---
title: "Initialize Verification Flow for API Clients"
method: GET
path: "/self-service/verification/api"
tags: ["public"]
---

# Initialize Verification Flow for API Clients

`GET /self-service/verification/api`

This endpoint initiates a verification flow for API clients such as mobile devices, smart TVs, and so on.

To fetch an existing verification flow call `/self-service/verification/flows?flow=<flow_id>`.

:::warning

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server
Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make
you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

:::

More information can be found at [Ory Kratos Email and Phone Verification Documentation](https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation).

## Response `200`

verificationFlow

- VerificationFlow — Used to verify an out-of-band communication channel such as an email address or a phone number. For more information head over to: https://www.ory.sh/docs/kratos/self-service/flows/verify-email-account-activation
  - `active` string — Active, if set, contains the registration method that is being used. It is initially not set.
  - `expires_at` string, date-time — ExpiresAt is the time (UTC) when the request expires. If the user still wishes to verify the address, a new request has to be initiated.
  - `id` string, uuid4
  - `issued_at` string, date-time — IssuedAt is the time (UTC) when the request occurred.
  - `messages` UiText[]
    - `context` object — The message's context. Useful when customizing messages.
    - `id` integer, required
    - `text` string, required — The message text. Written in american english.
    - `type` string, required
  - `methods` object, required — Methods contains context for all account verification methods. If a registration request has been processed, but for example the password is incorrect, this will contain error messages.
  - `request_url` string — RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.
  - `state` string, required
  - `type` string — The flow type can either be `api` or `browser`.

## Other responses

- `400` — genericError
- `500` — genericError

---

[API](https://skmtc.dev/ory/apis/ory-kratos-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-kratos-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-kratos-api/revisions/e77b8bae3f57/schema)