ORory
frontend

Create Recovery Flow for Native Apps

This endpoint initiates a recovery flow for API clients such as mobile devices, smart TVs, and so on.

If a valid provided session cookie or session token is provided, a 400 Bad Request error.

On an existing recovery flow, use the getRecoveryFlow API endpoint.

You MUST NOT use this endpoint in client-side (Single Page Apps, ReactJS, AngularJS) nor server-side (Java Server Pages, NodeJS, PHP, Golang, ...) browser applications. Using this endpoint in these applications will make you vulnerable to a variety of CSRF attacks.

This endpoint MUST ONLY be used in scenarios such as native mobile apps (React Native, Objective C, Swift, Java, ...).

More information can be found at Ory Kratos Account Recovery Documentation.

get/self-service/recovery/api

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /self-service/recovery/api
  • Auth
    none declared

Response

recoveryFlow

activestring

Active, if set, contains the recovery method that is being used. It is initially not set.

continue_withContinueWith[]

Contains possible actions that could follow this flow

expires_atstring date-time required

ExpiresAt is the time (UTC) when the request expires. If the user still wishes to update the setting, a new request has to be initiated.

idstring uuid required

ID represents the request's unique ID. When performing the recovery flow, this represents the id in the recovery ui's query parameter: http://<selfservice.flows.recovery.ui_url>?request=<id>

issued_atstring date-time required

IssuedAt is the time (UTC) when the request occurred.

request_urlstring required

RequestURL is the initial URL that was requested from Ory Kratos. It can be used to forward information contained in the URL's path or query for example.

return_tostring

ReturnTo contains the requested return_to URL.

stateunknown required
transient_payloadobject

TransientPayload is used to pass data from the recovery flow to hooks and email templates

typestring required

The flow type can either be api or browser.

Changes

No recorded changes to this operation across all 65 revisions of this API.