---
title: "Complete Settings Flow with Username/Email Password Method"
method: POST
path: "/self-service/settings/methods/password"
tags: ["public"]
---

# Complete Settings Flow with Username/Email Password Method

`POST /self-service/settings/methods/password`

Use this endpoint to complete a settings flow by sending an identity's updated password. This endpoint
behaves differently for API and browser flows.

API-initiated flows expect `application/json` to be sent in the body and respond with
HTTP 200 and an application/json body with the session token on success;
HTTP 302 redirect to a fresh settings flow if the original flow expired with the appropriate error messages set;
HTTP 400 on form validation errors.
HTTP 401 when the endpoint is called without a valid session token.
HTTP 403 when `selfservice.flows.settings.privileged_session_max_age` was reached.
Implies that the user needs to re-authenticate.

Browser flows expect `application/x-www-form-urlencoded` to be sent in the body and responds with
a HTTP 302 redirect to the post/after settings URL or the `return_to` value if it was set and if the flow succeeded;
a HTTP 302 redirect to the Settings UI URL with the flow ID containing the validation errors otherwise.
a HTTP 302 redirect to the login endpoint when `selfservice.flows.settings.privileged_session_max_age` was reached.

More information can be found at [Ory Kratos User Settings & Profile Management Documentation](../self-service/flows/user-settings).

## Query parameters

- `flow` string

## Request body

- CompleteSelfServiceSettingsFlowWithPasswordMethod
  - `csrf_token` string — CSRFToken is the anti-CSRF token type: string
  - `password` string, required — Password is the updated password type: string

## Response `200`

settingsViaApiResponse

- SettingsViaApiResponse — The Response for Settings Flows via API
  - `flow` SettingsFlow, required — This flow is used when an identity wants to update settings (e.g. profile data, passwords, ...) in a selfservice manner. We recommend reading the [User Settings Documentation](../self-service/flows/user-settings)
    - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
    - `expires_at` string, date-time, required — ExpiresAt is the time (UTC) when the flow expires. If the user still wishes to update the setting, a new flow has to be initiated.
    - `id` string, uuid4, required
    - `identity` Identity, required
      - `id` string, uuid4, required
      - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
        - `id` string, uuid4, required
        - `value` string, required
        - `via` string, required
      - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
      - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
      - `traits` Traits, required
      - `verifiable_addresses` VerifiableAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
        - `id` string, uuid4, required
        - `status` string, required
        - `value` string, required
        - `verified` boolean, required
        - `verified_at` string, date-time
        - `via` string, required
    - `issued_at` string, date-time, required — IssuedAt is the time (UTC) when the flow occurred.
    - `messages` UiText[]
      - `context` object — The message's context. Useful when customizing messages.
      - `id` integer, required
      - `text` string, required — The message text. Written in american english.
      - `type` string, required
    - `methods` object, required — Methods contains context for all enabled registration methods. If a settings flow has been processed, but for example the first name is empty, this will contain error messages.
    - `request_url` string, required — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
    - `state` string, required
    - `type` string — The flow type can either be `api` or `browser`.
  - `identity` Identity, required
    - `id` string, uuid4, required
    - `recovery_addresses` RecoveryAddress[] — RecoveryAddresses contains all the addresses that can be used to recover an identity.
      - `id` string, uuid4, required
      - `value` string, required
      - `via` string, required
    - `schema_id` string, required — SchemaID is the ID of the JSON Schema to be used for validating the identity's traits.
    - `schema_url` string, required — SchemaURL is the URL of the endpoint where the identity's traits schema can be fetched from. format: url
    - `traits` Traits, required
    - `verifiable_addresses` VerifiableAddress[] — VerifiableAddresses contains all the addresses that can be verified by the user.
      - `id` string, uuid4, required
      - `status` string, required
      - `value` string, required
      - `verified` boolean, required
      - `verified_at` string, date-time
      - `via` string, required

## Other responses

- `302` — Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 201.
- `400` — settingsFlow
- `401` — genericError
- `403` — genericError
- `500` — genericError

---

[API](https://skmtc.dev/ory/apis/ory-kratos-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-kratos-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-kratos-api/revisions/e77b8bae3f57/schema)