---
title: "Initialize Settings Flow for API Clients"
method: GET
path: "/self-service/settings/api"
tags: ["public"]
---

# Initialize Settings Flow for API Clients

`GET /self-service/settings/api`

This endpoint initiates a settings flow for API clients such as mobile devices, smart TVs, and so on.
You must provide a valid Ory Kratos Session Token for this endpoint to respond with HTTP 200 OK.

To fetch an existing settings flow call `/self-service/settings/flows?flow=<flow_id>`.

:::warning

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

:::

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Response `200`

settingsFlow

- SettingsFlow — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
  - `id` string, uuid4, required
  - `identity` Identity, required
    - `id` string, uuid4, required
    - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `id` string, uuid4, required
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `traits` Traits, required
    - `verifiable_addresses` VerifiableAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `id` string, uuid4, required
      - `status` string, required
      - `value` string, required
      - `verified` boolean, required
      - `verified_at` string, date-time
      - `via` string, required
  - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
  - `messages` UiText[]
    - `context` object — The message's context. Useful when customizing messages.
    - `id` integer, required
    - `text` string, required — The message text. Written in american english.
    - `type` string, required
  - `methods` object, required — Methods contains context for all enabled registration methods. If a settings flow has been processed, but for example the first name is empty, this will contain error messages.
  - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `state` string, required
  - `type` string — The flow type can either be `api` or `browser`.

## Other responses

- `400` — genericError
- `500` — genericError

---

[API](https://skmtc.dev/ory/apis/ory-kratos-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-kratos-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-kratos-api/revisions/e77b8bae3f57/schema)