The message's context. Useful when customizing messages.
          - `id` integer, required
          - `text` string, required — The message text. Written in american english.
          - `type` string, required
      - `type` 'text' | 'input' | 'img' | 'a' | 'script', required — The node's type

## Other responses

- `303` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
- `400` — selfServiceVerificationFlow
- `410` — jsonError
- `500` — jsonError

## Changes

- **2022-06-01** `fca041c7721f` — 1 breaking, 26 warning, 5 info
  - request body became required
  - added the new `a` enum value to the `ui/nodes/items/type` response property for the response status `200`
  - added the new `a` enum value to the `ui/nodes/items/type` response property for the response status `400`
  - added the new `default` enum value to the `ui/nodes/items/group` response property for the response status `200`
  - …28 more
- **2022-03-25** `7402181057bd` — 1 info
  - added the non-success response with the status `410`
- **2022-03-22** `028a4cf83c15` — 8 info
  - added the non-success response with the status `303`
  - removed the non-success response with the status `302`
  - the response property `ui/nodes/items/attributes/oneOf[subschema #3: ImageAttributes represents the attributes of an image node.]/height` became required for the status `200`
  - the response property `ui/nodes/items/attributes/oneOf[subschema #3: ImageAttributes represents the attributes of an image node.]/height` became required for the status `400`
  - …4 more
- …earlier changes not shown

[Full history](https://skmtc.dev/ory/apis/ory-identities-api/changes/self-service/verification/post.md)

---

[API](https://skmtc.dev/ory/apis/ory-identities-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-identities-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-identities-api/revisions/fca041c7721f/schema)